SlideShare a Scribd company logo
From Low-Level Events to Activities
A Pattern-based Approach
Felix Mannhardt, Massimiliano de Leoni, Hajo A. Reijers,
Wil M.P. van der Aalst, Pieter J. Toussaint (NTNU, Trondheim)
Presented at BPM 2016: 10.1007/978-3-319-45348-4_8
Problem: Events ≠ Recognizable high-level activities
PAGE 1
Alarm
records
Event Time
Red Button 20:08:00
Green Button 20:10:00
Gray Button 20:16:00
Shift
Event Time
Nurse 07:02:00
Green Button 07:15:00
Gray Button 07:18:00
records
Event Time
Green Button 22:02:00
Gray Button 22:10:00
records
Visit
Goal 1: From low-level events to high-level activities
PAGE 2
Event Log Abstracted Log
Low-level Event Time
Red Button 20:08:00
Green Button 20:10:00
Gray Button 20:16:00
Green Button 22:02:00
Gray Button 22:10:00
Nurse 07:02:00
Green Button 07:15:00
Gray Button 07:18:00
High-level Event Start Complete
Alarm 20:08:00 20:16:00
Visit 22:02:00 22:10:00
Shift 07:02:00 07:18:00
Goal 2: Deal with shared labels, concurrency and noise
PAGE 3
Low-level Event Time
Red Button 20:08:00
Green Button 20:10:00
Gray Button 20:16:00
Green Button 22:02:00
Nurse Changed 22:09:00
Gray Button 22:10:00
Nurse 22:15:00
Nurse 07:02:00
Green Button 07:15:00
Gray Button 07:18:00
High-level Activity Start Complete
Alarm 20:08:00 20:10:00
Visit 22:02:00 22:10:00
Shift 07:02:00 07:18:00
Missing events
Unexpected events
Event Log Abstracted Log
Related work
• Unsupervised event abstraction (Ferreira et al., Folino et al., …)
• Does not take domain knowledge into account
• Supervised event abstraction (Thomas Baier et al., Niek Tax, …)
• Assumes knowledge of a complete process model
• Semi-automatic discovery of the mapping between events and activities
• Uses clustering and constraint satisfaction to determine the mapping
• Uses annotated event logs
• Complex event processing
• Focus on detection of event patterns in data streams
• Not directly considering process instances / traces
PAGE 4
Overview: From Low-level Events to Activities
PAGE 5
Event Log Aligned Log Abstracted Log
Activity
Pattern
Abstraction
Model
3) Align model & log 4) Abstract events
1) Encode knowledge 2) Compose model
1) Encode knowledge on activities as activity patterns
PAGE 6
Alarm Shift
GreenV
GrayV
Pattern defines traces expected for
one activity instance!
Data Petri net used
for clear semantics!
Visit
What about interaction between activity patterns?
PAGE 7
Alarm
Interaction?
GreenV
GrayV
Visit
Overview – Step 2 – Composition
PAGE 8
Event Log Aligned Log Abstracted Log
Activity
Pattern
Abstraction
Model
2) Compose model
2) Build an integrated abstraction model
PAGE 9
Interaction?
Alarm Visit
Parallel
Alarm Visit
Interleaving
↔
Alarm Visit
Choice
✖
Alarm Visit
Sequence
Alarm Visit Alarm
0..✱
Repetition
2) Build an integrated abstraction model
PAGE 10
Handover
Alarm Visit
↔
0..✱
0..✱
0..✱
0..✱
Compile
Abstraction Model
Compiled Abstraction Model (DPN)
Overview – Step 3 – Alignment
PAGE 11
Event Log Aligned Log Abstracted Log
Activity
Pattern
Abstraction
Model
3) Align model & log
3) Align event log to abstraction model
PAGE 12
Event Log
Low-level Event Time
Red Button 20:08:00
Green Button 20:10:00
Green Button 22:02:00
Nurse 22:09:00
Gray Button 22:10:00
Nurse 22:15:00
Nurse 07:02:00
Green Button 07:15:00
