ANALYSIS OF EVENT LOGS FOR INTERNET OF THINGS DEVICES

Abstract

In some implementations, a system can receive an event log containing event data associated with a multitude of events performed by one or more external devices, including the IoT device. Accordingly, the system can analyze the event log to identify activity data associated with at least one activity that encompasses one or more events within the multitude of events. The system can further generate a case associated with that one or more activities, containing information generated based on the activity data, and can perform a process mining operation on that case, including the activity data.

Description

TECHNICAL AREA

[0001] The present disclosure relates generally to Internet of Things (IoT) devices and, for example, to the analysis of event logs for IoT devices. BACKGROUND

[0002] Process mining software can be configured to compare task data against an established process to generate descriptive analyses. For example, a user might use a device (such as a printer) to perform a setup task (such as loading the printer with label media and ribbon, or inserting a battery), execute an operation (such as user input via a mouse or keyboard to send instructions from a computer to the printer so that an image can be rendered and annotated onto media), or perform a maintenance operation (such as cleaning or servicing a component of the printer, like a printhead, or charging a battery for a mobile printer), to name just a few examples. However, collecting and configuring task data for comparison against the established process consumes significant processing resources.Accordingly, a descriptive analysis of this established process may obscure useful observations that relate only to user tasks or only to IoT device operations. Therefore, it is necessary to identify the operations associated with the IoT devices. DESCRIPTION

[0003] Some implementations described herein relate to a method for performing process mining on case data associated with an Internet of Things (IoT) device. The method may involve the device receiving an event log containing event data associated with a multitude of events performed by one or more external devices, including the IoT device. The method may involve the device analyzing the event log to identify activity data from the event data associated with at least one operation encompassing one or more events within the multitude of events. The method may involve the device generating case data associated with the at least one activity and containing the identified activity data.The procedure may include the device performing a process mining operation on the case data.

[0004] Some implementations described here involve an accessible, machine-readable medium that stores a set of instructions for a device. When executed by one or more of the device's processors, the set of instructions can cause the device to receive an event log containing event data associated with a multitude of events performed by one or more external devices, including an IoT device. When executed by one or more of the device's processors, the set of instructions can then cause the device to parse the event log to identify activity data from the event data associated with at least one operation encompassing one or more events within the multitude of events.The set of instructions, when executed by one or more processors of the device, can cause the device to generate case data associated with the at least one operation and containing the identified activity data. The set of instructions, when executed by one or more processors of the device, can also cause the device to perform a process mining operation on the case data.

[0005] Some of the implementations described here refer to a device. The device can include one or more memories and one or more processors coupled to the one or more memories. The one or more processors can be configured to receive an event log containing event data associated with a multitude of events performed by one or more external devices, including an IoT device. The one or more processors can be configured to parse the event log to identify, from the event data, activity data associated with at least one operation that encompasses one or more events from the multitude of events.One or more processors can be configured to create a case associated with at least one operation and containing the identified activity data. One or more processors can then be configured to perform a process mining operation on the case data. BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a representation of an example implementation described herein; Fig. 2 is a flowchart of an example process that focuses on Fig. 1 refers to; Fig. 3A-3B are a flowchart representing step 220 of Fig. 2 presents in more detail; Fig. 4 is a representation of another example implementation described herein; Fig. 5 is a flowchart of an example process that focuses on Fig. 4 refers to; Fig. Section 6 is a representation of a further example implementation of a training and / or a use of a model described herein; Fig. Figure 7 is a flowchart of an example process that focuses on Fig. 6 refers to; Fig. Section 8 is a representation of an example environment in which the systems and / or procedures described herein can be implemented; and Fig. Figure 9 is a representation of example components of one or more devices from Fig. 8. DETAILED DESCRIPTION

[0006] An Internet of Things (IoT) device (e.g., a printer, mobile computing device, barcode scanner, RFID reader, scale, etc.) can be configured to perform one or more operations according to one or more instructions and / or inputs. For example, a printer can perform a setup operation (e.g., advancing a label web so that the first label is near the printhead), a printing operation (e.g., receiving print instructions, displaying an image, and marking the image on the label media), or a maintenance operation (e.g., moving a printhead to facilitate cleaning or stopping a battery charging process when it is fully charged), among other examples. IoT devices can detect the occurrence of operations and catalog operation data that indicates the type of detected operation.The event data can contain (or be linked to) associated data, such as a device identifier or the time of the operation, and is written to memory in an event log. However, these event logs are often structured chronologically rather than logically by activity. Therefore, there is a need to identify the activities associated with the IoT devices so that process mining software can be applied to generate descriptive analyses related to the operations of the IoT devices.

[0007] The following detailed description of exemplary embodiments refers to the accompanying drawings. The same reference numbers in different drawings may denote identical or similar elements.

[0008] IoT devices typically perform one or more operations during use. The specific types of operations and the order in which they occur can vary depending on who is using the IoT device, what the user is trying to achieve, and where the IoT device is used, among other factors. Over time, the performance of an IoT device may degrade or change (e.g., due to wear and tear of one or more components, user error, damage to the IoT device, and / or software or firmware bugs). Conversely, an IoT device may improve (and / or optimize) its performance (e.g., in terms of its status and / or capabilities during use and / or based on improvements or changes to the software and / or firmware on the IoT device, among other factors).Accordingly, process mining software can be used to identify inefficiencies and efficiencies in the operation of an IoT device in order to improve the performance of the IoT device (e.g., energy saving, saving processing resources and / or saving storage resources).

[0009] Some implementations described here provide a system for identifying activities performed by an IoT device based on an event log associated with that device. As described herein, the system can, for example, receive event logs associated with a multitude of IoT devices (such as a multitude of IoT devices associated with a common location, user, brand, or similar firmware or application software) to identify activity data for each IoT device that contains one or more events. In some implementations, the system may include and / or use a model that is configured and / or trained to identify the activity data.

[0010] Accordingly, the system can be configured to apply process mining to case data generated based on operations identified from data in the event log. This allows the system to improve the performance of the IoT device by applying process mining. For example, the system can cause the IoT device to adjust a configuration or setting to reduce the consumption of processor and / or memory resources (e.g., in connection with the execution of unnecessary events and / or events inefficiently) and / or to reduce (or prevent) delays associated with the execution of certain tasks by the IoT device (which can improve the user experience, reduce power consumption, and / or increase availability for the execution of additional operations), among other examples.In another example, the system can send a notification (e.g., a warning) to a user so that they change their behavior to improve the operation and / or performance of the IoT device.

[0011] Fig. Figure 1 is a representation of an example implementation 100, which is associated with the identification of activities that are associated with an IoT device operation, as described herein. As in Fig. As shown in Figure 1, the example implementation 100 comprises one or more IoT devices 110, a management device 120, and an IoT management system 130. These devices are described below in conjunction with Fig. 8 and Fig. 9 described in more detail.

