A process mining method and device for mass event logs
By using SQL statements to stream massive event logs, the problems of high computer memory consumption and high data transmission costs are solved, enabling efficient and accurate process mining, supporting multi-dimensional analysis, and improving process mining efficiency and decision support.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- QINGLUAN TECH (BEIJING) CO LTD
- Filing Date
- 2023-02-15
- Publication Date
- 2026-07-14
AI Technical Summary
Existing technologies suffer from severe consumption of computer memory resources, high data transmission costs, and poor parallelism when processing massive event logs, resulting in low efficiency in process mining.
SQL statements are used to read massive event logs in a streaming manner for preprocessing and mining, including linking activity lists and route lists, statistical analysis of metric data, domain attribute segmentation and statistics, and construction of process mining models.
It improves the processing efficiency of massive event logs, reduces the consumption of computer equipment memory resources and data transmission costs, supports multi-dimensional and multi-granular process mining, provides more accurate reflection of business process execution, and improves decision support.
Smart Images
Figure CN116361356B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of process mining, and in particular to a method and apparatus for process mining of massive event logs. Background Technology
[0002] The current process mining technology mainly uses process mining algorithm software built with computer programming languages to execute process mining operations on computer devices. Process mining algorithm software built with computer programming languages such as C, C++, Java, and Python reads logs into the memory medium of the computer device for process mining processing, and stores the process model results in the storage medium of the computer device after mining. However, the main problems with this technology are: (1) The process mining algorithm software needs to read all logs into the memory of the computer device for preprocessing (including identification, log tagging, data format conversion, data quality control, etc.), while the memory of the computer device is limited. In processing each event log, complex operations such as process activity extraction, inter-activity routing calculation, and attribute measurement statistics are required, which consume a lot of computer device memory resources. At the same time, due to the separation of process mining calculation and log storage, a large amount of data transmission costs are incurred, resulting in low performance; (2) The above-mentioned complex operations such as process activity extraction, inter-activity routing calculation, and attribute measurement statistics are all concentrated in the log operation of event processing. The operations are highly coupled and cannot achieve parallel operation, so it is impossible to further improve efficiency.
[0003] Massive event logs refer to event logs that are continuously generated at an average rate of over 1000 entries per second. Processing massive event logs is challenging because the sheer volume of logs necessitates continuous process analysis; it's impossible to read and process all logs at once. Therefore, how to achieve process analysis of massive event logs has become a pressing issue. Summary of the Invention
[0004] Based on this, embodiments of the present invention provide a method and apparatus for process mining of massive event logs, so as to efficiently and accurately realize process mining of massive event logs.
[0005] To achieve the above objectives, embodiments of the present invention provide the following solutions:
[0006] A process mining method for massive event logs includes:
[0007] A massive amount of event logs is read using SQL statements in a streaming manner, and the massive amount of event logs is preprocessed to obtain preprocessed data; the preprocessed data includes: an activity list and an inter-activity routing list;
[0008] The preprocessed data is read in one go using SQL statements, and the activity list and the inter-activity routing list are linked to obtain the activity structure and the inter-activity routing structure.
[0009] The metrics of the activity list and the inter-activity routing list are statistically analyzed to obtain metric data, and the metric data is stored in the business data attribute list; the metric data includes: frequency, coverage and time consumption data;
[0010] SQL statements and user-defined functions are used to divide and statistically analyze the domain attributes of the preprocessed data, and hidden activities are mined based on the division and statistical results.
[0011] The domain attributes of the preprocessed data are used to generate a list of query conditions using SQL statements;
[0012] The process mining model is constructed by using SQL statements to read the activity structure, the inter-activity routing structure, the business data attribute list, the hidden activities, and the query condition list in one go; the process mining model is used to characterize the actual execution status of the business process.
[0013] Optionally, SQL statements are used to read massive event logs in a streaming manner, and the massive event logs are preprocessed to obtain preprocessed data, specifically including:
[0014] The system uses SQL statements to read massive event logs in a streaming manner and identifies the data information in the logs. The data information includes event cases and process activities.
