Process Mining Tutorial Computational Intelligence in HealthCare 20 - - PowerPoint PPT Presentation

Process Mining

prof.dr.ir. Wil van der Aalst

www.processmining.org Tutorial Computational Intelligence in HealthCare 20 - 24 September 2010, Eindhoven, the Netherlands

Focus of most modeling and analysis techniques is on right-hand side …

diagnosis/ requirements configuration/ implementation enactment/ monitoring adustment (re)design models data insight discussion verification performance analysis animation specification documentation configuration

Let’s play …

event log process model

Play-In

event log process model

Play-Out

event log process model

Replay

• extended model

showing times, frequencies, etc.

• diagnostics
• predictions
• recommendations

Menu

1. Introduction to process mining 2. Two types of processes:

• Lasagna processes
• Spaghetti processes

3. The Alpha algorithm 4. Over/underfitting 5. Replay

• Conformance checking
• Predictions

6. Process mining Software (BI versus ProM)

http://www.canarypete.be/

Growth of data

Data Mining

Process Mining = Process Analysis

• ffer

• ffer

+

Process Mining

• Process discovery: "What is

really happening?"

• Conformance checking: "Do

we do what was agreed upon?"

• Performance analysis:

"Where are the bottlenecks?"

• Process prediction: "Will this

case be late?"

• Process improvement: "How

to redesign this process?"

• Etc.

Process Discovery Example

α

>,→,||,# relations

• Direct succession: x>y iff

for some case x is directly followed by y.

• Causality: x→y iff x>y and

not y>x.

• Parallel: x||y iff x>y and

y>x

• Choice: x#y iff not x>y and

not y>x.

case 1 : task A case 2 : task A case 3 : task A case 3 : task B case 1 : task B case 1 : task C case 2 : task C case 4 : task A case 2 : task B case 2 : task D case 5 : task A case 5 : task E case 4 : task C case 1 : task D case 3 : task C case 3 : task D case 4 : task B case 5 : task D case 4 : task D

A>B A>C A>E B>C B>D C>B C>D E>D A→B A→C A→E B→D C→D E→D B||C C||B

ABCD ACBD AED

Basic Idea Used by α Algorithm (1)

a b (a) sequence pattern: a→b

Basic Idea Used by α Algorithm (2)

a b c (b) XOR-split pattern: a→b, a→c, and b#c

a b c (c) XOR-join pattern: a→c, b→c, and a#b

a b c (b) XOR-split pattern: a→b, a→c, and b#c

Basic Idea Used by α Algorithm (3)

a b c (d) AND-split pattern: a→b, a→c, and b||c

a b c (e) AND-join pattern: a→c, b→c, and a||b

a b c (d) AND-split pattern: a→b, a→c, and b||c

Example Revisited

A B C D E p2 end p4 p3 p1 start B#E C#E …

Result produced by α algorithm

A>B A>C A>E B>C B>D C>B C>D E>D A→B A→C A→E B→D C→D E→D B||C C||B

Process mining: Linking events to models

software system (process) model event logs

models analyzes

discovery

records events, e.g., messages, transactions, etc. specifies configures implements analyzes supports/ controls

extension conformance

“world”

people machines

• rganizations

components business processes

Old Toolset

22-

software system (process) model event logs

models analyzes

discovery

records events, e.g., messages, transactions, etc. specifies configures implements analyzes supports/ controls

extension conformance

“world”

people machines

• rganizations

components business processes

ProMimport MXML

New Toolset

22-

software system (process) model event logs

models analyzes

discovery

records events, e.g., messages, transactions, etc. specifies configures implements analyzes supports/ controls

extension conformance

“world”

people machines

• rganizations

components business processes

XESame 5.2 ►6.0 MXML ►XES

Motivation for changes

22-

software system (process) model event logs

models analyzes

discovery

records events, e.g., messages, transactions, etc. specifies configures implements analyzes supports/ controls

extension conformance

“world”

people machines

• rganizations

components business processes

XESame 5.2 ►6.0 MXML ►XES

dist stri ributio ion deco coupling ng log

• gic

c and nd UI dealing ng w with h hund ndre reds of

• f plug

ug-ins ns extendible ble se sema mantics no p no prog rogra ramm mming ing map mapping p prob roblems

Where did we apply process mining?