[0012] In example implementation 100, the IoT management system 130 comprises a reference data structure 140, an activity identification model 150, and process mining software 160. As in conjunction with Fig. As described in more detail below, the IoT management system 130 can include a communications device and / or a computing device. For example, the IoT management system 130 can include a server, such as an application server, a client server, a web server, a database server, a host server, a proxy server, a virtual server (running, for example, on computer hardware), or a server in a cloud computing system. In some implementations, the IoT management system 130 includes computer hardware used in a cloud computing environment. As described herein, the IoT management system 130 (and / or another associated system) can configure the process mining software 160 based on a case data structure 170 containing activity data extracted from event logs, as described herein.

[0013] As in Fig. As shown in Figure 1, the IoT management system 130 can receive event data from a variety of IoT devices 110 (e.g., IoT device 110a to IoT device 110n, where n is a positive integer). In some implementations, the IoT devices 110a to 110n can all be the same device type (e.g., all printers, all scanners, all thermostats, or all security cameras, among other examples). Alternatively, at least two of the IoT devices can be different (e.g., a thermostat and a smart light controller, a security camera and a video doorbell, and / or a printer and a scanner nearby, to name just a few examples). Each IoT device 110 can submit a separate event log to the IoT management system 130, which is then combined with the event logs from the other IoT devices.Additionally or alternatively, each IoT device 110 can stream (or otherwise transmit) event data to the IoT management system 130, which is aggregated in an event log for IoT devices 110a through 110n. As mentioned above, in some implementations, the IoT management system 130 may include a server in a cloud computing system or computer hardware used in a cloud computing environment. Thus, in some implementations, event data can be streamed to the IoT management system 130 during the execution of the IoT device 110 and subsequently stored. For example, the event data can be generated as the operations occur (e.g., in real time or near real time) and subsequently retrieved from the cloud computing system or environment using other tools and / or systems.

[0014] As used herein, the term “event data” refers to machine-readable data associated with an operation (e.g., detected by the IoT device 110) and stored by the IoT device 110. Accordingly, an “event log” is a data structure containing event data from one or more operations captured by the IoT device 110.

[0015] As in Fig. As further illustrated in Figure 1, the IoT management system 130 can analyze the event logs to identify activity data associated with at least one operation that includes one or more events performed by the IoT devices 110a to 110n. Accordingly, the IoT management system 130 can use the reference data structure 140 and the activity identification model 150 to identify the activity data, as described in the section on the IoT devices 110a to 110n. Fig. 3A-3B described. For example, the IoT management system 130 can identify event data for a maintenance activity that is associated with individual operations that occur during the maintenance activity. For printers, the types of activities that can be detected can include maintenance activities (e.g., cleaning or replacing a printhead, replacing or adding print media, facilitating or automatically removing / eliminating jammed print media, charging a battery, or other types of maintenance activities), specific printing activities (e.g., with events related to printing content onto media under certain conditions or with specific parameters), and specific processing activities (e.g., with events related to verifying a connection to a host system or network). For mobile computers (e.g., scanners), specific maintenance activities (e.g.,Software updates, memory wipes, or other types of maintenance activities), certain scanning activities (e.g., events scanning content under specific conditions or with specific parameters), and certain processing activities (e.g., events verifying a connection to a host system or network) can be identified, among other examples. For thermostats, certain types of activities can be identified, such as environmental control activities (e.g., heating or cooling a building, or other environmental control activities), certain maintenance activities (e.g., filter expiration and replacement), and certain processing activities (e.g., events verifying a connection to a host system or network). Other types of activities can be identified similarly for other types of IoT devices.

[0016] As in Fig. As further illustrated in Figure 1, the IoT management system 130 can store a data structure 170 containing case data and the identified activity data. Additionally, the case data can contain derived data. For example, based on timestamps contained in the activity data, the IoT management system 130 can calculate durations associated with at least one operation. Accordingly, the IoT management system 130 can process the case data using process mining software 160 (e.g., Celonis Process Mining, UiPath Platform, ARIS Process Mining 10, DISCO, Scout Platform, Minit, SAP Signavio Process Intelligence, Kofax Insight, QPR ProcessAnalyzer, or similar process mining software).

[0017] In some implementations, the IoT Management System 130 can configure the IoT devices 110a to 110n based on the output of the process mining operation. For example, the IoT Management System 130 can configure the IoT devices 110a to 110n via communication links established between the IoT Management System 130 and the IoT devices 110a to 110n (e.g., via a network or a peer-to-peer communication protocol). The IoT Management System 130 can configure the IoT devices 110a to 110n with settings to reduce the duration associated with certain activities, thereby saving energy, processing resources, and / or memory. Additionally or alternatively, the IoT Management System 130 can display recommended settings to a user (e.g., via a user device, as in conjunction with...). Fig. 4 described). Additionally or alternatively, the IoT management system 130 can output descriptive and diagnostic analyses (e.g., to a user interface) obtained by the process mining software 160 based on the case data (e.g., DISCO® ediscovery data). In some implementations, the IoT management system 130 can output both the descriptive analyses based on the case data and reported process information based on task data associated with an established process that includes a user of the IoT devices 110a to 110n.

[0018] As mentioned above, Fig. 1 is shown as an example. Other examples can be found in the description in Fig. 1 differ. The number and arrangement of the in Fig. The devices shown in Figure 1 are an example. In practice, there may be additional devices, fewer devices, different devices, or devices arranged differently than those shown. Fig. Give 1. In addition, two or more of the in Fig. The devices shown in 1 may be implemented in a single device, or a single device in Fig. The device shown in Figure 1 can be implemented as multiple distributed devices. Additionally or alternatively, a device can be integrated into Figure 1. Fig. 1. The depicted group of devices (e.g., one or more devices) performs one or more functions that are delegated to another in Fig. The group of devices shown in 1 will be implemented.

[0019] Fig. Figure 2 is a flowchart of an example process 200, which is associated with performing a process mining operation on case data related to IoT devices. In some implementations, one or more process steps of Fig. 2. These processes are performed by a system (e.g., the IoT management system 130). In some implementations, one or more process steps can be performed by Fig. 2. performed by another device or group of devices that are separate from or include the system, such as the IoT device 110, the management device 120 and / or a user device 430 (as described in Fig. 4 shown). Additionally or alternatively, one or more process steps of Fig. 2 of one or more components of the device 900 of Fig. 9 are performed, such as processor 920, memory 930, input component 940, output component 950 and / or communication component 960.

[0020] As in Fig. As shown in Figure 2, process 200 in step 210 can include receiving an event log containing event data associated with a variety of events performed by one or more devices (e.g., including IoT device 110). For example, the IoT management system 130 can receive the event data from IoT device 110. IoT device 110 can detect an operation and catalog the occurrence of that operation in memory. For example, a printer can detect the opening of a printhead assembly and record the type and time of the printhead opening in the printer's memory as event data. In another example, the printer device can detect the closing of the printhead assembly and record the type of printhead closing operation and the time data in the printer's memory as event data.Accordingly, the printer device can detect a variety of operations and record associated event data in memory to create the event log. In some implementations, the IoT management system 130 can receive the event data individually from the IoT device 110 or from multiple IoT devices via event logs. The event logs can be received by the IoT device 110 during a training period associated with training an activity identification model and / or a feature extraction model associated with the activity identification model, as described elsewhere herein. Additionally or alternatively, the event logs can also be received during the operation of the IoT devices.