[0015] The data information is sequentially subjected to log tagging, data format conversion, and data quality control operations to obtain preprocessed process activity information;
[0016] Based on the preprocessed process activity information, an activity list and an inter-activity routing list are constructed to obtain preprocessed data.
[0017] Optionally, SQL statements and user-defined functions are used to classify and statistically analyze the domain attributes of the preprocessed data, specifically including:
[0018] The domain attributes of the preprocessed data are divided into multiple groups to obtain the division results;
[0019] The user-defined function is accessed using SQL statements, the domain attributes of the preprocessed data are passed into the user-defined function, and the domain attributes of the preprocessed data are statistically analyzed using a pre-stored set metric statistical method to obtain statistical results.
[0020] Optionally, the frequency includes: event frequency, rework frequency, and flow case frequency.
[0021] Optionally, the coverage includes: case coverage.
[0022] Optionally, the time consumption data includes: activity time consumption, maximum activity time consumption, minimum activity time consumption, average activity time consumption, median activity time consumption, standard deviation of activity time consumption, total time consumption of inter-activity routing, maximum time consumption of inter-activity routing, minimum time consumption of inter-activity routing, average time consumption of inter-activity routing, median time consumption of inter-activity routing, and standard deviation of inter-activity time consumption.
[0023] Optionally, the query conditions in the query condition list can be freely combined to generate complex query conditions; the complex query conditions support multi-dimensional and multi-granular process mining; the multi-dimensional dimensions include: time dimension, location dimension, amount dimension, resource dimension, organization dimension, and business data dimension; the multi-granularity includes multiple different granularities in time, multiple different granularities in location, and multiple different granularities in organization.
[0024] The present invention also provides a process mining device for massive event logs, comprising: a preprocessing module based on SQL event logs, an activity and route mining module based on SQL, a process event attribute mining module based on SQL, and a process model construction module based on SQL, connected in sequence.
[0025] The preprocessing module based on the SQL event log is used for:
[0026] A massive amount of event logs is read using SQL statements in a streaming manner, and the massive amount of event logs is preprocessed to obtain preprocessed data; the preprocessed data includes: an activity list and an inter-activity routing list;
[0027] The SQL-based activity and route mining module is used for:
[0028] The preprocessed data is read in one go using SQL statements, and the activity list and the inter-activity routing list are linked to obtain the activity structure and the inter-activity routing structure.
[0029] The metrics of the activity list and the inter-activity routing list are statistically analyzed to obtain metric data, and the metric data is stored in the business data attribute list; the metric data includes: frequency, coverage and time consumption data;
[0030] The SQL-based process event attribute mining module is used for:
[0031] SQL statements and user-defined functions are used to divide and statistically analyze the domain attributes of the preprocessed data, and hidden activities are mined based on the division and statistical results.
[0032] The domain attributes of the preprocessed data are used to generate a list of query conditions using SQL statements;
[0033] The SQL-based process model construction module is used for:
[0034] The process mining model is constructed by using SQL statements to read the activity structure, the inter-activity routing structure, the business data attribute list, the hidden activities, and the query condition list in one go; the process mining model is used to characterize the actual execution status of the business process.