• Municipalities (e.g., Alkmaar, Heusden, Harderwijk, etc.)
• Government agencies (e.g., Rijkswaterstaat, Centraal

Justitieel Incasso Bureau, Justice department)

• Insurance related agencies (e.g., UWV)
• Banks (e.g., ING Bank)
• Hospitals (e.g., AMC hospital, Catharina hospital)
• Multinationals (e.g., DSM, Deloitte)
• High-tech system manufacturers and their customers

(e.g., Philips Healthcare, ASML, Ricoh, Thales)

• Media companies (e.g. Winkwaves)
• ...

Example of a Lasagna Process

Example: WMO Harderwijk

• Process related to the execution of “Wet

Maatschappelijke Ondersteuning” (WMO) Harderwijk

• Handling WMO applications
• WMO: supporting citizens of municipalities (illness,

handicaps, elderly, etc.).

• Examples:
• wheelchair, scootmobiel, ...
• adaptation of house (elevator), ...
• household help, ...

Event log

(796 applications, 5187 events)

Helicopter view of 1.5 years

Huge variance in durations

Process discovered using Genetic Miner

Various representations

Fuzzy Miner

Seamless abstraction

more detailed more abstract

Fuzzy Replay

Conformance checking using Replay

= should not have happened but did = should have happened but did not

Performance analysis using Replay

Performance information

Prediction based

• n Replay

Spaghetti Processes

Balanci ncing ng B Between n Underfitt ittin ing a g and Overfit ittin ting

Process spectrum

structured (Lasagna) unstructured (Spaghetti)

How can process mining help?

• Detect bottlenecks
• Detect deviations
• Performance

measurement

• Suggest

improvements

• Decision support

(recommendation and prediction)

• Provide mirror
• Highlight important

problems

• Avoid ICT failures
• Avoid management

by PowerPoint

• From “politics” to

“analytics”

Learning processes: The Alpha Algorithm

Process Mining: The alpha algorithm

α

algorithm

• fferte uitgeprint

• ntbrekende

• ntvangen

• pvagen gegevens

• nvoldoende

Alpha algorithm

Without transactional information (just completes)

Starting point: event logs

event logs, audit trails, databases, message logs, etc. www.xes-standard.org

XES (compatible with MXML)

Event log consists of:

• traces (process instances)

− events

• Standard extensions:
• concept (for naming)
• lifecycle (for transactional properties)
• org (for the organizational perspective)
• time (for timestamps)
• semantic (for ontology references)

extensions loaded every trace has a name every event has a name and a transition classifier = name + transition start of trace (i.e. process instance) name of trace name of event (activity name) resource transition timestamp

start of trace name of trace name of event (activity name) resource data associated to event timestamp end of trace (i.e. process instance)

Example log

• Minimal information in log: case

id’s and task id’s.

• Additional information: event

type, time, resources, and data.

• Sequences:
• 1: ABCD
• 2: ACBD
• 3: ABCD
• 4: ACBD
• 5: EF
• So this log there are three

possible sequences:

• ABCD
• ACBD
• EF

case 1 : task A case 2 : task A case 3 : task A case 3 : task B case 1 : task B case 1 : task C case 2 : task C case 4 : task A case 2 : task B case 2 : task D case 5 : task E case 4 : task C case 1 : task D case 3 : task C case 3 : task D case 4 : task B case 5 : task F case 4 : task D

>,→,||,# relations

• Direct succession: x>y iff

for some case x is directly followed by y.

• Causality: x→y iff x>y and

not y>x.

• Parallel: x||y iff x>y and

y>x

• Choice: x#y iff not x>y and

not y>x.

case 1 : task A case 2 : task A case 3 : task A case 3 : task B case 1 : task B case 1 : task C case 2 : task C case 4 : task A case 2 : task B case 2 : task D case 5 : task E case 4 : task C case 1 : task D case 3 : task C case 3 : task D case 4 : task B case 5 : task F case 4 : task D

A>B A>C B>C B>D C>B C>D E>F A→B A→C B→D C→D E→F B||C C||B

ABCD ACBD EF

Basic idea (1) x y

x→y

Basic idea (2)

x→y, x→z, and y||z

x z y

Basic idea (3)

x→y, x→z, and y#z

x z y

Basic idea (4)

x→z, y→z, and x||y

x y z

Basic idea (5)

x→z, y→z, and x#y

x y z

It is not that simple! Basic Alpha algorithm

Let W be a workflow log over T. α(W) is defined as follows.