[0021] In some implementations, the IoT device 110 can be configured to periodically send the event log to the IoT management system 130 (e.g., according to a schedule and / or based on a detected operation (or set of operations)). Additionally or alternatively, the IoT device 110 can be configured to send the event log to the IoT management system 130 based on a request received from the IoT management system 130 (which can be transmitted periodically and / or on demand, for example, based on user input). The event log associated with the IoT device 110 can contain event data for one or more operations detected by the IoT device 110. In some implementations, the event data can be streamed to the IoT management system 130 while the IoT device 110 is performing an operation.For example, event data can be generated when the processes occur (e.g., in real time or near real time).

[0022] In some implementations, the event log can display IoT device information that identifies one or more characteristics and / or properties of IoT device 110. These characteristics can include, but are not limited to, a version of the software installed on IoT device 110, a type of IoT device 110, a make or model of IoT device 110, a serial number of IoT device 110, a name associated with IoT device 110, and / or an Internet Protocol (IP) address associated with IoT device 110. Characteristics can also include a usage history of IoT device 110 (e.g., a number of operations performed by IoT device 110, an identifier of a user logged into IoT device 110, and / or a number of specific types of operations performed by IoT device 110, among other examples).

[0023] In some implementations, the IoT management system 130 can also obtain status information from the IoT device 110 (e.g., based on the IoT devices being configured to log event data and / or track operations, and / or based on the IoT device 110 experiencing an error within a threshold period after the operations have been performed). Additionally or alternatively, the status information can be viewed by a user through a user interface of the IoT device 110 or through the management device 120 (e.g., in conjunction with a supervised learning technique described herein). The status information can identify one or more types of problems (or errors) occurring in the IoT devices during specific time periods.For printers, such problems can include user interface issues, printing errors, delays in completing a process, media defects (e.g., clogs or creases in media such as ribbons or labels), or printhead or other hardware component failures, among other examples. Another example for thermostats is the inability to activate an associated heating, ventilation, and air conditioning (HVAC) system, display problems (e.g., faulty pixels), or input problems (e.g., a faulty button and / or touchscreen), to name just a few.

[0024] As in Fig. As further described in Figure 2, in step 220, process 200 analyzes the event log to identify activity data from the event data that is associated with at least one operation containing one or more events from the multitude of events. For example, based on the event data contained in the event logs, the IoT management system 130 can identify events that are associated with each type of operation. For example, the IoT management system 130 can recognize that a particular event associated with an operation is a start event (e.g., an event that starts the operation or that is paired with an end event or an intermediate event), an intermediate event of the operation (e.g., an event that occurs between two other events), or an end event of the operation (e.g., an event that ends the operation or that is paired with a start event or an intermediate event).Additionally or alternatively, the IoT Management System 130 can classify a specific event. The IoT Management System 130 can classify a specific event as a set event if it is an event that occurs in conjunction with another event to form an operation. The IoT Management System can classify a specific event as a standalone event (e.g., an event that is the only event for the operation) or as a nested event (nested within an operation that consists of paired events or occurs independently). The IoT Management System 130 can classify a specific event as a delete event if it is an event that terminates an activity or a total delete event that terminates all ongoing activities related to the IoT Device 110 (e.g., a shutdown or power outage event).In some implementations, the IoT Management System 130 can also determine whether events are passive or active. The IoT Management System 130 can classify an event as passive if it is non-task-related, such as sensor-based events where a sensor detects a specific state, or user-based events where a user interacts with the IoT Device 110 or causes the IoT Device 110 to perform an operation. The IoT Management System 130 can classify an event as active if it is task-related.

[0025] In some implementations, the IoT management system can identify 130 activity data points by extracting event data from the event log based on rules (e.g., by parsing the event data to identify paired events and single events, as in conjunction with the Fig. (described in sections 3A-3B). For example, the IoT Management System 130 can ensure that each identified set event is paired with a delete event. Additionally, the IoT Management System 130 can ensure that some types of standalone events are nested within paired events, while other types of standalone events are not nested within paired events. In some implementations, the IoT Management System 130 can reorder event data. For example, the IoT Management System 130 can reorder a standalone event and a unique event depending on whether the standalone event is nested within a paired event. For instance, an event log might show that a print completion event is associated with the same timestamp as a network disconnection event.Accordingly, the IoT Management System 130 can reorder the events so that the network disconnection event is not embedded within a print start and a print finish event. In another example, an event log might show that a print start event, a printhead close event, and a print finish event all occurred at approximately the same time (or within a time span that meets a threshold). The IoT Management System 130 can then reorder the events so that the printhead close event precedes the print start event, which in turn precedes the print finish event. In yet another example, an event log might show that a coolant level event occurred at approximately the same time (or within a time span that meets a threshold) as a coolant cycle end event.Accordingly, the IoT management system 130 can arrange the events so that the coolant level event is nested within a cooling cycle start event and a cooling cycle end event.

[0026] Additionally or alternatively, the IoT management system can use an identification model that includes a feature extraction model configured to process event logs and / or event data to identify features (e.g., based on parameters in the event data, timestamps associated with events in the event data, or event information received by the management device 120) that are associated with and / or common to a particular type of operation. The feature extraction model can include a machine learning model (e.g., a support vector machine, a regression model, a neural network, a clustering model, a predictive model, and / or a generator model), as described in conjunction with Fig. 6 described. For example, the IoT management system 130 can use a classification model (e.g., a cluster model) to identify the activity data.

[0027] In some implementations, event data can contain one or more parameters associated with the events. For example, these parameters might specify the power level, network connection status, operational status (e.g., successful printing, failed printing, successful scanning, failed scanning, successful heating cycle, failed heating cycle, successful cooling cycle, or failed cooling cycle), memory status, memory level, and / or other parameters associated with the events. The IoT Management System 130 can copy event data from the event logs into data structures that store the activity data associated with the identified activity.

[0028] As in Fig. As further illustrated in Figure 2, process 200 generates case data in step 230, which is associated with at least one operation and contains the identified activity data. Accordingly, the IoT management system 130 can store a data structure containing case data and the identified activity data. Additionally, the case data can contain derived data. For example, based on timestamps contained in the activity data, the IoT management system 130 can calculate durations associated with at least one operation.

[0029] As in Fig. As further shown in Figure 2, in step 240, process 200 performs a process mining operation on the case, including the activity data. For example, the IoT management system 130 can process the case data using process mining software (e.g., Celonis Process Mining, UiPath Platform, ARIS Process Mining 10, DISCO, Scout Platform, Minit, SAP Signavio Process Intelligence, Kofax Insight, QPR ProcessAnalyzer, or similar process mining software). It should be understood that process 200 can also perform other operations (e.g., predictive analytics, anomaly detection, Monte Carlo analysis, and other examples) on the case data, including the activity data.

[0030] Although Fig. Two example steps of process 200 show that process 200 may, in some implementations, have additional steps, fewer steps, different steps, or steps arranged differently than those shown. Fig. 2. Additionally or alternatively, two or more of the steps of process 200 can be carried out in parallel.