[0035] According to specific embodiments provided by the present invention, the present invention discloses the following technical effects:
[0036] This invention proposes a method and apparatus for process mining of massive event logs. It employs SQL statements to read and preprocess massive event logs using a streaming method, improving processing efficiency. The SQL-based process mining technology allows process mining calculations to be performed and processed on the event log storage device, shortening the distance between computation and storage, saving data reading and transmission time, and significantly improving computational efficiency. It supports the mining of implicit activities from complex event log attributes, enabling process mining results to more accurately reflect the actual execution status of business processes, thereby providing more effective decision support. Therefore, this invention can efficiently and accurately achieve process mining from massive event logs. Attached Figure Description
[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0038] Figure 1 A flowchart illustrating a process mining method for massive event logs provided in an embodiment of the present invention;
[0039] Figure 2 This is a structural diagram of a process mining method for massive event logs provided in an embodiment of the present invention. Detailed Implementation
[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0041] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0042] Example 1
[0043] This embodiment provides a process mining method for massive event logs, which utilizes SQL statements to achieve process mining. It mainly includes the following four aspects: a SQL-based event log preprocessing method, a SQL-based activity and route mining method, a SQL-based process event attribute mining method, and a SQL-based process model construction method. These methods use SQL statements to preprocess massive event logs, discover activity routes, and analyze potential events affecting routes based on event attributes, ultimately constructing complex process models. This method can process and mine complex process models with high performance and accuracy.
[0044] See Figure 1 The process mining method for massive event logs provided in this embodiment specifically includes:
[0045] Step 101: Use SQL statements to read massive event logs in a streaming manner, and preprocess the massive event logs to obtain preprocessed data; the preprocessed data includes: an activity list and an inter-activity routing list.
[0046] Step 102: Use SQL statements to read the preprocessed data all at once, and link the activity list and the inter-activity routing list to obtain the activity structure and the inter-activity routing structure.
[0047] Step 103: Perform statistics on the metrics of the activity list and the inter-activity routing list to obtain metric data, and store the metric data in the business data attribute list; the metric data includes: frequency, coverage and time consumption data.
[0048] The frequency includes: event frequency, rework frequency, and frequency of cases passed through. The coverage includes: case coverage. The time consumption data includes: activity time consumption, maximum activity time consumption, minimum activity time consumption, average activity time consumption, median activity time consumption, standard deviation of activity time consumption, total time consumption of inter-activity routing, maximum time consumption of inter-activity routing, minimum time consumption of inter-activity routing, average time consumption of inter-activity routing, median time consumption of inter-activity routing, and standard deviation of inter-activity time consumption.
[0049] Step 104: Use SQL statements and user-defined functions to divide and count the domain attributes of the preprocessed data, and mine hidden activities based on the division and count results.
[0050] Step 105: Use SQL statements to generate a list of query conditions from the domain attributes of the preprocessed data.
[0051] The query conditions in the query condition list can be freely combined to generate complex query conditions; the complex query conditions support multi-dimensional and multi-granular process mining; the multi-dimensional dimensions include: time dimension, location dimension, amount dimension, resource dimension, organization dimension and business data dimension; the multi-granularity includes multiple different granularities in time, multiple different granularities in location and multiple different granularities in organization.
[0052] Step 106: Use SQL statements to read the activity structure, the inter-activity routing structure, the business data attribute list, the hidden activities, and the query condition list in one go, and construct a process mining model; the process mining model is used to characterize the actual execution status of the business process.
[0053] Step 101 specifically includes:
[0054] A massive event log is read using SQL statements in a streaming manner to identify the data information in the log. The data information includes event cases and process activities. Log tagging, data format conversion, and data quality control operations are performed on the data information sequentially to obtain preprocessed process activity information. An activity list and an inter-activity routing list are constructed based on the preprocessed process activity information to obtain preprocessed data.
[0055] Step 101 mainly implements a preprocessing method based on SQL event logs. In practical applications, a specific implementation process of step 101 is as follows:
[0056] The preprocessing method based on SQL event logs mainly involves high-speed preprocessing of massive event logs, including identifying event cases, process activities, event timestamps (if timestamps exist), and event business data attributes, as well as log tagging, data format conversion, and data quality control. After completing the above operations, process activity information is aggregated and extracted, and routes between activities are marked.
[0057] This method involves using SQL statements to stream massive event logs on a computer. During the reading process, it first identifies process case information, process activity information, and event timestamps (if any) within the logs. The event logs are then aggregated and grouped by process case, and each case is sorted in ascending order by timestamp. If an event log lacks timestamp information, no sorting is performed. Based on the identified process activity information, an activity list and an inter-activity routing list for the process model are constructed. This preprocessing significantly accelerates process mining performance by pre-executing process activity identification, a crucial step in traditional process mining techniques.