• 1. TW = { t ∈ T | ∃σ ∈ W t ∈ σ},
• 2. TI = { t ∈ T | ∃σ ∈ W t = first(σ) },
• 3. TO = { t ∈ T | ∃σ ∈ W t = last(σ) },
• 4. XW = { (A,B) | A ⊆ TW ∧ A ≠ ø ∧ B ⊆ TW ∧ B ≠ ø ∧

∀a ∈ A∀b ∈ B a →W b ∧ ∀a1,a2 ∈ A a1#W a2 ∧ ∀b1,b2 ∈ B b1#W b2 },

• 5. YW = { (A,B) ∈ X | ∀(A′,B′) ∈ X A ⊆ A′ ∧B ⊆ B′⇒ (A,B) = (A′,B′) },
• 6. PW = { p(A,B) | (A,B) ∈ YW } ∪{iW,oW},
• 7. FW = { (a,p(A,B)) | (A,B) ∈ YW ∧ a ∈ A } ∪ { (p(A,B),b) | (A,B) ∈

YW ∧ b ∈ B } ∪{ (iW,t) | t ∈ TI} ∪{ (t,oW) | t ∈ TO}, and

• 8. α(W) = (PW,TW,FW).

Example revisited

W:

case case 1 1 : t : task ask A A case case 2 2 : t : task ask A A case case 3 3 : t : task ask A A case case 3 3 : t : task ask B B case case 1 1 : t : task ask B B case case 1 1 : t : task ask C C case case 2 2 : t : task ask C C case case 4 4 : t : task ask A A case case 2 2 : t : task ask B B case case 2 2 : t : task ask D D case case 5 5 : t : task ask E E case case 4 4 : t : task ask C C case case 1 1 : t : task ask D D case case 3 3 : t : task ask C C case case 3 3 : t : task ask D D case case 4 4 : t : task ask B B case case 5 5 : t : task ask F F case case 4 4 : t : task ask D D

A B C D E F

α(W)

A>B A>C B>C B>D C>B C>D E>F A→B A→C B→D C→D E→F B||C C||B

Exercise (1)

• What does the Alpha algorithm produce for a log

consisting only of the following traces?

• ABCD
• ACBD
• AED
• Direct succession: x>y iff for

some case x is directly followed by y.

• Causality: x→y iff x>y and not y>x.
• Parallel: x||y iff x>y and y>x
• Choice: x#y iff not x>y and not

y>x.

Let W be a workflow log over T. α(W) is defined as follows.

• 1. TW = { t ∈ T | ∃σ ∈ W t ∈ σ},
• 2. TI = { t ∈ T | ∃σ ∈ W t = first(σ) },
• 3. TO = { t ∈ T | ∃σ ∈ W t = last(σ) },
• 4. XW = { (A,B) | A ⊆ TW ∧ A ≠ ø ∧ B ⊆ TW ∧ B ≠ ø ∧

∀a ∈ A∀b ∈ B a →W b ∧ ∀a1,a2 ∈ A a1#W a2 ∧ ∀b1,b2 ∈ B b1#W b2 },

• 5. YW = { (A,B) ∈ X | ∀(A′,B′) ∈ X A ⊆ A′ ∧B ⊆ B′⇒ (A,B) =

(A′,B′) },

• 6. PW = { p(A,B) | (A,B) ∈ YW } ∪{iW,oW},
• 7. FW = { (a,p(A,B)) | (A,B) ∈ YW ∧ a ∈ A } ∪ {

(p(A,B),b) | (A,B) ∈ YW ∧ b ∈ B } ∪{ (iW,t) | t ∈ TI} ∪{ (t,oW) | t ∈ TO}, and

• 8. α(W) = (PW,TW,FW).

Another example taken step-by-step ...

A>B A>C A>E B>C D>D C>B C>D E>D A→B A→C A→E B→D C→D E→D B||C C||B

A and B need to be non-empty.

A>B A>C A>E B>C D>D C>B C>D E>D A→B A→C A→E B→D C→D E→D B||C C||B

# #

Exercise (2)

• What does the Alpha algorithm produce for a log

consisting only of the following traces?

• ACD
• BCE
• Direct succession: x>y iff for

some case x is directly followed by y.

• Causality: x→y iff x>y and not y>x.
• Parallel: x||y iff x>y and y>x
• Choice: x#y iff not x>y and not

y>x.

Let W be a workflow log over T. α(W) is defined as follows.

