A method for mining infrequent behaviors of business processes based on ROUGE index and LOF algorithm

Abstract

The present invention discloses a method for mining infrequent behaviors of business processes based on ROUGE indicators and LOF algorithm, including obtaining an event log L, calculating a distance matrix of trajectory data according to the event log L, obtaining a reachability matrix of each trajectory data, calculating the local reachability density for each trajectory data, calculating the LOF value of each trajectory data, and judging whether the trajectory data is an infrequent behavior. The present invention extracts information such as event trajectory, frequency, and label from the event log, and uses ROUGE, an evaluation indicator in the field of machine translation, as a similarity measurement indicator between trajectories, to mine infrequent behaviors through an improved LOF algorithm. The method comprehensively considers local density, frequency information, and similarity between trajectories. It is evaluated by using real event data and compared with two clustering methods. Experimental results show that the method can quickly process event logs, identify infrequent behaviors therefrom, and provide reliable infrequent behavior mining results.

Description

Technical Field

[0001] The present invention relates to the field of process mining, and in particular to a method for mining infrequent behaviors of business processes based on ROUGE indicators and LOF algorithms. Background Art

[0002] Business processes are processes in which the activities of an organization or enterprise are described and standardized in a specific order and steps, aiming to improve efficiency, control costs and achieve sustainable development. Process mining aims to extract relevant information about business processes from event logs to achieve discovery, consistency and enhancement of business processes. Process mining discovers, monitors and optimizes existing system logs of enterprises to improve the operational efficiency of enterprises. Traditional mining techniques mainly focus on mining frequently occurring behaviors in event logs, aiming to extract, analyze and display the main execution conditions and patterns of actual business processes. In order to quickly understand the overall information of event logs, most mining methods simply treat infrequent behaviors as noise removal to reduce the complexity of the model. However, this ignores the important information contained in infrequent behaviors.

[0003] Infrequent behavior refers to a series of activities in the entire event log that have a low frequency and are very different from most activities. Infrequent behavior contains important system information, reflecting special properties, hidden rules, potential risks, etc. In the actual system, these behaviors may be operations that are only performed under certain conditions, or they may be sudden events. For example, in the loan application process of financial institutions, there are a few high-risk instances of obtaining loans. In the reimbursement of travel expenses for university employees, there are some instances of unsuccessful reimbursement. Mining infrequent behavior can discover hidden business opportunities and innovations, and enhance the competitiveness and efficiency of enterprises. Infrequent behavior contains key system information and potential risks. Ignoring it may lead to missing important business opportunities or potential problems. By mining and analyzing infrequent behavior, it is possible to find undiscovered key information contained in it, so as to better understand the mode of business operation and take targeted measures to optimize and improve it. It makes up for the limitation of traditional data mining technology focusing on frequent patterns and provides more possibilities for solving practical problems. Therefore, it is necessary to mine infrequent behavior.

[0004] At present, the infrequent behavior mining methods in business processes can be roughly divided into four categories:

[0005] (1) Clustering-based method. The extracted event log features are clustered and similar behaviors are grouped together. Each trajectory is checked and, based on the set threshold, it is decided whether to add it to the formed cluster. The behaviors that are not added to the cluster after clustering are the filtered infrequent behaviors. Using clustering to detect infrequent behaviors can cope with a variety of infrequent behavior types and distributions. The effect of clustering is affected by parameter settings. Inappropriate parameters will lead to inaccurate or unstable mining results.

[0006] (2) Automaton-based methods. First, the cases in the event log are abstracted into automata. Then, infrequent transitions are filtered out from the automata, thereby filtering out infrequent behaviors. For example, anomaly detection, fraud detection, etc. The behaviors recorded in the log during the establishment of an abstract process are used as an automaton (directed graph). This automaton captures the direct follow-up dependency between event labels in the log and is used to filter out infrequent behaviors in the business process. This method can effectively process sequence data in event logs and can also flexibly define the conditions and thresholds for infrequent behaviors. However, it is necessary to design appropriate automaton structures and parameters, which requires manual intervention or prior knowledge. Automata face the problem of state explosion when processing large-scale data, which increases computational complexity and reduces the efficiency of mining models.

[0007] (3) Dependency-based methods. This method identifies infrequent behaviors by analyzing the dependencies between activities, such as direct dependencies, indirect dependencies, long-distance dependencies, etc. Then infrequent behaviors are filtered out based on the strength or type of the dependencies. This paper proposes an effective infrequent behavior identification method based on frequent patterns and data dependencies. For each subsequence and its successor activity, the conditional dependency probability is calculated. That is, under specific data dependency conditions, the probability that the subsequence directly succeeds the activity. Infrequent behavior detection based on dependencies can better reflect the logical structure of the process. However, there are also some disadvantages, such as dependencies are difficult to quantify, filtering may ignore important causal relationships, and retention may lead to model redundancy.