[0031] The Fig. Figures 3A-3B are a flowchart of an example process 300, which is associated with the identification of activity data. In some implementations, one or more process steps of the Fig. 3A-3B are executed by a system (e.g., the IoT management system 130). In some implementations, one or more process steps of the Fig. 3A-3B may be performed by another device or group of devices that are separate from or include the system, such as the IoT device 110, the management device 120, and / or a user device 430. Additionally or alternatively, one or more process steps of the Fig. 3A-3B of one or more components of the device 900 of Fig. 9 are performed, such as processor 920, memory 930, input component 940, output component 950 and / or communication component 960.

[0032] As in Fig. As shown in Figure 3A, process 300 identifies activities per category in step 305. For example, a paired set event and a paired clear event can be activity types that are logically paired. Accordingly, a paired set event precedes a corresponding paired clear event. Paired events can be nested. Nesting occurs, for example, when a sequence of events that begins with a paired set event contains further paired set events that occur before a paired clear event for the paired set event. Examples of paired set events and paired clear events for printers might be: "Set printhead open" and "Clear printhead open," "Set media off" and "Clear media off," or "Set ribbon off" and "Clear ribbon off."Examples of paired set events and paired delete events for scanners could be a "start input event" and a "scan stop output event", an "application start event" and an "application stop event", a "battery swap input event" and a "battery swap output event", a "battery charge on event" and a "battery charge off event", a "device break event" and a "device break restore event", or a "Bluetooth connect event" and a "Bluetooth disconnect event".

[0033] Furthermore, a total delete event also deletes all paired events that have not yet been deleted. An example of a total delete event for printers is `cold_start_set`, which occurs when the printer restarts. The restart can be triggered by the user or the system, for example.

[0034] A standalone event can be enclosed within a paired set event and a paired clear event, or within a paired set event and a total clear event. Calibration events are examples of standalone events for printers. Special standalone events are similar to standalone events, except that they are independent of paired events. The `Cut_error-set` event is an example of a special standalone event for printers (for example, a label printer with a media cutter). Another example is a "low battery" event. Similarly, time-delayed events can display device metrics, such as the device firmware version, battery statistics, network connectivity statistics, or memory statistics.

[0035] As in Fig. As further illustrated in Figure 3A, process 300, in step 310, defines behavior options for set event activities, delete event activities, and overall delete event activities. For example, a behavior option for multiple set event activities might include a nesting procedure. In another example, a behavior option for a delete event without a matching set event might include estimating a preceding set event. In yet another example, a behavior option for an overall delete event within a sequence of individual events might include discarding the overall delete event.

[0036] As in Fig. As further shown in Figure 3A, process 300 captures an IoT data sequence in step 315 containing a multitude of data records, each data record containing event data and an IoT identifier. As shown in Fig. As shown in Figure 3A, process 300 in step 320 also discards records until an initial record with a desired IoT identifier is identified. In step 325, activities are iteratively identified for each desired IoT identifier, as shown below in conjunction with Fig. 3B is described. Furthermore, in step 330, process 300 determines whether all desired IoT identifiers have been processed. If all desired IoT identifiers have been processed, process 300 terminates. However, if not all desired IoT identifiers have been processed, process 300 returns to step 325 and can be repeated for each desired IoT identifier until all data has been processed.

[0037] As in Fig. As shown in Figure 3B, in step 327, process 300 determines whether an event is a total delete event. If an event in the dataset is a total delete event, process 300 proceeds to step 335 and logs the total delete event as the only event in the activity. Accordingly, process 300 returns to step 325. If an event in the dataset is not a total delete event, process 300 proceeds to step 337. In step 337, process 300 determines when a series of individual events begins. When a series of individual events begins, process 300 proceeds to step 340 and logs the individual events until it finds a total delete event, a set or delete event, or a special standalone event. Accordingly, the total delete event, the set or delete event, or the special standalone event will be the first event in a subsequent iteration.In some implementations, a behavior option may involve bundling a complete deletion event and / or a specific standalone event within the activity, including the sequence of standalone events. Accordingly, process 300 returns to step 325. Alternatively, if a sequence of standalone events does not begin, process 300 proceeds to step 343.

[0038] In step 343, process 300 determines whether an event in the record is a special standalone event. If an event in the record is a special standalone event, process 300 proceeds to step 345 and logs the special standalone event as the only event in the activity. Accordingly, process 300 returns to step 325. If an event in the record is not a special standalone event, process 300 proceeds to step 347. In step 347, process 300 determines whether an event in the record is a set event. If an event in the record is a set event, process 300 proceeds to step 350 and increments a counter associated with set events. However, if multiple events of the same event type occur before a corresponding delete (or total delete) event, the counter is not incremented.If an event in the data set is a deletion event, the counter is decremented by process 300 in step 350.

[0039] When the counter reaches zero or a total deletion event is detected, process 300 logs the activity. Accordingly, standalone events (or special standalone events) occurring before the counter reaches zero or the total deletion event is detected are included in the activity. Additionally, process 300 returns to step 325.

[0040] If an event in the data record is not a set event, process 300 proceeds to step 355. If a set event is missing for a corresponding delete event in step 355, process 300 assumes that the set event has been lost. Accordingly, the corresponding set event is added to the activity containing the delete event. Process 300 then returns to step 325.

[0041] Although the Fig. Example steps 3A-3B of method 300 show that in some embodiments, method 300 may include additional steps, fewer steps, different steps, or steps arranged differently than shown. Fig. 3A-3B. Additionally or alternatively, two or more of the steps of procedure 300 can be carried out in parallel.

[0042] Fig. Figure 4 is a representation of an example implementation 400 associated with a system for monitoring an IoT device operation, as described herein. As in Fig. As shown in Figure 4, the example implementation 400 comprises an IoT device 110 with an IoT device controller 410 and an event log 420, a user device 430, and an IoT management system 130 (e.g., the IoT management system 130 of example implementation 100). These devices are discussed further below in conjunction with the Fig. 8 and Fig. 9 described in more detail.

[0043] The IoT device 110 can perform an operation. The operation can include, for example, a printing operation, a maintenance operation, a user-based operation, a software-based operation, a cooling system operation, a heating system operation, a filtering operation, an image capture operation, or a focusing operation, among other examples. The IoT device 110 can include, as shown, the IoT device controller 410 and the event log 420. The IoT device controller 410 can be configured to generate and / or maintain the event log 420 in connection with operations performed and / or detected. For example, the IoT device controller 410 can store event data (e.g., in real time or as the operation occurs). As described herein, the event data can further include or identify event parameters and / or timestamps associated with the events.

[0044] Accordingly, the IoT management system 130 can determine a prediction for the IoT device 110 based on at least one operation identified from the event data contained in the event message(s). For example, based on the at least one operation and the process mining performed (e.g., by the process mining software 160) on case data (e.g., in a case data structure 170), including activity data, the IoT management system 130 can predict a subsequent state or operation for the IoT device 110. The prediction can, for example, include a probability that the state or operation will occur within a certain time period.