• 1. TW = { t ∈ T | ∃σ ∈ W t ∈ σ},
• 2. TI = { t ∈ T | ∃σ ∈ W t = first(σ) },
• 3. TO = { t ∈ T | ∃σ ∈ W t = last(σ) },
• 4. XW = { (A,B) | A ⊆ TW ∧ A ≠ ø ∧ B ⊆ TW ∧ B ≠ ø ∧

∀a ∈ A∀b ∈ B a →W b ∧ ∀a1,a2 ∈ A a1#W a2 ∧ ∀b1,b2 ∈ B b1#W b2 },

• 5. YW = { (A,B) ∈ X | ∀(A′,B′) ∈ X A ⊆ A′ ∧B ⊆ B′⇒ (A,B) =

(A′,B′) },

• 6. PW = { p(A,B) | (A,B) ∈ YW } ∪{iW,oW},
• 7. FW = { (a,p(A,B)) | (A,B) ∈ YW ∧ a ∈ A } ∪ {

(p(A,B),b) | (A,B) ∈ YW ∧ b ∈ B } ∪{ (iW,t) | t ∈ TI} ∪{ (t,oW) | t ∈ TO}, and

• 8. α(W) = (PW,TW,FW).

Exercise (3)

• What does the Alpha algorithm produce for a log

consisting only of the following traces?

• ACEG
• AECG
• BDFG
• BFDG
• Direct succession: x>y iff for

some case x is directly followed by y.

• Causality: x→y iff x>y and not y>x.
• Parallel: x||y iff x>y and y>x
• Choice: x#y iff not x>y and not

y>x.

Let W be a workflow log over T. α(W) is defined as follows.

• 1. TW = { t ∈ T | ∃σ ∈ W t ∈ σ},
• 2. TI = { t ∈ T | ∃σ ∈ W t = first(σ) },
• 3. TO = { t ∈ T | ∃σ ∈ W t = last(σ) },
• 4. XW = { (A,B) | A ⊆ TW ∧ A ≠ ø ∧ B ⊆ TW ∧ B ≠ ø ∧

∀a ∈ A∀b ∈ B a →W b ∧ ∀a1,a2 ∈ A a1#W a2 ∧ ∀b1,b2 ∈ B b1#W b2 },

• 5. YW = { (A,B) ∈ X | ∀(A′,B′) ∈ X A ⊆ A′ ∧B ⊆ B′⇒ (A,B) =

(A′,B′) },

• 6. PW = { p(A,B) | (A,B) ∈ YW } ∪{iW,oW},
• 7. FW = { (a,p(A,B)) | (A,B) ∈ YW ∧ a ∈ A } ∪ {

(p(A,B),b) | (A,B) ∈ YW ∧ b ∈ B } ∪{ (iW,t) | t ∈ TI} ∪{ (t,oW) | t ∈ TO}, and

• 8. α(W) = (PW,TW,FW).

More on Process Discovery

Examples of process discovery techniques

• Algorithmic techniques
• Alpha miner
• Alpha+, Alpha++, Alpha#
• FSM miner
• Fuzzy miner
• Heuristic miner
• Multi phase miner
• Genetic process mining
• Single/duplicate tasks
• Distributed GM
• Region-based process mining
• State-based regions
• Language based regions
• Classical approaches not dealing with concurrency
• Inductive inference (Mark Gold, Dana Angluin et al.)
• Sequence mining

Genetic Mining

(Ana Karla Alves de Medeiros et al.)

• 1. initial population
• 2. fitness test
• 3. select best parents
• 4. crossover
• 5. children
• 6. mutation
• 7. new population

Design choices

• 1. initial population
• 2. fitness test
• 3. select best parents
• 4. crossover
• 5. children
• 6. mutation
• 7. new population

representation fitness crossover mutation

Properties of Genetic Mining

• Requires a lot of computing power.
• Can deal with noise, infrequent behavior, duplicate

tasks, invisible tasks, etc.

• Allows for incremental improvement and

combinations with other approaches (heuristics post-optimization, etc.).

Challenge: Balancing Between Underfitting and Overfitting

The essence

A B C D E

ABCD ACBD AED ABCD ABCD AED ACBD ...

But ...

A B C D E

Any log containg activities A, B, C, D, and E.

start end

Finding a balance

A D C E B A D C E B

ACD BCE ... ACD ACE BCE BCD ...

(a) (b) (c) (d)

more behavior more behavior

A D C E B A D C E B

ACD ACE BCE BCD 99 85

A D C E B A D C E B

ACD ACE BCE BCD 99 88 85 78

A D C E B A D C E B

ACD ACE BCE BCD 99 2 85 3

Structure: Is this the simplest model (Occam's Razor)? Fitness: Is the event log possible according to the model? Precision: Is the model not underfitting (allow for too much)? Generalization: Is the model not overfitting (only allow for the “accidental” examples)?