[0058] Steps 102 and 103 primarily implement an SQL-based activity and route mining method. In practical applications, a specific implementation process for steps 102 and 103 is as follows:
[0059] The SQL-based activity and route mining method is executed after preprocessing in step 101. It links the identified activity list and inter-activity route list, transforming the activity list into the activity structure of the process model through routing, thus forming the basic structure of the process model. Since redundancy exists in the preprocessed inter-activity route list (which is unavoidable), redundancy is removed in step 103. Furthermore, statistical analysis is performed on the metrics of the activities and inter-activity routes, such as frequency, coverage, and duration. This statistical data is stored in the business data attribute list of the activities and inter-activity routes.
[0060] The specific operation of this method involves using SQL statements on a computer device to read preprocessed data all at once, performing activity attribute statistics for each activity in the activity list, performing attribute statistics for each inter-activity route in the inter-activity route list, storing the data in the attribute list of each activity and inter-activity route after the statistics are completed, and removing redundant activity information and inter-activity route information to optimize the storage of the process model.
[0061] Step 104 specifically includes:
[0062] The domain attributes of the preprocessed data are divided into multiple groups to obtain the division results; a user-defined function is accessed using an SQL statement, the domain attributes of the preprocessed data are passed into the user-defined function, and a pre-stored set metric statistical method is used to perform statistics on the domain attributes of the preprocessed data to obtain statistical results.
[0063] Steps 104 and 105 mainly implement a SQL-based process event attribute mining method. In practical applications, a specific implementation process of steps 104 and 105 is as follows:
[0064] The SQL-based process event attribute mining method, after step 103, categorizes and statistically analyzes the attributes (domain attributes) of each activity in addition to the aforementioned event business data attributes. Domain attributes primarily refer to specific business domains. For example, in the finance domain, an invoice generation event might include, in addition to the case, event name, and timestamp, invoice number, invoice amount, payee, and paying unit. In the manufacturing domain, a parts outbound event might include, in addition to the case, event name, and timestamp, part number, outbound quantity, recipient, outbound approver, and outbound amount. These are all domain attributes. The domain attributes of event logs may belong to one or more domains. Based on the domain characteristics of specific attribute values, the domain attributes reflected in each event log are divided into multiple groups, and the aforementioned other attributes in each group are statistically analyzed. This step is not available in traditional process mining techniques. If traditional process mining techniques were to perform this step, it would significantly reduce process mining efficiency, making such inefficiency unacceptable to users. Because each activity and the routes between activities have numerous business attributes, and the statistical criteria and methods are complex, this step requires significant computing, memory, and storage resources. Furthermore, the number of business attributes is uncertain, making effective mining difficult using traditional process mining techniques. However, applying an SQL-based process event attribute mining method allows for more efficient data acquisition through segmentation and statistical operations, thus providing sufficient computational efficiency for process mining analysis targeting other attributes.
[0065] The specific operation of this method is as follows: (1) Using User-Definition Functions (UDFs), specific metrics and statistical methods are built into the mining device; (2) Other attributes of the activity are divided into multiple groups; (3) The UDF is accessed through SQL statements, and other attributes of the activities and inter-activity routes of the process model are passed into the UDF. The UDF is executed while the SQL statement is executed to achieve statistics; (4) Based on the division results and statistical results, the hidden activity mining is performed, and the mining results are returned to the user. The hidden activity is not an activity that is explicitly reflected in the event log, but a de facto activity formed according to the statistical results of specific metrics. The hidden activity is directly related to the setting of statistical metrics. Setting different statistical metrics will lead to the mining of different hidden activities; (4) Since the SQL statement accepts flexible combination of query conditions, each activity and other attributes of inter-activity routes will generate a list of query conditions. The query conditions in this list can be freely combined to generate complex query conditions, thereby supporting multi-dimensional and multi-granular process mining. Multi-dimensionality refers to the query scope, such as time, location, amount, resource, organization, and business data dimensions. Multi-granularity refers to queries at different levels and with different granularities. For example, in terms of time, there are year, month, day, hour, minute, and second; in terms of location, there are country, province, city, district, county, and village; and in terms of organization, there are branch offices, departments, and teams. Each dimension constitutes a process mining slice, and multiple dimension process mining slices form a process mining cube. This provides users with multi-dimensional and multi-granular mining results, effectively supporting their business decisions.