[0008] (4) Statistical methods. One statistical method is based on hypothesis testing. First, the given event log is converted into a correlation matrix, recording the number of occurrences of each pair of direct successor events. For each pair of events, a one-sided binomial test is performed based on the parameters specified by the user to determine whether they should be considered infrequent behaviors. Outliers or significant differences in infrequent behaviors can be identified, which helps to understand the patterns and laws of infrequent behaviors. However, statistical methods are usually based on certain assumptions or models. If the data does not meet the assumptions or models, the results will be inaccurate. Summary of the invention

[0009] In view of the problems existing in the prior art, the present invention provides a method for mining infrequent behaviors of business processes based on ROUGE indicators and LOF algorithm.

[0010] The present invention adopts the following technical solutions:

[0011] A method for mining infrequent behaviors of business processes based on ROUGE index and LOF algorithm includes the following steps:

[0012] Step 1: Get the data set data, and get the event log L from the data set data. The event log L includes multiple trajectory data and the occurrence frequency and trajectory length corresponding to the trajectory data.

[0013] Step 2: Calculate the distance matrix of trajectory data based on event log L.

[0014] Step 3: Arrange each column of the distance matrix of the trajectory data in ascending order, find the xth nearest point of each trajectory data, and the distance between them is called the proximity distance, which is recorded in the array x_distances.

[0015] Step 4: Get the reachability matrix of each trajectory data.

[0016] Step 5: For each trajectory data, calculate the local reachability density of its x nearest neighbor trajectory data.

[0017] Step 6: Calculate the LOF value of each trajectory data.

[0018] Step 7: Set a threshold T, compare the LOF value of each trajectory data with the threshold, and determine whether the trajectory data is an infrequent behavior.

[0019] Preferably, step 2 specifically includes the following steps:

[0020] Step 2.1: Call the similarity calculation function getROUGEScore() to calculate the distance between any two trajectory data i and j.

[0021] The specific process is:

[0022] Step 2.1.1: Calculate the similarity index ROUGE-N score and ROUGE-L score of two trajectory data i and j. The specific formula is:

[0023]

[0024] Where L represents an event log dataset; i represents a trajectory in the event log dataset; gram n Represents a sequence of n consecutive activities in a trajectory; ∑Count match (gram n) indicates that gram appears in both tracks i and j n The number of Gount(gram n ) indicates that gram appears in trajectory i n In formula (1), n ​​is 1 for ROUGE-1 score, and n is 2 for ROUGE-2 score.

[0025] The calculation formula of ROUGE-L score is:

[0026]

[0027]

[0028]

[0029] Where i and j represent two trajectories respectively; |i| and |j| represent the lengths of trajectories i and j respectively; S lcs Used to calculate the longest subsequence that is the same in two trajectories; β is a hyperparameter; R lcs and P lcs They represent the recall and precision of the longest common subsequence respectively; ROUGE-L index is calculated by dividing R lcs and P lcs Comprehensive consideration is taken to evaluate the similarity between two trajectories.

[0030] Step 2.1.2: Calculate the similarity between two trajectory data i and j, getROUGEScore(i,j), the calculation formula is:

[0031] getROUGEScore(i,j)=ROUGE_1*W 1 +ROUGE_2*W 2 +ROUGE_L*W 3 (5).

[0032] Among them, W 1 , W 2 and W 3 All are weights.

[0033] Step 2.1.3: Calculate the distance distances[i,j] between trajectory data i and j.

[0034] distances[i,j]=1-getROUGEcore(i,j) (6).

[0035] Step 2.2: Repeat step 2.1 to calculate the distances between all trajectory data and obtain the distance matrix of the trajectory data.

[0036] Preferably, step 4 specifically includes the following steps:

[0037] Step 4.1: For trajectory data i, find the x nearest neighbor trajectory data j of trajectory data i.

[0038] Step 4.2: Get the xth nearest neighbor distance x_distances[j] of trajectory data i, and calculate the reachable distance reach_dist between trajectory data i and x nearest neighbor trajectory data j, using the formula:

[0039] reach_dist=max(x_distances[j],distances[i,j]) (7).

[0040] Step 4.3: Calculate the reachable distance of all trajectory data to form the reachability matrix reachability_matrix.