Gray Button 07:18:00
Compiled abstraction model
Alignments
3) Align event log to abstraction model
Low-level Event Time
Red Button 20:08:00
Green Button 20:10:00
Green Button 22:02:00
Nurse 22:09:00
Gray Button 22:10:00
Nurse 22:15:00
Nurse 07:02:00
Green Button 07:15:00
Gray Button 07:18:00
Process Step Time
RedA 20:08:00
GreenA 20:10:00
GrayA
GreenV 22:02:00
GrayV 22:10:00
NurseS 07:02:00
GreenS 07:15:00
GrayS 07:18:00
Event Log Existing alignment methods [1] Aligned Log
Model only
Log only
…
[1] Balanced multi-perspective checking of process conformance.
Computing. 98 (4). 2016
Overview – Step 4 – Abstract Events
PAGE 14
Event Log Aligned Log Abstracted Log
Activity
Pattern
Abstraction
Model
4) Abstract events
4) Create an abstracted event log for high-level activities
PAGE 15
Aligned Log
Abstract aligned events
Abstracted Log
High-level Event Transition Time
Alarm start 20:08:00
Alarm complete 20:10:00
Visit start 22:02:00
Visit complete 22:10:00
Shift start 07:02:00
Shift complete 07:18:00
Process Step Time
RedA 20:08:00
GreenA 20:10:00
GrayA
GreenV 22:02:00
GrayV 22:10:00
NurseS 07:02:00
GreenS 07:15:00
GrayS 07:18:00
Alarm
Visit
Shift
Use time of previous
mapped event.
Alignment forced a model
move: Matching error!
Additional data attributes
can be mapped!
Recap: Abstraction Method
PAGE 16
Event Log Aligned Log Abstracted Log
Activity
Pattern
Abstraction
Model
3) Align event log to
abstraction model
4) Abstract based
on aligned log
1) Encode knowledge
on activities as patterns
2) Build
integrated model
Evaluation: Digital whiteboard system in a hospital
PAGE 17
• Information system
• Digital whiteboard
• Supports work of nurses
• Mixed clinical & logistic info
• Flexible system
• Dataset
• One year
• > 8,000 cases
• > 280,000 events
• Event per changed cell
Evaluation: Activity Patterns
PAGE 18
• 18 activity patterns
• Our assumptions
• Interview with expert
• Abstraction model
• Most interleaved & repeated
• Five concurrent activities
• Resulting abstraction
• Low average error rate
• Successful abstraction
Evaluation: Detected shift change pattern
PAGE 19
Shift pattern captures
a meaningful activity
Blue: Nurse
Green: Call Signal Green
Yellow: Call Signal Gray
Relatively rare pattern!
00:00 24:00 00:00 24:00
Conclusion & Future work
PAGE 20
• Method
• Pattern-based event abstraction
• Knowledge encoded as activity patterns
• Abstraction using alignment methods
• Results
• Handles shared labels, concurrency and noise
• Alignment gives reliability measure
• Successfully used in case studies
• Future work
• Prioritization among activity patterns
• Decomposed / approximate alignment methods
• Mining / recommendation of suitable patterns Implemented in ProM 6.6
Questions?
PAGE 21
@fmannhardt - f.mannhardt@tue.nl
fmannhardt.de/g/pba - Documentation & Installation
Backup: Mapping of the interactions to DPN
PAGE 22
Parallel
Alarm Visit
Interleaving
↔
Alarm Visit
Choice
✖
Alarm Visit
Sequence
Alarm Visit
Alarm
Visit
source sink
Alarm
Visit
source sink
Alarm
Visit
source sink
Alarm
Visit
source sink
Backup: Result using IVM
PAGE 23
Examinations recorded by
multiple TreatmentChanged
Unabstracted events
Abstracted events
300 patients with Chest Pain
receive an X-Ray
Transfer  Discharge