[0066] Step 106 mainly implements the SQL-based process model construction method. In practical applications, a specific implementation process of step 106 is as follows:
[0067] The SQL-based process model construction method refers to, after completing step 105 above, using SQL statements to read the activity structure and inter-activity routing structure of the process model, as well as all attributes of activities and routes, all at once, and assembling them into a process mining model structure using SQL statements, thus completing the construction of the process mining model. Construction methods include: generating via querying and generating using automatic layout methods.
[0068] This process is generated through queries. Specifically, it involves using conditional and unconditional SQL queries on a computer to retrieve the process mining model. The process model contains activity structures and inter-activity routing structures. The process involves finding all activities without input routes and adding an input route to each of these activities. All input routes connect to a start activity, which is not an actual activity but a marker activity that indicates the process begins at that activity. Similarly, the process involves finding all activities without output routes and adding an output route to each of these activities. All output routes connect to an end activity, which is also not an actual activity but a marker activity that indicates the process ends at that activity.
[0069] To display the process model on the front end, an automatic layout method can be applied to obtain the activity structure and routing structure of the process model. The automatic layout method determines whether the connection route between each activity and its starting activity is a direct route or a non-direct route. Direct routes are divided into two layers: the first layer is the activity accessible via the direct route, the second layer is the next activity reachable from the activity accessible via the direct route, and so on, until the ending activity is reached. Activities from all layers are evenly distributed across each layer, forming the activity layout for each layer, ultimately displayed as the process mining model.
[0070] The method in this embodiment adopts a SQL-based streaming preprocessing scheme. Streaming preprocessing operations support continuous log identification, log tagging, and data format conversion. It is an incremental preprocessing scheme that eliminates the need for the process mining algorithm software to read all event logs into the computer device's memory. Process mining calculations based on SQL statements reduce the consumption of computer device memory resources, significantly reduce data transmission costs, and improve efficiency. By designing operations such as process activity extraction, inter-activity routing calculation, attribute measurement statistics, and hidden activity mining as parallel execution of SQL statements, operation decoupling is achieved, coupling is reduced, and parallelism is increased, greatly improving process mining efficiency and effectively improving process mining for massive event logs.
[0071] Example 2
[0072] In order to execute the method corresponding to Embodiment 1 above and achieve the corresponding functions and technical effects, a process mining device for massive event logs is provided below.
[0073] See Figure 2 The process mining device includes: a preprocessing module based on SQL event logs, an activity and route mining module based on SQL, a process event attribute mining module based on SQL, and a process model construction module based on SQL, connected in sequence.
[0074] The preprocessing module based on the SQL event log is used for:
[0075] A massive amount of event logs is read using SQL statements in a streaming manner, and the massive amount of event logs (i.e., the event log stream) is preprocessed to obtain preprocessed data; the preprocessed data includes: an activity list and an inter-activity routing list.
[0076] The preprocessing operations in this module mainly include: identification (cases, activities, timestamps), log tagging, data format conversion, and data quality control.
[0077] The SQL-based activity and route mining module is used for:
[0078] Establish links between activities. Specifically, use SQL statements to read the preprocessed data all at once, link the activity list and the inter-activity routing list to obtain the activity structure and the inter-activity routing structure.