[0041] Preferably, step 5 specifically includes:

[0042] For trajectory data i, calculate the local reachability density local_reachability_density between it and the x nearest neighbor trajectory data. The formula is:

[0043]

[0044] Among them, freq i is the occurrence frequency of trajectory data i, reachability_matrix,axis=1 means that the reachability matrix reachability_matrix is ​​calculated by column.

[0045] Preferably, step 6 specifically includes:

[0046] For trajectory data i, the LOF value calculation formula of trajectory data is:

[0047]

[0048] Among them, local_reachability_density[j] represents the local reachability density of the x nearest neighbor trajectory data j of trajectory data i, It represents the average value of the local reachability density of the x nearest neighbor trajectory data of trajectory data i.

[0049] Preferably, step 7 specifically includes:

[0050] If the LOF value of a trajectory data is greater than or equal to the threshold T, the trajectory data is an infrequent behavior trajectory; if the LOF value of a trajectory data is less than the threshold T, the trajectory data is a frequent behavior trajectory.

[0051] The present invention has the following beneficial effects:

[0052] The present invention proposes a method for mining infrequent behaviors of business processes based on ROUGE indicators and LOF algorithm, which extracts information such as event trajectories, frequencies and labels from event logs, and uses ROUGE, an evaluation indicator in the field of machine translation, as a similarity measurement indicator between trajectories, to mine infrequent behaviors through an improved LOF algorithm. This method comprehensively considers local density, frequency information and similarity between trajectories. It is evaluated by using real event data and compared with two methods in clustering. Experimental results show that this method can quickly process massive event logs, accurately identify infrequent behaviors, and provide reliable infrequent behavior mining results. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 The figure is a main step diagram of a method for mining infrequent behaviors of business processes based on ROUGE indicator and LOF algorithm.

[0054] Figure 2 This is the main flow chart of a method for mining infrequent behaviors of business processes based on ROUGE indicators and LOF algorithm.

[0055] Figure 3 This is a comparison chart of the F1 values ​​of the three methods under different parameters in Example 1.

[0056] Figure 4 This is a comparison chart of the F1 values ​​of different ROUGE indicators under different parameters.

[0057] Figure 5 The figure is a comparison chart of the F1 values ​​between the improved LOF algorithm and the unimproved LOF algorithm. DETAILED DESCRIPTION

[0058] The specific implementation of the present invention is further described below in conjunction with the accompanying drawings and specific embodiments:

[0059] Before conducting infrequent behavior mining, event logs need to be processed initially. This simplifies the data analysis and infrequent behavior mining process while maintaining data integrity to improve the stability of the method.

[0060] Since the method proposed in the present invention is aimed at trajectories, it is necessary to convert the original log in units of events into event logs in units of trajectories. In the event log, the occurrence of events is not random, but there is a certain order of precedence. In the loan approval event log, "apply for a loan" is the predecessor event of "agree to approve", in the expense reimbursement event log, "submit an application" is the predecessor event of "proceeding approval", in the hospital visit event log, "patient registration" is the predecessor event of "doctor consultation", and so on. The present invention mainly studies how to perform infrequent behavior mining from the perspective of control flow, focusing on the attributes of the event such as the instance to which it belongs, the activity name, and the timestamp. The event log is divided into multiple cases. Next, Example 1 will be introduced in detail.

[0061] Example 1 takes the loan application lifecycle event log of a Dutch financial institution as an example, including all events for creating and processing incoming loan application results.

[0062] Table 1 shows an example of a loan application log snippet. Employee User_17 created a quote in the bank. The monthly cost of this quote is 402.36, and the first withdrawal amount is 27,000. In the next few minutes, employee User_17 sent the quote to the customer via mail and the Internet. After evaluating the bank's quote, the customer expressed his intention and finally accepted the loan plan. This shows that the customer recognized the loan conditions and quote.

[0063] Table 1 Loan application log fragment

[0064]

[0065] Each case contains a related sequence of events, which reflects the execution of a complete business process instance from start to finish. A case corresponds to a trajectory such as σ 1 =<O_Create Offer,O_Created,O_Sent(mail and online),O_Returned,O_Accepted> .

[0066] In preparation, dividing the event log into cases can preserve the contextual information between events and provide characteristics, attributes, and behavior patterns of the case as a whole. This makes it easier to analyze the entire event log and better understand and study the behavior of the entire process. For ease of observation and understanding, letter labels will be used to represent specific activity names. A trajectory can be obtained by arranging the activities contained in the instance in chronological order. The event log is divided, represented, and stored. Example 2 is given below for detailed explanation.