[0045] Accordingly, the IoT management system 130 can determine a configuration for the IoT device 110 and transmit the configuration to the user device 430 and / or the IoT device 110. Based on the received configuration, the user device 430 and / or the IoT device 110 can then adjust one or more settings of the IoT device identified in the configuration to optimize the IoT device, as described herein. In some implementations, the configuration may be linked to prediction for the IoT device 110.

[0046] As mentioned above, Fig. 4 is shown as an example. Other examples can be found in the description in Fig. 4 differ. The number and arrangement of the in Fig. The devices shown in Figure 4 are only an example. In practice, there may be additional devices, fewer devices, different devices, or devices arranged differently than those shown. Fig. 4. In addition, two or more of the in Fig. The devices shown in the 4 may be implemented in a single device, or a single device in Fig. The device shown in section 4 can be implemented as multiple distributed devices. Additionally or alternatively, a [device] can be implemented in Fig. 4. The depicted set of devices (e.g., one or more devices) performs one or more functions that are performed by another in Fig. The set of devices shown in section 4 will be implemented.

[0047] Fig. Figure 5 is a flowchart of an example Process 500 related to the configuration of an IoT device. In some implementations, one or more process steps of Fig. 5 can be performed by a system (e.g., the IoT management system 130). In some implementations, one or more process steps can be performed by Fig. 5. performed by another device or group of devices that are separate from or include the system, such as the IoT device 110, the management device 120, and / or a user device 430. Additionally or alternatively, one or more process steps of Fig. 5 of one or more components of the device 900 of Fig. 9 are performed, such as processor 920, memory 930, input component 940, output component 950 and / or communication component 960.

[0048] As in Fig. As shown in Figure 5, in step 510, process 500 receives one or more event notifications with event data from one or more external devices (e.g., including IoT device 110). Accordingly, the IoT management system 130 can receive event notification(s) indicating that an operation has occurred, resulting in the logging of event data. In some implementations, the event notification(s) can be received based on the occurrence of a specific operation, based on IoT device 110 detecting that an operation has occurred, and / or periodically. For example, a notification about a media-out event from a printer can be sent when a printer's media sensor detects no media.Similarly, a printer can send a notification about a printhead failure event if a printer controller detects a long period without printing, measures a resistance value of a printer's printhead, and transmits the measured value to the IoT management system 130.

[0049] As in Fig. As further illustrated in Figure 5, in step 520, process 500 identifies at least one operation based on the event data. Accordingly, the IoT management system 130 can identify the at least one operation performed by the IoT device 110. For example, the IoT management system can use rules and / or a machine learning model, as described here, to determine the operation performed. The IoT management system 130 can create an activity set associated with the operation performed and select event data from the event message(s) to include in the activity set.

[0050] As in Fig. As further illustrated in Figure 5, in step 530, process 500 determines a configuration for the IoT device based on at least one operation and a process mining operation. For example, the IoT management system 130 can predict a subsequent state or operation for the IoT device 110 and determine the configuration (e.g., settings for the IoT device 110) to improve the capability of the IoT device 110 (e.g., using less energy, processing resources, or memory). In one example, the IoT device 110 could be a printer, and the IoT management system 130 could adjust a configuration associated with a print job, such as reducing print density to conserve battery power, based on the prediction of an approaching battery discharge event.In another example, the IoT device 110 could be a barcode scanner, the event notification could display a removal-from-dock event, and the IoT management system 130 could instruct the scanner to initiate a network connection to reduce the latency between scanning object barcodes and providing decoded data to the IoT management system 130, based on the IoT management system 130's prediction of an approaching scan-complete event. In another example, the IoT device 110 could be a thermostat, and the IoT management system 130 could cause the thermostat to turn off its display to conserve power and processing resources, based on the prediction of an approaching cooling cycle completion or heating cycle completion event. As a result, the IoT management system 130 (e.g.,(in real time) improves a capability of the IoT Device 110, thereby saving energy, computing resources and / or device resources (e.g. media or other materials) that would otherwise be wasted if the configuration were not updated.

[0051] As in Fig. As further shown in Figure 5, process 500 in step 540 transfers the configuration to a user device or to the IoT device. Accordingly, based on the received configuration, the user device 430 and / or the IoT device 110 can adjust one or more settings of the IoT device 110 that were identified in the configuration in order to optimize the IoT device 110, as described above.

[0052] Although Fig. The five example steps of process 500 show that process 500 may have additional steps, fewer steps, different steps, or steps arranged differently in some implementations than those shown. Fig. The process comprises 5 steps. Additionally or alternatively, two or more of the steps of process 500 can be carried out in parallel.

[0053] Fig. Figure 6 is a diagram illustrating an example 600 of training and using a machine learning model in conjunction with learning and identifying activities related to an IoT device 110. The training and use of the machine learning model described here can be performed using a machine learning system. The machine learning system may include or be contained within a computer device, server, cloud computing environment, or similar, such as the IoT management system 130, as described in more detail elsewhere herein.

[0054] As shown under reference number 605, a machine learning model can be trained on a set of observations. The set of observations can be obtained from training data (e.g., historical data), such as data collected during one or more of the processes described herein. In some implementations, the machine learning system can receive the set of observations (e.g., as input) from one or more IoT devices 110a to 110n, a user device 430, and / or an administrative device 120, as described elsewhere herein.

[0055] As shown under reference number 610, the set of observations comprises a feature set. The feature set may contain a set of variables, and a variable may be referred to as a feature. A particular observation may contain a set of variable values ​​(or feature values) corresponding to the set of variables. In some implementations, the machine learning system may determine variables for a set of observations and / or variable values ​​for a particular observation based on inputs received from the IoT device(s) 110a to 110n, the user device 430, and / or the management device 120. For example, the machine learning system may determine a feature set (e.g.,one or more features and / or feature values) by extracting the feature set from structured data, by performing natural language processing to extract the feature set from unstructured data, and / or by receiving input from an operator.

[0056] For example, a feature set for a set of observations can include a first feature of IoT device information (e.g., identifying information such as a name, IP address, serial number, and / or other similar information), a second feature based on activity data (e.g., an event type with an activity set), a third feature of event data (e.g., operations performed by an IoT device), and so on. As shown, for a first observation, the first feature can have a value of Information_1 (e.g., identifying a first IoT device), the second feature can have a value of Activity_1 (e.g., identifying an event type), the third feature can have a value of Ev_1.1, Ev_1.2, etc. (e.g., identifying event data associated with Activity_1), among other examples.These features and feature values ​​are given as examples and may differ in other examples. For instance, the feature set may include one or more of the following: a location of the IoT device, an entity or user associated with the IoT device, a media type associated with the activity, power consumption (or other resource consumption) associated with the activity, timestamps associated with events, and / or a usage history of the IoT device, among other examples.

[0057] As reference number 615 shows, the set of observations can be associated with a target variable. The target variable can be a variable with a numeric value, a variable with a numeric value that falls within a range or has several discrete possible values, a variable selectable from one of several options (e.g., one of several classes, classifications, or identifiers), and / or a variable with a Boolean value. A target variable can be associated with a target variable value, and a target variable value can be specific to an observation. In Example 300, the target variable is an IoT device status (e.g., an indication of the next expected event for the IoT device), which has the value Status_1 for the first observation.