More Related Content

PPTX
From Low-Level Events to Activities - A Pattern based Approach
PPTX
Unsupervised Event Abstraction using Pattern Abstraction and Local Process Mo...
PDF
Scalable Machine Learning
PDF
ODSC UK 2016: How To Analyse Weather Data and Twitter Sentiment with Spark an...
PDF
Network Intelligence Driven Human Behavior Modeling
PDF
GurminderBharani_Masters_Thesis
PDF
Scaling Pattern and Sequence Queries in Complex Event Processing
KEY
Flexible Event Tracking (Paul Gebheim)
From Low-Level Events to Activities - A Pattern based Approach
Unsupervised Event Abstraction using Pattern Abstraction and Local Process Mo...
Scalable Machine Learning
ODSC UK 2016: How To Analyse Weather Data and Twitter Sentiment with Spark an...
Network Intelligence Driven Human Behavior Modeling
GurminderBharani_Masters_Thesis
Scaling Pattern and Sequence Queries in Complex Event Processing
Flexible Event Tracking (Paul Gebheim)

Similar to From Low-Level Events to Activities - A Pattern-based Approach (20)

PDF
The application of process mining in a simulated smart environment to derive ...
PDF
PDF
RuleML 2015: When Processes Rule Events
PPTX
Semantic-based Process Analysis
PDF
MULTI-AGENT BASED IOT SMART WASTE MONITORING AND COLLECTION ARCHITECTURE
PPT
2011 NIJ Crime Mapping Conference - Data Mining and Risk Forecasting in Web-b...
PDF
MULTI-AGENT BASED IOT SMART WASTE MONITORING AND COLLECTION ARCHITECTURE
PDF
Introduction to Streaming Analytics
PDF
Using IoT to manage water
PPTX
Event Processing Using Semantic Web Technologies
PPTX
Multi-Perspective Comparison of Business Processes Variants Based on Event Logs
PPTX
What does "monitoring" mean? (FOSDEM 2017)
PDF
BDE ESD Tool - Big Data Met NORWAY Rasmus Benestad
PDF
ESD-big data by Rasmus Benestad
PPTX
Ian wcre2011
PDF
ERP data warehousing in organiz 1st Edition by Gerald Grant ISBN
PDF
Digital journey of a mid sized city : From strategy to concrete implementations
PPTX
INTERNET OF THINGS IMPLEMENTATION FOR WIRELESS MONITORING OF AGRICULTURAL...
PDF
PDF
Building Smart Cities: The Data-Driven Way (Created For The Big 5 Construct 2...
The application of process mining in a simulated smart environment to derive ...
RuleML 2015: When Processes Rule Events
Semantic-based Process Analysis
MULTI-AGENT BASED IOT SMART WASTE MONITORING AND COLLECTION ARCHITECTURE
2011 NIJ Crime Mapping Conference - Data Mining and Risk Forecasting in Web-b...
MULTI-AGENT BASED IOT SMART WASTE MONITORING AND COLLECTION ARCHITECTURE
Introduction to Streaming Analytics
Using IoT to manage water
Event Processing Using Semantic Web Technologies
Multi-Perspective Comparison of Business Processes Variants Based on Event Logs
What does "monitoring" mean? (FOSDEM 2017)
BDE ESD Tool - Big Data Met NORWAY Rasmus Benestad
ESD-big data by Rasmus Benestad
Ian wcre2011
ERP data warehousing in organiz 1st Edition by Gerald Grant ISBN
Digital journey of a mid sized city : From strategy to concrete implementations
INTERNET OF THINGS IMPLEMENTATION FOR WIRELESS MONITORING OF AGRICULTURAL...
Building Smart Cities: The Data-Driven Way (Created For The Big 5 Construct 2...
Ad

More from Felix Mannhardt (7)

PPTX
A Taxonomy for Combining Activity Recognition and Process Discovery in Indust...
PPTX
Estimating the Impact of Incidents on Process Delay - ICPM 2019
PPTX
Data-driven Process Discovery - Revealing Conditional Infrequent Behavior fro...
PPTX
Analyzing the Trajectories of Patients with Sepsis using Process Mining
PPTX
XESLite - Handling Event Logs in ProM
PPTX
Measuring the Precision of Multi-perspective Process Models
PPTX
Decision Mining Revisited - Discovering Overlapping Rules
A Taxonomy for Combining Activity Recognition and Process Discovery in Indust...
Estimating the Impact of Incidents on Process Delay - ICPM 2019
Data-driven Process Discovery - Revealing Conditional Infrequent Behavior fro...
Analyzing the Trajectories of Patients with Sepsis using Process Mining
XESLite - Handling Event Logs in ProM
Measuring the Precision of Multi-perspective Process Models
Decision Mining Revisited - Discovering Overlapping Rules
Ad