[0067] Example 2 Taking the loan application event log as an example, the original event log is divided according to the case. The specific label correspondence of the activity is shown in Table 2. Trajectories with the same activity occurrence order are regarded as the same trajectory, and the trajectory is sorted in descending order according to the frequency of occurrence, and the sample log set L can be obtained. s =[<a,b,c,f> 16365 ,<a,b,c,h,g> 16299 ,<a,b,c,h,e> 3532 ,<a,b,c,h,f> 2393 ,<a,b,f> 1203 ,<a,b,c,e> 962 ,<a,b,d,h,g> 929 ,<a,b,d,f> 875 ,<a,b,c> 108 ,<a,b,d,e> 101 ,<a,b,d,h,f> 62 ,<a,b,e> 59 ,<a,b,c,h> 48 ,<a,b,d,h,e> 41 ,<a,b,d> 17 ,<a,b,d,h> 1 ] Among them, the shape is<a,b,c,f> Represents the trajectory σ 1 , the superscript number 16365 indicates freq 1 =16365.

[0068] Table 2 Loan application log activity label comparison table

[0069]

[0070] When the trajectory σ is used as input, freq(σ) is the occurrence frequency of the trajectory σ. 1 In the event log L s appears 40 times in the 1 )=40. The trajectory similarity calculation function getROUGEScore() takes trajectory i and trajectory j as input and can get the similarity value between the two trajectories. The function value range is [0,1]. The higher the value, the higher the similarity. 1 With trajectory r 2 If they are exactly the same, then ROUGE(i,j)=1.

[0071] Combination Figures 1 to 5 , a business process infrequent behavior mining method based on ROUGE indicator and LOF algorithm, including the following steps:

[0072] Step 1: Get the data set data, and get the event log L from the data set data. The event log L includes multiple trajectory data and the occurrence frequency and trajectory length corresponding to the trajectory data.

[0073] Step 2: Calculate the distance matrix of trajectory data based on event log L.

[0074] The specific steps include:

[0075] Step 2.1: Call the similarity calculation function getROUGEScore() to calculate the distance between any two trajectory data i and j. The specific process is:

[0076] Step 2.1.1: Calculate the similarity index ROUGE-N score and ROUGE-L score of two trajectory data i and j. The specific formula is:

[0077]

[0078] Where L represents an event log dataset; i represents a trajectory in the event log dataset; gram n Represents a sequence of n consecutive activities in a trajectory; ∑Count match (gram n ) indicates that gram appears in both tracks i and j n The number of Count(gram n ) indicates that gram appears in trajectory i n In formula (1), n ​​is 1 for ROUGE-1 score, and n is 2 for ROUGE-2 score.

[0079] The calculation formula of ROUGE-L score is:

[0080]

[0081]

[0082]

[0083] Where i and j represent two trajectories respectively; |i| and |j| represent the lengths of trajectories i and j respectively; S lcs Used to calculate the longest subsequence that is the same in two trajectories; β is a hyperparameter; R lcs and P lcs They represent the recall and precision of the longest common subsequence respectively; ROUGE-L index is calculated by dividing R lcs and P lcs Comprehensive consideration is taken to evaluate the similarity between two trajectories.

[0084] Step 2.1.2: Calculate the similarity between two trajectory data i and j, getROUGEScore(i,j), the calculation formula is:

[0085] getROUGEScore(i,j)=ROUGE_1*W 1 +ROUGE_2*W 2 +ROUGE_L*W 3 (5).

[0086] Among them, W 1 , W 2 and W 3 All are weights.

[0087] Step 2.1.3: Calculate the distance distances[i,j] between trajectory data i and j;

[0088] distances[i,j]=1-getROUGEcore(i,j) (6).

[0089] Step 2.2: Repeat step 2.1 to calculate the distances between all trajectory data and obtain the distance matrix of the trajectory data.

[0090] Step 3: Arrange each column of the distance matrix of the trajectory data in ascending order, find the xth nearest point of each trajectory data, and the distance between them is called the proximity distance, which is recorded in the array x_distances.

[0091] Step 4: Get the reachability matrix of each trajectory data.

[0092] The specific steps include:

[0093] Step 4.1: For trajectory data i, find the x nearest neighbor trajectory data j of trajectory data i.

[0094] Step 4.2: Get the xth nearest neighbor distance x_distances[j] of trajectory data i, and calculate the reachable distance reach_dist between trajectory data i and x nearest neighbor trajectory data j. The formula is:

[0095] reach_disk=max(x_distances[j],distances[i,j]) (7).

[0096] Step 4.3: Calculate the reachable distance of all trajectory data to form the reachability matrix reachability_matrix.

[0097] Step 5: For each trajectory data, calculate the local reachability density of its x nearest neighbor trajectory data.