[0058] The features and target variables described above are examples, and other examples may differ. For example, with a target variable of type activity, the feature group could include events and the timestamps associated with those events.

[0059] The target variable can represent a value for which a machine learning model is trained to predict, and the feature set can represent the variables that are fed into a trained machine learning model to predict a value for the target variable. The set of observations can contain values ​​of the target variable, allowing the machine learning model to be trained to recognize patterns in the feature set that lead to a target variable value. A machine learning model trained to predict a target variable value can be called a supervised learning model.

[0060] In some implementations, the machine learning model can be trained on a set of observations that do not contain a target variable. This can be referred to as an unsupervised learning model. In this case, the machine learning model can learn patterns from the set of observations without labeling or supervision and provide output indicating such patterns, for example, through clustering and / or association to identify related groups of elements within the set of observations.

[0061] The machine learning system can train a machine learning model 620 using the observation set and one or more machine learning algorithms, such as a regression algorithm, a decision tree algorithm, a neural network algorithm, a k-nearest neighbor algorithm, a support vector machine algorithm, or similar. After training, the machine learning system can store the machine learning model as a trained machine learning model 625 for use in analyzing new observations.

[0062] Furthermore, the machine learning system can apply the trained machine learning model 625 to a new observation by, for example, receiving a new observation and inputting it into the trained machine learning model 625. As shown, the new observation might contain, for example, a first feature of IoT device information, a second feature of activity data, a third feature of event data, and so on. The machine learning system can then apply the trained machine learning model 625 to the new observation to generate an output (e.g., a result). The nature of the output can depend on the type of machine learning model and / or the type of machine learning task being performed. For example, the output might include a predicted value of a target variable, such as when supervised learning is used.Additionally or alternatively, the output may contain information that identifies a cluster to which the new observation belongs, and / or information that indicates the degree of similarity between the new observation and one or more other observations, e.g., when unsupervised learning is used.

[0063] For example, the trained machine learning model 625 can predict a value of Status_N for the IoT device status target variable for the new observation. Based on this prediction, the machine learning system can make an initial recommendation, provide output to determine an initial recommendation, perform an initial automated action, and / or initiate the performance of an initial automated action (e.g., by instructing another device to perform the automated action), among other examples. The initial recommendation might, for instance, include a suggestion to change a setting in the IoT device configuration and / or a suggestion to update the IoT device's software or firmware.The first automated action could include, for example, the automatic adjustment of a setting in the configuration of the IoT device and / or the automatic download or installation of an update to the software or firmware of the IoT device.

[0064] In some implementations, the trained machine learning model 625 can classify (e.g., cluster) the new observation into a cluster. The observations within a cluster may have a threshold for the degree of similarity. For example, if the machine learning system classifies the new observation into an initial cluster 630a (e.g., a cluster associated with a state or group of states), then the machine learning system can make an initial recommendation, such as the initial recommendation described above. Additionally or alternatively, the machine learning system can perform an initial automated action and / or initiate the performance of an initial automated action (e.g., by instructing another device to perform the automated action) based on the classification of the new observation into the initial cluster, such as the initial automated action described above.Other clusters could be Cluster 630b and Cluster 630c, as shown in . Fig. 6 shown.

[0065] In some implementations, the recommendation and / or automated action associated with the new observation may be based on a target variable value that has a specific label (e.g., classification or categorization), on whether a target variable value meets one or more thresholds (e.g., whether the target variable value is greater than a threshold, less than a threshold, equal to a threshold, falls within a range of thresholds, or similar), and / or on a cluster into which the new observation is classified. The recommendations, actions, and clusters described above are examples, and other examples may differ.

[0066] In some implementations, the trained machine learning model 625 can be retrained using feedback information. For example, feedback can be provided to the machine learning model. This feedback can be associated with actions taken based on recommendations from the trained machine learning model 625, and / or with automated actions performed or caused by the trained machine learning model 625. In other words, the recommendations and / or actions output by the trained machine learning model 625 can be used as input to retrain the machine learning model (e.g., a feedback loop can be used to train and / or update the machine learning model).For example, the feedback information can include updated event information associated with the IoT device.

[0067] In this way, the machine learning system can apply a rigorous and automated process to learn and identify the state of IoT devices. The machine learning system enables the detection and / or identification of dozens, hundreds, thousands, or millions of features and / or feature values ​​across dozens, hundreds, thousands, or millions of observations, thereby increasing accuracy and consistency and reducing the delay associated with identifying states and improvements for IoT devices. Additionally or alternatively, the machine learning system can apply a rigorous and automated process to learn and identify activities in event logs associated with IoT devices.The machine learning system enables the detection and / or identification of dozens, hundreds, thousands, or millions of features and / or feature values ​​for dozens, hundreds, thousands, or millions of observations, thereby increasing accuracy and consistency and reducing the delay associated with identifying activities for IoT devices. This can be used to apply process mining operations to cases associated with the activities, thereby improving the operation of the IoT device.

[0068] As already mentioned, Fig. 6 is shown as an example. Other examples may differ from what is associated with Fig. As described in section 6, they differ.

[0069] Fig. Figure 7 is a flowchart of an example process 700, which is associated with the training and use of a machine learning model. In some implementations, one or more process steps of Fig. 7. This can be performed by a system (e.g., the IoT management system 130). In some implementations, one or more process steps can be performed by Fig. 7. performed by another device or group of devices that are separate from or include the system, such as the IoT device 110, the management device 120, and / or a user device 430. Additionally or alternatively, one or more process steps of Fig. 7 of one or more components of the device 900 of Fig. 9 are performed, such as processor 920, memory 930, input component 940, output component 950 and / or communication component 960.

[0070] As in Fig. As shown in Figure 7, in step 710, process 700 trains a machine learning model based on at least one stored observation and its associated feature set and target variables. Accordingly, the IoT management system 130 can train the machine learning model using one or more machine learning algorithms, such as a regression algorithm, a decision tree algorithm, a neural network algorithm, a k-nearest neighbor algorithm, a support vector machine algorithm, or similar. After training, the IoT management system 130 can store the machine learning model as a trained machine learning model for use in analyzing new observations.

[0071] For example, the IoT management system 130 can receive training data showing at least one stored observation based on historical (and / or real-world) uses of the IoT devices 110a to 110n during a specific period (e.g., a training period, an evaluation period, and / or a test period). In such a case, the IoT management system 130 can receive reference event data and / or reference event logs associated with the IoT devices 110a to 110n that perform operations during their use. Additionally or alternatively, a preselected or preconfigured set of IoT devices (e.g., with different sets of features or configurations) can be configured for use in training the IoT management system 130 model, as described herein.

[0072] As in Fig. As further illustrated in Figure 7, process 700 processes a new observation by the trained model in step 720. For example, in step 730a for supervised learning, the trained model can predict a target variable for the new observation. Alternatively, in step 730b for unsupervised learning, the trained model can determine a cluster for the new observation.