Recently uploaded (20)

PPTX
7. General Toxicologyfor clinical phrmacy.pptx
PPTX
Microbiology with diagram medical studies .pptx
PPTX
Introduction to Cardiovascular system_structure and functions-1
PDF
AlphaEarth Foundations and the Satellite Embedding dataset
PPTX
2Systematics of Living Organisms t-.pptx
PPTX
Comparative Structure of Integument in Vertebrates.pptx
PDF
Mastering Bioreactors and Media Sterilization: A Complete Guide to Sterile Fe...
PPTX
Taita Taveta Laboratory Technician Workshop Presentation.pptx
PDF
Formation of Supersonic Turbulence in the Primordial Star-forming Cloud
PPTX
Protein & Amino Acid Structures Levels of protein structure (primary, seconda...
PPTX
DRUG THERAPY FOR SHOCK gjjjgfhhhhh.pptx.
PPTX
EPIDURAL ANESTHESIA ANATOMY AND PHYSIOLOGY.pptx
PPTX
G5Q1W8 PPT SCIENCE.pptx 2025-2026 GRADE 5
PPTX
TOTAL hIP ARTHROPLASTY Presentation.pptx
PPTX
ANEMIA WITH LEUKOPENIA MDS 07_25.pptx htggtftgt fredrctvg
PDF
IFIT3 RNA-binding activity primores influenza A viruz infection and translati...
PDF
Biophysics 2.pdffffffffffffffffffffffffff
PDF
SEHH2274 Organic Chemistry Notes 1 Structure and Bonding.pdf
PPTX
2. Earth - The Living Planet earth and life
PPTX
neck nodes and dissection types and lymph nodes levels
7. General Toxicologyfor clinical phrmacy.pptx
Microbiology with diagram medical studies .pptx
Introduction to Cardiovascular system_structure and functions-1
AlphaEarth Foundations and the Satellite Embedding dataset
2Systematics of Living Organisms t-.pptx
Comparative Structure of Integument in Vertebrates.pptx
Mastering Bioreactors and Media Sterilization: A Complete Guide to Sterile Fe...
Taita Taveta Laboratory Technician Workshop Presentation.pptx
Formation of Supersonic Turbulence in the Primordial Star-forming Cloud
Protein & Amino Acid Structures Levels of protein structure (primary, seconda...
DRUG THERAPY FOR SHOCK gjjjgfhhhhh.pptx.
EPIDURAL ANESTHESIA ANATOMY AND PHYSIOLOGY.pptx
G5Q1W8 PPT SCIENCE.pptx 2025-2026 GRADE 5
TOTAL hIP ARTHROPLASTY Presentation.pptx
ANEMIA WITH LEUKOPENIA MDS 07_25.pptx htggtftgt fredrctvg
IFIT3 RNA-binding activity primores influenza A viruz infection and translati...
Biophysics 2.pdffffffffffffffffffffffffff
SEHH2274 Organic Chemistry Notes 1 Structure and Bonding.pdf
2. Earth - The Living Planet earth and life
neck nodes and dissection types and lymph nodes levels