[0098] Specifically include:

[0099] For trajectory data i, calculate the local reachability density local_reachability_density between it and the x nearest neighbor trajectory data. The formula is:

[0100]

[0101] Among them, freq i is the occurrence frequency of trajectory data i, reachability_matrix,axis=1 means that the reachability matrix reachability_matrix is ​​calculated by column.

[0102] Step 6: Calculate the LOF value of each trajectory data.

[0103] Specifically include:

[0104] For trajectory data i, the LOF value calculation formula of trajectory data is:

[0105]

[0106] Among them, local_reachability_density[j] represents the local reachability density of the x nearest neighbor trajectory data j of trajectory data i, It represents the average value of the local reachability density of the x nearest neighbor trajectory data of trajectory data i.

[0107] Step 7: Set a threshold T, compare the LOF value of each trajectory data with the threshold, and determine whether the trajectory data is an infrequent behavior.

[0108] Specifically include:

[0109] If the LOF value of a trajectory data is greater than or equal to the threshold T, the trajectory data is an infrequent behavior trajectory; if the LOF value of a trajectory data is less than the threshold T, the trajectory data is a frequent behavior trajectory.

[0110] This method checks each track one by one, and calculates the local reachability density and LOF value of each track in turn according to the distance between tracks. According to the LOF value, the frequent behavior set and the infrequent behavior set are selected. The LOF algorithm calculates the LOF value by comparing the density of each data point with the surrounding data points. It considers the local and global properties of the data set at the same time, reduces the impact of noise on infrequent behavior detection, and provides more accurate infrequent behavior detection results.

[0111] The LOF-based algorithm is a method for detecting outliers in data and can mine rare data points. The LOF algorithm calculates the relative density of each trajectory with other trajectories in its neighborhood, taking into account both the local and global properties of the dataset, and can detect multiple types of infrequent behaviors. When calculating the local reachability density of each trajectory, this method introduces the frequency information of the trajectory, which can more comprehensively evaluate the similarity between trajectories.

[0112] The logarithmic function is introduced to compress the frequency data, making the frequency distribution smoother. Trajectories with lower frequencies have greater weights in calculations, which helps reduce data imbalance problems. The degree of infrequent behavior is measured by calculating the LOF value of each trajectory point. This makes LOF highly interpretable in infrequent behavior mining.

[0113] The trajectory similarity metric combines the two similarity indicators ROUGE-N and ROUGE-L. It takes into account the overlap of continuous activity sequences and the longest common activity sequence. It also sets adjustable weights. If you pay more attention to continuous activity segments, you can increase the weight of ROUGE-N; if you pay more attention to the longest common activity sequence, you can increase the weight of ROUGE-L. It can more comprehensively compare the similarities between case trajectories, flexibly adjust the similarity metric according to the specific application scenario, and provide information in multiple dimensions to understand the characteristics of trajectory similarity.

[0114] In the present invention, the trajectory frequency is introduced as a factor in calculating the local reachable density, which can better reflect the importance and frequency of the trajectory. At the same time, the logarithmic function is used for normalization, so that the trajectory with a higher frequency is closer to the trajectory with a lower frequency after normalization, thereby balancing the density difference between different trajectories. The density and outlier of the trajectory can be evaluated more accurately.

[0115] The distance measure between two trajectories is expressed as 1 minus the similarity between the trajectories. The specific calculation process of trajectory similarity is shown in Example 3.

[0116] Example 3: Let trajectory σ 1 =<a,b,c,d,e,f,g> With the trajectory σ 2 =<a,b,c,e,f,g> . Calculate the similarity index of two trajectories ROUGE-1, ROUGE-2 scores, ROUGE-L score in ROUGE-N, and get the trajectory similarity comprehensively. For trajectory σ 1 and σ 2 After splitting by unary matching and binary matching, they are shown in Tables 3 and 4.

[0117] Table 3 Split by unary matching

[0118]

[0119] Table 4 Split by binary matching

[0120]

[0121] ROUGE-N index score calculation, after splitting by multivariate continuous matching, is calculated same

[0122] ROUGE-L score calculation, the longest subsequence S that is the same in tracks i and j lcs (i, j) = 6, β in the ROUGE-L index is 1, and the calculation is:

[0123]

[0124]

[0125]

[0126] The similarity of trajectories i and j can be obtained by multiplying the ROUGE-N and ROUGE-L indicator scores of two trajectories with the corresponding weights and summing them. The ROUGE indicator is combined with ROUGE-1, ROUGE-2 and ROUGE-L with weight parameters of 0.3, 0.3 and 0.4.