[0079] Statistical metrics data. Specifically, the metrics of the activity list and the inter-activity routing list are statistically analyzed to obtain metric data, which is then stored in the business data attribute list; the metric data includes frequency, coverage, and time consumption data.
[0080] The SQL-based process event attribute mining module is used for:
[0081] The process involves activity attribute segmentation, activity attribute statistics, and hidden activity mining. Specifically, SQL statements and user-defined functions are used to segment and statistically analyze the domain attributes of the preprocessed data, and hidden activities are mined based on the segmentation and statistical results.
[0082] Generate a list of query criteria. Specifically, use SQL statements to generate a list of query criteria from the domain attributes of the preprocessed data.
[0083] The SQL-based process model construction module is used for:
[0084] The process mining model is constructed by using SQL statements to read the activity structure, the inter-activity routing structure, the business data attribute list, the hidden activities, and the query condition list in one go; the process mining model is used to characterize the actual execution status of the business process.
[0085] The specific operations of this module mainly include: query generation process mining model and automatic layout generation process mining model.
[0086] Compared with existing process mining technologies, the method or apparatus of the present invention has the following advantages:
[0087] (1) The process mining device based on SQL statements realizes streaming reading and preprocessing, which is an efficient way to process massive logs.
[0088] (2) Process mining computation is closer to data storage. Traditional process mining computation involves reading logs from the storage medium of the storage device, storing them in the computing memory for centralized processing, or transmitting them to the computing device via a network, which is inefficient. SQL-based process mining technology allows process mining computation and processing to be performed on the event log storage device, shortening the distance between computation and storage and saving data reading and transmission time. This greatly improves the efficiency of process mining computation, enabling SQL-based process mining technology to support the mining of massive event logs.
[0089] (3) This invention supports the mining of implicit activities of complex event log attributes. That is, by dividing and statistically analyzing event log attributes of specific metrics, it can mine implicit activities of processes in a multi-dimensional and multi-granular manner, so that the process mining results can more accurately reflect the actual situation of business process execution, thereby providing more effective decision support.
[0090] Furthermore, SQL-based process mining technology is one of the effective solutions for processing massive event logs under the current trend of computing being closer to storage. Process mining technology targets continuous and massive event logs. The basic solution involves reading massive amounts of event logs into the computer device's memory at once for process mining and statistics. This solution has two design approaches: one is centralized process mining, where all event logs are transmitted or read to the same computer device for centralized mining; the other is distributed mining through a distributed computing framework, where all event logs are transmitted or read to various nodes in a distributed computer device cluster for distributed computing.
[0091] Both of the above design approaches have huge reading and transmission costs and consume a lot of memory resources in computer equipment. The second approach also has the problem of how to read and output massive logs in blocks, as well as the problem of merging process mining results. These problems have the disadvantages of high design cost, unreliable performance, and high implementation cost, and cannot replace the method of the present invention in a low-cost, high-reliability, and high-performance manner.
[0092] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.
[0093] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.
Claims
1. A process mining method for massive event logs, characterized in that, include: A massive amount of event logs is read using SQL statements in a streaming manner, and the massive amount of event logs is preprocessed to obtain preprocessed data; The preprocessed data includes: an activity list and an inter-activity routing list; The preprocessed data is read in one go using SQL statements, and the activity list and the inter-activity routing list are linked to obtain the activity structure and the inter-activity routing structure. The metrics of the activity list and the inter-activity routing list are statistically analyzed to obtain metric data, and the metric data is stored in the business data attribute list; the metric data includes: frequency, coverage and time consumption data; SQL statements and user-defined functions are used to divide and statistically analyze the domain attributes of the preprocessed data, and hidden activities are mined based on the division and statistical results. The domain attributes of the preprocessed data are used to generate a list of query conditions using SQL statements; The activity structure, the inter-activity routing structure, the business data attribute list, the hidden activities, and the query condition list are read in one go using SQL statements to construct a process mining model; the process mining model is used to characterize the actual execution status of the business process. A massive amount of event logs is read using SQL statements in a streaming manner, and the logs are preprocessed to obtain preprocessed data, specifically including: The system uses SQL statements to read massive event logs in a streaming manner and identifies the data information in the logs. The data information includes event cases and process activities. The data information is sequentially subjected to log tagging, data format conversion, and data quality control operations to obtain preprocessed process activity information; Based on the preprocessed process activity information, an activity list and an inter-activity routing list are constructed to obtain preprocessed data.