From Low-Level Events to Activities - A Pattern-based Approach

  • 1. From Low-Level Events to Activities A Pattern-based Approach Felix Mannhardt, Massimiliano de Leoni, Hajo A. Reijers, Wil M.P. van der Aalst, Pieter J. Toussaint (NTNU, Trondheim) Presented at BPM 2016: 10.1007/978-3-319-45348-4_8
  • 2. Problem: Events ≠ Recognizable high-level activities PAGE 1 Alarm records Event Time Red Button 20:08:00 Green Button 20:10:00 Gray Button 20:16:00 Shift Event Time Nurse 07:02:00 Green Button 07:15:00 Gray Button 07:18:00 records Event Time Green Button 22:02:00 Gray Button 22:10:00 records Visit
  • 3. Goal 1: From low-level events to high-level activities PAGE 2 Event Log Abstracted Log Low-level Event Time Red Button 20:08:00 Green Button 20:10:00 Gray Button 20:16:00 Green Button 22:02:00 Gray Button 22:10:00 Nurse 07:02:00 Green Button 07:15:00 Gray Button 07:18:00 High-level Event Start Complete Alarm 20:08:00 20:16:00 Visit 22:02:00 22:10:00 Shift 07:02:00 07:18:00
  • 4. Goal 2: Deal with shared labels, concurrency and noise PAGE 3 Low-level Event Time Red Button 20:08:00 Green Button 20:10:00 Gray Button 20:16:00 Green Button 22:02:00 Nurse Changed 22:09:00 Gray Button 22:10:00 Nurse 22:15:00 Nurse 07:02:00 Green Button 07:15:00 Gray Button 07:18:00 High-level Activity Start Complete Alarm 20:08:00 20:10:00 Visit 22:02:00 22:10:00 Shift 07:02:00 07:18:00 Missing events Unexpected events Event Log Abstracted Log
  • 5. Related work • Unsupervised event abstraction (Ferreira et al., Folino et al., …) • Does not take domain knowledge into account • Supervised event abstraction (Thomas Baier et al., Niek Tax, …) • Assumes knowledge of a complete process model • Semi-automatic discovery of the mapping between events and activities • Uses clustering and constraint satisfaction to determine the mapping • Uses annotated event logs • Complex event processing • Focus on detection of event patterns in data streams • Not directly considering process instances / traces PAGE 4
  • 6. Overview: From Low-level Events to Activities PAGE 5 Event Log Aligned Log Abstracted Log Activity Pattern Abstraction Model 3) Align model & log 4) Abstract events 1) Encode knowledge 2) Compose model
  • 7. 1) Encode knowledge on activities as activity patterns PAGE 6 Alarm Shift GreenV GrayV Pattern defines traces expected for one activity instance! Data Petri net used for clear semantics! Visit
  • 8. What about interaction between activity patterns? PAGE 7 Alarm Interaction? GreenV GrayV Visit
  • 9. Overview – Step 2 – Composition PAGE 8 Event Log Aligned Log Abstracted Log Activity Pattern Abstraction Model 2) Compose model
  • 10. 2) Build an integrated abstraction model PAGE 9 Interaction? Alarm Visit Parallel Alarm Visit Interleaving ↔ Alarm Visit Choice ✖ Alarm Visit Sequence Alarm Visit Alarm 0..✱ Repetition
  • 11. 2) Build an integrated abstraction model PAGE 10 Handover Alarm Visit ↔ 0..✱ 0..✱ 0..✱ 0..✱ Compile Abstraction Model Compiled Abstraction Model (DPN)
  • 12. Overview – Step 3 – Alignment PAGE 11 Event Log Aligned Log Abstracted Log Activity Pattern Abstraction Model 3) Align model & log
  • 13. 3) Align event log to abstraction model PAGE 12 Event Log Low-level Event Time Red Button 20:08:00 Green Button 20:10:00 Green Button 22:02:00 Nurse 22:09:00 Gray Button 22:10:00 Nurse 22:15:00 Nurse 07:02:00 Green Button 07:15:00 Gray Button 07:18:00 Compiled abstraction model Alignments
  • 14. 3) Align event log to abstraction model Low-level Event Time Red Button 20:08:00 Green Button 20:10:00 Green Button 22:02:00 Nurse 22:09:00 Gray Button 22:10:00 Nurse 22:15:00 Nurse 07:02:00 Green Button 07:15:00 Gray Button 07:18:00 Process Step Time RedA 20:08:00 GreenA 20:10:00 GrayA GreenV 22:02:00 GrayV 22:10:00 NurseS 07:02:00 GreenS 07:15:00 GrayS 07:18:00 Event Log Existing alignment methods [1] Aligned Log Model only Log only … [1] Balanced multi-perspective checking of process conformance. Computing. 98 (4). 2016