[0127] ROUGE_1*0.3+ROUGE_2*0.3+ROUGE_L*0.4=0.917

[0128] In order to better demonstrate the effect of the present invention, an example is given below to compare the existing method with the method of the present invention.

[0129] Three methods:

[0130] ① The ROUGE indicator is used as a distance function, combined with the method proposed by the present invention of the LOF algorithm.

[0131] ② Cosine similarity is used as a distance function, combined with the partitioning clustering method of the K-means clustering algorithm.

[0132] ③ The spectral clustering method is combined with the edit distance as the distance function.

[0133] The parameter settings are introduced in detail below. In real event logs, trajectories with a length of less than 3 have basically no reference value. Therefore, when preprocessing event logs, trajectories with a length of less than 3 are ignored. ① When using the method of the present invention to mine infrequent behaviors, the number of nearest neighbors x of the specified trajectory is set to 5, and the threshold T for judging infrequent behavior trajectories is set to 2. When the ROUGE indicators are used in combination, the weight parameters of ROUGE-1, ROUGE-2 and ROUGE-L are 0.3, 0.3 and 0.4. ② The number of K-Means clusters k is set to 4. ③ When using the spectral clustering method for infrequent behavior mining, the number of clusters k is set to 4. The general edit distance threshold edit_eps is set to 0.3.

[0134] Example 1

[0135] In Example 1, the infrequent behaviors obtained by the DBSCAN algorithm are used as a benchmark. The infrequent behavior mining method is analyzed by calculating the F1 value and the running time.

[0136] (1) Comparison of F1 values. The F1 value is an indicator for comprehensively evaluating model performance, which is obtained by reconciling the precision rate and the recall rate. The F1 value is defined as follows: Wherein, Precision is the accuracy of the method of the present invention, which measures the proportion of samples predicted by the algorithm to be positive examples that are actually positive examples. Recall is the recall rate of the method of the present invention, which measures the ratio of the number of positive samples correctly identified by the algorithm to the number of samples that are actually positive.

[0137] The precision rate is the proportion of samples that are judged as infrequent behaviors that are actually infrequent behaviors. Among them, TP is the number of infrequent behaviors correctly identified, and FP is the number of infrequent behaviors incorrectly identified. Recall rate is the proportion of all infrequent trajectories that are correctly mined, that is, Among them, FN is the number of behaviors that are predicted to be frequent but predicted incorrectly and are actually infrequent behaviors.

[0138] (2) The time taken for infrequent behavior mining. The infrequent behavior mining method processes the preprocessed event logs. The time for event log preprocessing is not included. The time from the start of infrequent behavior mining to the mining of all infrequent behaviors is recorded in seconds.

[0139] In order to verify the operation effect of the method of the present invention on real cases, experiments will be conducted on several real events. By using real data sets, the applicability and performance of the proposed method in actual scenarios can be better evaluated. The data sets used in this experiment are as follows.

[0140] ①BPIC_2017: contains real event logs about loan applications from Dutch financial institutions. The trajectory represents the loan application process of a customer.

[0141] ②Request For Payment: includes events where students apply for domestic non-travel related expenses. The track represents the process of students applying for regular expenses.

[0142] ③Domestic Declarations: Contains events where students apply for domestic travel expense reimbursement. The trace represents the process of students applying for travel expenses.

[0143] ④Prepaid Travel Cost: includes the event that students apply for prepaid travel expenses. The trace represents the process of students applying for prepaid travel expenses.

[0144] ⑤Help Desk: Contains events of the workflow of the customer service center of the Netherlands Telecom Company. The trace represents the flow of customer service records.

[0145] ⑥International Declarations: Contains events where students apply for international travel expense reimbursement. The track represents the process of students applying for international travel expense reimbursement.

[0146] Experimental verification on real data sets. In order to verify the effectiveness of the method of the present invention, six real data sets commonly used in the field of data mining are used for analysis and comparison. The basic information of the event log after preprocessing is shown in Table 5.

[0147] Table 5 Real event log related information

[0148]

[0149] In the experiment, the F1 value and running time of the three algorithms, namely, the method of the present invention, the partition clustering method and the spectral clustering method, in detecting infrequent behaviors are compared in detail. The experimental results are shown in Tables 6 and 7.

[0150] Table 6 F1 values ​​of three algorithms on different datasets

[0151]

[0152]

[0153] In terms of F1 value. It can be seen that in the real event log set, the proportion of infrequent behaviors is small, and the algorithm can easily achieve a high precision and recall rate, and the F1 value is obtained after reconciliation. The performance of the method of the present invention is better than that of the partition clustering method and the spectral clustering method, and has higher performance in 6 experimental sets. The partition clustering method is slightly lower in F1 value, and the spectral clustering method performs relatively poorly. In general, the method of the present invention has strong accuracy and stability when conducting infrequent behavior mining experiments.