Evaluating process mining results

Representing process models

• f trip

• f a

• f trip

• f travel

• f trip

Highlights more important paths More significant nodes are emphasized

Aggregation

Clustering of coherent, less significant structures

Abstraction

Removing isolated, less significant structures

More to learn from maps...

Fuzzy miner

Showing reality

Back to the future …

software system (process) model event logs

models analyzes

discovery

records events, e.g., messages, transactions, etc. specifies configures implements analyzes supports/ controls

extension conformance

“world”

people machines

• rganizations

components business processes

Pre redi dict ct: When wil will I b be h home? ? At 1 11.26! Rec ecomme

• mmend: How
• w to

to get home ASAP et home ASAP? Take Take a a lef eft tu t turn! Detec etect: You You d drive too ve too fas ast! t!

Operational Support: Detect, Predict, and Recommend

current data historic data (simulation) models learn (discover and enhance) detect predict recommend alerts predictions recommendations

Operational Support and Conformanc Checking Based on Replay

A B C D E p2 end p4 p3 p1 start

Play Out (Classical use of models)

A B C D A C B D A B C D A E D A C B D A C B D A E D A E D

Play In (Process Discovery)

A B C D E p2 end p4 p3 p1 start

ABCD ACBD AED ACBD AED ABCD … a process discovery algorithm like the α algorithm

A B C D E p2 end p4 p3 p1 start

Replay

A B C D

A B C D E p2 end p4 p3 p1 start

Replay can detect problems

AC D

Problem! missing token Problem! token left behind

A B C D E p2 end p4 p3 p1 start

Replay can extract timing information

A5B8 C9D13

5 8 9 13

3 4 5 4

3 2 6 5 8 7 6 4 7 7 4 3

Example: Conformance Checker

Conformance checker

(Anne Rozinat et al.)

How to quantify this?

Fitness by replay

m=missing,r=remaining,c=consumed,p=produced

No problem (m=0, r=0)

Another (impossible) trace

Fitness calculation

Examples

f=1.000 f=0.995 f=0.540

Diagnostics

Other Metrics

• Fitness is not sufficient: hence other metrics are

needed such as behavioral and structural appropriateness, etc.

• These metrics cover aspects such as:
• Punishing for "too much" behavior.
• Punishing for "overly complex" models.

Another Replay Example: Time-based Operational Support (TOS)

Architecture

Step 1: Learn Transition System

Prefix-set-activity abstraction is used here. Other abstractions possible.

Step 2: Replay Log for Time Information

e=elapsed, r=remaining, and s=sojourn.

Step 3: Calculate statistics

Step 4: Start Operational Support

A B C D

known past unknown future current state

A B A B ? ? A B C ?

detect: B does not fit the model (not allowed, too late, etc.) predict: some prediction is made about the future (e.g. completion date or outcome)

T=10

recommend: based on past experiences C is recommended (e.g., to minimize costs)

Business Intelligence Tools?

Business Intelligence Tools?

• Business Objects (SAP)
• Cognos Business Intelligence (IBM)
• Oracle Business Intelligence
• Hyperion (Oracle)
• SAS Business Intelligence
• Microsoft Business Intelligence
• SAP Business Intelligence (SAP BI)
• Jaspersoft (Open Source Business Intelligence)
• Pentaho BI Suite (Open Source)
• ....
• Dashboards, reports, scorecards,
• Slicing and dicing, data mining, ...

Process Mining Software

ARIS Process Performance Manager Interstage Automated Business Process Discovery & Visualization Process Discovery Focus Futura Reflect Enterprise Visualization Suite Comprehend BPM|one fluxicon/nitro ProcessGold

Conclusion

Process Mining !

More Information

IEEE Task Force on Process Mining

• ProM Software: prom.sourceforge.net
• Process mining: www.processmining.org
• ProM 5 series nightly builds: prom.win.tue.nl/tools/prom/nightly5/
• ProM 6 series nightly builds: prom.win.tue.nl/tools/prom/nightly/
• Converting logs (MXML-based) promimport.sourceforge.net
• XES: www.xes-standard.org and www.openxes.org
• Papers et al.: vdaalst.com
• IEEE Task Force on Process Mining: www.win.tue.nl/ieeetfpm/