  • 15. Overview – Step 4 – Abstract Events PAGE 14 Event Log Aligned Log Abstracted Log Activity Pattern Abstraction Model 4) Abstract events
  • 16. 4) Create an abstracted event log for high-level activities PAGE 15 Aligned Log Abstract aligned events Abstracted Log High-level Event Transition Time Alarm start 20:08:00 Alarm complete 20:10:00 Visit start 22:02:00 Visit complete 22:10:00 Shift start 07:02:00 Shift complete 07:18:00 Process Step Time RedA 20:08:00 GreenA 20:10:00 GrayA GreenV 22:02:00 GrayV 22:10:00 NurseS 07:02:00 GreenS 07:15:00 GrayS 07:18:00 Alarm Visit Shift Use time of previous mapped event. Alignment forced a model move: Matching error! Additional data attributes can be mapped!
  • 17. Recap: Abstraction Method PAGE 16 Event Log Aligned Log Abstracted Log Activity Pattern Abstraction Model 3) Align event log to abstraction model 4) Abstract based on aligned log 1) Encode knowledge on activities as patterns 2) Build integrated model
  • 18. Evaluation: Digital whiteboard system in a hospital PAGE 17 • Information system • Digital whiteboard • Supports work of nurses • Mixed clinical & logistic info • Flexible system • Dataset • One year • > 8,000 cases • > 280,000 events • Event per changed cell
  • 19. Evaluation: Activity Patterns PAGE 18 • 18 activity patterns • Our assumptions • Interview with expert • Abstraction model • Most interleaved & repeated • Five concurrent activities • Resulting abstraction • Low average error rate • Successful abstraction
  • 20. Evaluation: Detected shift change pattern PAGE 19 Shift pattern captures a meaningful activity Blue: Nurse Green: Call Signal Green Yellow: Call Signal Gray Relatively rare pattern! 00:00 24:00 00:00 24:00
  • 21. Conclusion & Future work PAGE 20 • Method • Pattern-based event abstraction • Knowledge encoded as activity patterns • Abstraction using alignment methods • Results • Handles shared labels, concurrency and noise • Alignment gives reliability measure • Successfully used in case studies • Future work • Prioritization among activity patterns • Decomposed / approximate alignment methods • Mining / recommendation of suitable patterns Implemented in ProM 6.6
  • 22. Questions? PAGE 21 @fmannhardt - f.mannhardt@tue.nl fmannhardt.de/g/pba - Documentation & Installation
  • 23. Backup: Mapping of the interactions to DPN PAGE 22 Parallel Alarm Visit Interleaving ↔ Alarm Visit Choice ✖ Alarm Visit Sequence Alarm Visit Alarm Visit source sink Alarm Visit source sink Alarm Visit source sink Alarm Visit source sink
  • 24. Backup: Result using IVM PAGE 23 Examinations recorded by multiple TreatmentChanged Unabstracted events Abstracted events 300 patients with Chest Pain receive an X-Ray Transfer  Discharge

Editor's Notes

  • #2: Good afternoon, I would like to present our work about “Pattern-based Event Abstraction”. My name is Felix Mannhardt, I’m a PhD student at the Eindhoven University of Technology. This paper is joint work with Massimiliano, Hajo, Wil from Eindhoven and Pieter Toussaint from NTNU, Trondheim.
  • #3: Assume that you want to analyze work at a hospital ward For example, you want to look at three activities: Alarm (activated by a patient) Visit (by a nurse) Handover (from a nurse to another nurse) Looking at events in your event log only events at a lower level of abstraction are recorded For example, Alarm corresponds to: Red Button, Green Button, Gray Button … Our work had two goals
  • #6: Related work (PhD thesis by Thomas Baier): Assume knowledge of the full process model for the overall process Resolves to clustering methods and heuristics for concurrency and noise
  • #9: Can both activities occur concurrently, are there constraints on the cardinality, are they mutually-exclusive
  • #12: Be quick here: For details see the paper & technical report!
  • #17: Remember the other data
  • #25: TODO: maybe show the nurse call model instead! TODO: fix the model for the unabstracted events