[0154] Table 7 Running time of three algorithms on real logs

[0155]

[0156] In terms of running time, the method of the present invention and the partitioning clustering method run in less than 1 second on the BPIC2017, Request For Payment, and Domestic Declarations event logs with smaller data volumes, which is much lower than the spectral clustering method. At the same time, although the method of the present invention is slightly slower than the partitioning clustering method in some cases, it still maintains a very high F1 value, outperforming the partitioning clustering method in terms of quality.

[0157] In summary, the method of the present invention shows a higher F1 value and a shorter running time in the infrequent behavior mining experiment. This means that it can not only effectively identify and mine infrequent behaviors, but also complete the task at a faster speed. Therefore, the method of the present invention has obvious advantages in infrequent behavior mining.

[0158] In order to see the operation of the three methods more comprehensively. Different x values ​​are used in the method of the present invention for infrequent behavior mining. Different k values ​​are used in the partition clustering method and the spectral clustering method for infrequent behavior mining. The dataset used is the International Declarations dataset with a moderate number of deduplicated trajectories. The x value in the method of the present invention is the x trajectories of the nearest neighbor for calculating the LOF value, and the k value in the partition clustering method and the spectral clustering method is the number of clusters of trajectory clustering.

[0159] Experiments were conducted using the method of the present invention, the partition clustering method, and the spectral clustering method under different parameters. The F1 value was as follows: Figure 3 shown.

[0160] Figure 3It is the F1 value performance of the method of the present invention, the partitioning clustering method and the spectral clustering method under different values. For the method of the present invention, as the x value increases, the F1 value gradually increases, and reaches the highest point of 0.9558 when x=5. After that, the x value continues to increase, the F1 value decreases slightly, and drops to 0.9535 when x=12, and generally maintains a very high F1 value. The F1 value of the partitioning clustering method is lower than that of the method of the present invention, always close to 0.9384, with no obvious upward trend, and is generally slightly lower than the method of the present invention. The F1 value of the spectral clustering method is improved most significantly. As the k value increases, the F1 value increases, and the spectral clustering method can better capture infrequent behaviors by dividing into more clusters. But it is still not as good as the other two methods.

[0161] Overall, the F1 value of the method of the present invention is generally maintained in a relatively high range. The parameter setting has a very loose range and is applicable to a variety of data sets.

[0162] The following is a comparative experiment based on the main improvements of the method of the present invention. A comparative experiment is conducted when the two indicators ROUGE-N and ROUGE-L are used in combination and separately. When the two indicators are used in combination, the weight parameters of ROUGE-1, ROUGE-2 and ROUGE-L are 0.3, 0.3 and 0.4. When ROUGE-N is used alone, the weight parameters of ROUGE-1 and ROUGE-2 are 0.5 and 0.5. A comparative experiment is conducted between the improved LOF algorithm with the addition of frequency information and logarithmic function and the unimproved LOF algorithm.

[0163] Figure 4 The figure shows the comparison of F1 values ​​of different ROUGE indicators under different parameters. After comparative analysis, the ROUGE-N combined with the ROUGE-L method showed relatively stable performance throughout the experiment by setting the weights reasonably. The combination of the two indicators is generally higher than the F1 value used alone, and the fluctuation is relatively small. When using the ROUGE-N indicator, when the value of x is large, the F1 value increases, and it will also decrease as the value of x increases. The F1 value of the ROUGE-L indicator gradually decreases when x is 2 to 5, and is relatively stable afterwards. Therefore, considering the stability and effect comprehensively, the ROUGE-N combined with the ROUGE-L indicator is more suitable for evaluation tasks and more suitable for a variety of situations.

[0164] Figure 5Comparison of F1 values ​​between the improved LOF algorithm with frequency information and logarithmic function and the unimproved LOF algorithm. The improved LOF algorithm performs better in F1 value. When the parameter x is between 3 and 7, the improvement of LOF significantly improves the F1 value. When the parameter x is between 8 and 12, the number of adjacent trajectory points calculated by LOF increases, and the improvement is smaller than that of the unimproved LOF algorithm. Under the same parameters, the F1 value of the improved LOF algorithm remains stable in the entire parameter range, and is generally slightly higher than that of the unimproved LOF algorithm.