[0073] As in Fig. As further shown in Figure 7, process 700 determines in step 740 whether a new observation is available. If a new observation is available, process 700 returns to step 720. In this way, process 700 can iterate for each new observation to be processed. Accordingly, the trained model can be used repeatedly for new observations. Alternatively, process 700 terminates if no new observation is available. In some implementations, such as in conjunction with Fig. As described in section 6, the model can be retrained using the results of some or all of the new observations.

[0074] Although Fig. The seven example steps of process 700 show that in some implementations, process 700 may have additional steps, fewer steps, different steps, or steps arranged differently than those shown. Fig. The 7 steps shown are included. Additionally or alternatively, two or more of the steps of process 700 can be carried out in parallel.

[0075] Fig. Figure 8 is a diagram of an example environment 800 in which the systems and / or procedures described here can be implemented. As in Fig. As shown in Figure 8, the environment 800 can include an IoT management system 130, one or more IoT devices 110, a management device 120, a user device 430, and a network 810. The devices in the environment 800 can be connected to each other via wired connections, wireless connections, or a combination of wired and wireless connections.

[0076] The IoT management system 130 comprises one or more devices capable of receiving, generating, storing, processing, providing, and / or forwarding information related to learning, identifying, and / or monitoring the operation of an IoT device 110, as described elsewhere herein. The IoT management system 130 may include a communications device and / or a computing device. For example, the IoT management system 130 may include a server, such as an application server, a client server, a web server, a database server, a host server, a proxy server, a virtual server (running, for example, on computer hardware), or a server in a cloud computing system. In some implementations, the IoT management system 130 includes computer hardware used in a cloud computing environment.

[0077] The IoT device 110 comprises one or more devices capable of receiving, generating, storing, processing, and / or providing information related to the performance of one or more operations and / or event logs associated with those operations, as described elsewhere herein. In one embodiment, the IoT device 110 may comprise one or more printers, scanners, thermostats, mobile computers, or similar devices. The IoT device 110 may include a communication device and / or a computing device that enables communication with one or more of the other devices in the environment 800.

[0078] The management device 120 comprises one or more devices capable of receiving, generating, storing, processing, and / or providing information related to managing the execution of an operation of the IoT device 110 and / or managing or controlling the IoT management system 130, as described elsewhere herein. The management device 120 may include a communications device and / or a computing device. For example, the management device 120 may include a wireless communications device, a mobile phone, a user device, a laptop computer, a tablet computer, a desktop computer, an unmanned aerial vehicle (UAV), a wearable communications device (such as a smartwatch, smart glasses, a head-mounted display, or a virtual reality headset), or a similar type of device.

[0079] The User Device 430 comprises one or more devices capable of receiving, generating, storing, processing, and / or providing information associated with the management, control, or use of the IoT Device 110, as described elsewhere herein. The User Device 430 may include a communications device and / or a computing device. For example, the User Device 430 may include a wireless communications device, a mobile phone, a user device, a laptop, a tablet computer, a desktop computer, a wearable communications device (such as a smartwatch, smart glasses, a head-mounted display, or a virtual reality headset), or a similar type of device.

[0080] The in Fig. Figure 8 shows the number and arrangement of devices and networks, which is only an example. In practice, additional devices and / or networks, fewer devices and / or networks, different devices and / or networks, or devices and / or networks arranged differently than those shown may be used. Fig. 8 shown may be present. In addition, two or more of the ones shown may be present. Fig. The devices shown in the 8 illustrations may be implemented in a single device, or a single device in Fig. The device shown in Figure 8 can be implemented as multiple distributed devices. Additionally or alternatively, a set of devices (e.g., one or more devices) of environment 800 can perform one or more functions that are described as being performed by another set of devices of environment 800.

[0081] Fig. Figure 9 is a diagram of example components of a Device 900, which may correspond to the IoT Management System 130, the IoT Device 110, the Management Device 120, and / or the User Device 430. In some implementations, the IoT Management System 130, the IoT Device 110, the Management Device 120, and / or the User Device 430 comprise one or more Devices 900 and / or one or more components of the Device 900. As shown in Fig. As shown in Figure 9, the device 900 can comprise a bus 910, a processor 920, a memory 930, an input component 940, an output component 950 and a communication component 960.

[0082] The 910 bus comprises one or more components that enable wired and / or wireless communication between the components of the 900 device. The 910 bus can connect two or more components of Fig. 9. Coupling them together, for example, by operational coupling, communicative coupling, electronic coupling, and / or electrical coupling. The Processor 920 comprises a central processing unit, a graphics processing unit, a microprocessor, a control unit, a microcontroller, a digital signal processor, a field-programmable gate array, an application-specific integrated circuit, and / or another type of processing component. The Processor 920 is implemented in hardware, firmware, or a combination of hardware and software. In some implementations, the Processor 920 comprises one or more processors that can be programmed to perform one or more of the operations or processes described herein.

[0083] Memory 930 comprises volatile and / or non-volatile memory. For example, Memory 930 may include random-access memory (RAM), read-only memory (ROM), a hard disk drive, and / or another type of memory (e.g., flash memory, magnetic memory, and / or optical memory). Memory 930 may include internal memory (e.g., RAM, ROM, or a hard disk drive) and / or removable memory (e.g., removable via a universal serial bus connection). Memory 930 may be a non-transient, computer-readable medium. Memory 930 stores information, instructions, and / or software (e.g., one or more software applications) relating to the operation of Device 900. In some implementations, Memory 930 includes one or more memories connected to one or more processors (e.g., Processor 920), for example, via Bus 910.Additionally or alternatively, the 930 memory can contain one or more memories integrated into the 920 processor (e.g., on the same chip or package).

[0084] The input component 940 enables the device 900 to receive inputs, such as user inputs and / or captured inputs. The input component 940 may include, for example, a touchscreen, a keyboard, a keypad, a mouse, a button, a microphone, a switch, a sensor, a global positioning system sensor, an accelerometer, a gyroscope, and / or an actuator. The output component 950 enables the device 900 to produce outputs, for example, via a display, a speaker, and / or a light-emitting diode. The communication component 960 enables the device 900 to communicate with other devices via a wired and / or wireless connection. The communication component 960 may include, for example, a receiver, a transmitter, a transceiver, a modem, a network card, and / or an antenna.

[0085] The device 900 can perform one or more operations or processes described herein. For example, a non-transitory, computer-readable medium (e.g., memory 930) can store a set of instructions (e.g., one or more instructions or code) for execution by the processor 920. The processor 920 can execute the set of instructions to perform one or more operations or processes described herein. In some implementations, the execution of the instruction set by one or more processors 920 causes the one or more processors 920 and / or the device 900 to perform one or more operations or processes described herein. In some implementations, wired circuitry is used instead of, or in combination with, the instructions to perform one or more operations or processes described herein.Additionally or alternatively, the 920 processor can be configured to perform one or more of the operations or processes described here. Therefore, the implementations described here are not limited to a specific combination of hardware circuits and software.