2. The process mining method for massive event logs according to claim 1, characterized in that, The domain attributes of the preprocessed data are divided and statistically analyzed using SQL statements and user-defined functions, specifically including: The domain attributes of the preprocessed data are divided into multiple groups to obtain the division results; The user-defined function is accessed using SQL statements, the domain attributes of the preprocessed data are passed into the user-defined function, and the domain attributes of the preprocessed data are statistically analyzed using a pre-stored set metric statistical method to obtain statistical results.
3. The process mining method for massive event logs according to claim 1, characterized in that, The frequency includes: event frequency, rework frequency, and case frequency.
4. The process mining method for massive event logs according to claim 1, characterized in that, The coverage rate includes: case coverage rate.
5. A process mining method for massive event logs according to claim 1, characterized in that, The time consumption data includes: activity time consumption, maximum activity time consumption, minimum activity time consumption, average activity time consumption, median activity time consumption, standard deviation of activity time consumption, total time consumption of inter-activity routing, maximum time consumption of inter-activity routing, minimum time consumption of inter-activity routing, average time consumption of inter-activity routing, median time consumption of inter-activity routing, and standard deviation of inter-activity time consumption.
6. The process mining method for massive event logs according to claim 1, characterized in that, The query conditions in the query condition list can be freely combined to generate complex query conditions; The complex query conditions support multi-dimensional and multi-granular process mining; The multiple dimensions include: time dimension, location dimension, amount dimension, resource dimension, organization dimension, and business data dimension; The multiple granularities include multiple different granularities in time, multiple different granularities in location, and multiple different granularities in tissue.
7. A process mining device for massive event logs, characterized in that, include: The modules are sequentially connected: a preprocessing module based on SQL event logs, an activity and route mining module based on SQL, a process event attribute mining module based on SQL, and a process model construction module based on SQL. The preprocessing module based on the SQL event log is used for: A massive amount of event logs is read using SQL statements in a streaming manner, and the massive amount of event logs is preprocessed to obtain preprocessed data; The preprocessed data includes: an activity list and an inter-activity routing list; The SQL-based activity and route mining module is used for: The preprocessed data is read in one go using SQL statements, and the activity list and the inter-activity routing list are linked to obtain the activity structure and the inter-activity routing structure. The metrics of the activity list and the inter-activity routing list are statistically analyzed to obtain metric data, and the metric data is stored in the business data attribute list; the metric data includes: frequency, coverage and time consumption data; The SQL-based process event attribute mining module is used for: SQL statements and user-defined functions are used to divide and statistically analyze the domain attributes of the preprocessed data, and hidden activities are mined based on the division and statistical results. The domain attributes of the preprocessed data are used to generate a list of query conditions using SQL statements; The SQL-based process model construction module is used for: The activity structure, the inter-activity routing structure, the business data attribute list, the hidden activities, and the query condition list are read in one go using SQL statements to construct a process mining model; the process mining model is used to characterize the actual execution status of the business process. A massive amount of event logs is read using SQL statements in a streaming manner, and the logs are preprocessed to obtain preprocessed data, specifically including: The system uses SQL statements to read massive event logs in a streaming manner and identifies the data information in the logs. The data information includes event cases and process activities. The data information is sequentially subjected to log tagging, data format conversion, and data quality control operations to obtain preprocessed process activity information; Based on the preprocessed process activity information, an activity list and an inter-activity routing list are constructed to obtain preprocessed data.