[0165] In the method of the present invention, ROUGE-N and ROUGE-L are combined to flexibly set weights according to specific needs and application scenarios. ROUGE-N focuses on the similarity of continuous activity sequences, while ROUGE-L focuses on the similarity of the longest common subsequence of trajectories. The combination of the two more comprehensively considers the trajectory similarity and improves the stability and interpretability of the infrequent behavior detection method.

[0166] When the improved LOF algorithm calculates the local reachable density, it uses the value 1 minus the similarity as the distance between trajectories and adds the trajectory frequency information, which can more accurately mine infrequent behaviors. Adding a logarithmic function to adjust the frequency makes the frequency distribution smooth, and a small number of infrequent behaviors are easy to detect. In summary, the method of the present invention has the advantages of rapid discovery of abnormal behaviors, high scalability, and strong interpretability in infrequent behavior mining.

[0167] Of course, the above description is not a limitation of the present invention, and the present invention is not limited to the above examples. Changes, modifications, additions or substitutions made by technicians in this technical field within the essential scope of the present invention should also fall within the protection scope of the present invention.

Claims

1. A method for mining infrequent behaviors of business processes based on ROUGE index and LOF algorithm, characterized in that: The following steps are involved: Step 1: Get the data set data, and get the event log L from the data set data. The event log L includes multiple trajectory data and the occurrence frequency and trajectory length corresponding to the trajectory data; Step 2: Calculate the distance matrix of trajectory data based on event log L; The specific steps include: Step 2.1: Call the similarity calculation function getROUGEScore() to calculate the distance between any two trajectory data i and j; The specific process is: Step 2.1.1: Calculate the similarity index ROUGE-N score and ROUGE-L score of two trajectory data i and j. The specific formula is: （1）； in, Represents an event log dataset; Represents a track in the event log set; Represents a sequence of n consecutive activities in a trajectory; Indicates that it appears in both trajectories i and j at the same time The number of Representation trajectory Appear in In formula (1), n ​​is 1 for ROUGE-1 score, and n is 2 for ROUGE-2 score; The calculation formula for the Rouge-L score is: （2）； （3）； （4）； in, and Represent two trajectories respectively; and Respectively represent the trajectory and Length; Used to calculate the longest identical subsequence in two trajectories; is a hyperparameter; and Represent the recall and precision of the longest common subsequence respectively; ROUGE-L index is calculated by and Comprehensive consideration is taken to evaluate the similarity between two trajectories; Step 2.1.2: Calculate the similarity between two trajectory data i and j , the calculation formula is: （5）； in, , and All are weights; Step 2.1.3: Calculate the distance between trajectory data i and j ; （6）； Step 2.2: Repeat step 2.1 to calculate the distances between all trajectory data and obtain the distance matrix of trajectory data; Step 3: Arrange each column of the distance matrix of the trajectory data in ascending order, find the xth nearest point of each trajectory data, the distance between the two is called the proximity distance, and is recorded in the array x_distances; Step 4: Obtain the reachability matrix of each trajectory data; Step 5: For each trajectory data, calculate the local reachability density of its x nearest neighbor trajectory data; Specifically include: For trajectory data i, calculate the local reachability density between it and the x nearest neighbor trajectory data , the formula is: （8）； in, is the occurrence frequency of trajectory data i, Represents the reachability matrix Calculate by column; Step 6: Calculate the LOF value of each trajectory data; Specifically include: For trajectory data i, the LOF value calculation formula of trajectory data is: （9）； in, represents the local reachability density of x nearest neighbor trajectory data j of trajectory data i, Represents the average of the local reachability densities of the x nearest neighbor trajectory data of trajectory data i; Step 7: Set a threshold T, compare the LOF value of each trajectory data with the threshold, and determine whether the trajectory data is an infrequent behavior.

2. According to claim 1, a method for mining infrequent behaviors of business processes based on ROUGE index and LOF algorithm is characterized in that: Step 4 specifically includes the following steps: Step 4.1: For trajectory data i, find the x nearest neighbor trajectory data j of trajectory data i; Step 4.2: Get the xth nearest neighbor distance x_distances[j] of trajectory data i, and calculate the reachable distance between trajectory data i and x nearest neighbor trajectory data j , the formula is: （7）； Step 4.3: Calculate the reachable distance of all trajectory data to form a reachability matrix .

3. The method for mining infrequent behaviors of business processes based on ROUGE index and LOF algorithm according to claim 1, characterized in that: Step 7 specifically includes: If the LOF value of a trajectory data is greater than or equal to the threshold T, the trajectory data is an infrequent behavior trajectory; if the LOF value of a trajectory data is less than the threshold T, the trajectory data is a frequent behavior trajectory.

Images