[0086] The number and arrangement of the in Fig. The components shown in Figure 9 are an example. Device 900 can have additional components, fewer components, different components, or components arranged differently than those shown. Fig. 9 shown. Additionally or alternatively, a set of components (e.g., one or more components) of the device 900 can perform one or more functions that are described as being performed by another set of components of the device 900.

[0087] The foregoing disclosure serves for illustration and description, but makes no claim to completeness or to limit the explanations to the exact forms disclosed. Modifications and variations may be made in light of the above disclosure or may be acquired from practical implementation experience.

[0088] The term "component" as used here is to be understood in the broadest sense as hardware, firmware, and / or a combination of hardware and software. The terms "accessible machine-readable medium," "non-transient machine-readable medium," and "machine-readable storage device" are explicitly defined here as a storage medium (e.g., a disk of a hard disk drive, a digital versatile disc, a compact disc, flash memory, read-only memory, random access memory, or similar) on which machine-readable instructions (e.g., code in the form of software and / or firmware) can be stored. The instructions can be stored for any duration, e.g., permanently, for an extended period (e.g., during the execution of a program associated with the instructions), or for a short period (e.g., during the intermediate storage of the instructions, during a buffering process, etc.).Furthermore, the terms “accessible machine-readable medium”, “non-transitory machine-readable medium”, and “machine-readable storage device” are expressly defined here in such a way as to exclude the transmission of signals. This means that an “accessible machine-readable medium”, a “non-transitory machine-readable medium”, and a “machine-readable storage device”, or similar, as used in the claims, should not be interpreted as a propagating signal.

[0089] Depending on the context, meeting a threshold can refer to a value that is greater than the threshold, greater than or equal to the threshold, less than the threshold, less than or equal to the threshold, equal to the threshold, not equal to the threshold, etc.

[0090] It is clear that the systems and / or procedures described herein can be implemented in various forms of hardware, firmware, or a combination of hardware and software. The actual specialized control hardware or software code used to implement these systems and / or procedures does not limit the possible implementations. Therefore, the operation and behavior of the systems and / or procedures are described here without reference to any specific software code, assuming that software and hardware can be developed to implement the systems and / or procedures based on the description contained herein.

[0091] Even if the claims and / or description specify certain combinations of features, these combinations are not intended to limit the disclosure of different embodiments. In fact, many of these features can be combined in ways not expressly mentioned in the claims and / or disclosed in the description. Although each dependent claim listed below may depend directly on only one claim, the disclosure of the different embodiments includes each dependent claim in combination with every other claim in the claim set. As used herein, a phrase referring to "at least one of" a list of elements refers to any combination of those elements, including individual members. For example, "at least one of: a, b, or c" is intended to include a, b, c, ab, ac, bc, and abc, as well as any combination with several of the same elements.

[0092] No element, action, or instruction used herein should be considered critical or essential unless expressly designated as such. The articles "ein" and "eine" used herein encompass one or more elements and may be used interchangeably with "ein oder mehr." Furthermore, the article "der / die / das," as used herein, is intended to encompass one or more objects referred to in conjunction with the article "der / die / das" and may be used interchangeably with "der / die / das eine oder die mehr." In addition, the term "sentence," as used herein, is intended to encompass one or more articles (e.g., related articles, unrelated articles, or a combination of related and unrelated articles) and may be used interchangeably with "ein oder mehr." When only one object is meant, the expression "nur ein" or a similar formulation is used.The terms "has," "have," "exhibit," and similar expressions used here are also to be understood as open terms. The phrase "based on" means "based at least partially on" unless explicitly stated otherwise. Similarly, the term "or" used here is intended to be comprehensive when used in a series and can be used interchangeably with "and / or" unless explicitly stated otherwise (e.g., when used in combination with "either" or "only one of").

Claims

[1] A method for performing a process mining operation on case data associated with an Internet of Things (IoT) device, comprising: receiving, by a device, an event log containing event data associated with a plurality of events performed by one or more external devices, including the IoT device; analyzing the event log by the device to identify activity data from the event data associated with at least one operation comprising one or more events of the plurality of events; generating, by the device, case data associated with the at least one process and containing the identified activity data; and Performing a process mining operation on the case data by the device. [2] The method of claim 1, wherein the activity data comprises a set event paired with a delete event. [3] The method of claim 1, wherein the activity data comprises a discrete event. [4] The method of claim 1, wherein the case data comprises first activity data including a set event paired with a delete event and second activity data nested within the first activity data. [5] The method of claim 1, wherein the case data further includes a duration based on timestamps associated with the one or more events included in the at least one operation. [6] The method of claim 1, further comprising: identifying, by the device, a portion of the event data associated with the IoT device; and Discarding a remaining portion of the event data by the device before analyzing the event log. [7] The method of claim 1, wherein analyzing the event log comprises: Identifying a standalone event and a unique event separated by a time period that meets an overlap threshold; and Reorder the standalone event and the delete event based on whether the standalone event is a nested event. [8] The method of claim 1, wherein the IoT device comprises a printer or a mobile computer. [9] Accessible, machine-readable medium storing a set of instructions, the set of instructions comprising: one or more instructions that, when executed by one or more processors of a device, cause the device to: Receiving an event log containing event data associated with a plurality of events performed by one or more external devices, including an Internet of Things (IoT) device; Analyzing the event log to identify from the event data activity data associated with at least one operation that includes one or more events from the plurality of events; Generating case data associated with the at least one process and containing the activity data; Performing an operation on the case data, including the activity data; and Displaying a result of the operation on a user interface. [10] The accessible machine-readable medium of claim 9, wherein the at least one activity comprises a set event paired with a delete event. [11] The accessible machine-readable medium of claim 9, wherein the activity data comprises a discrete event. [12] The accessible machine-readable medium of claim 9, wherein the case data comprises first activity data including a set event paired with a delete event, and second activity data nested within the first activity data. [13] The accessible machine-readable medium of claim 9, wherein the case data further includes a duration based on timestamps associated with the one or more events included in the at least one operation. [14] The accessible machine-readable medium of claim 9, wherein the one or more instructions, when executed, further cause the device to: Identifying a portion of the event data associated with the IoT device; and Discarding any remaining event data before analyzing the event log. [15] The accessible machine-readable medium of claim 9, wherein the one or more instructions that cause the device to analyze the event log cause the device to: Identifying a standalone event and a deletion event separated by a time period that meets an overlap threshold; and Reorder the standalone event and the delete event based on whether the standalone event is a nested event. [16] The accessible machine-readable medium of claim 9, wherein the one or more external devices comprise a printer or a mobile computer. [17] Device comprising: one or more memories; and one or more processors coupled to the one or more memories and configured to: receive an event log containing event data associated with a plurality of events performed by one or more external devices, including an Internet of Things (IoT) device; Analyzing the event log to identify from the event data activity data associated with at least one activity that includes one or more events from the plurality of events; Generating case data associated with the at least one activity and including information generated based on the activity data; Performing an operation on the case data, including the activity data; and Displaying a result of the operation on a user interface. [18] The apparatus of claim 17, wherein the activity data comprises a set event paired with a delete event. [19] The apparatus of claim 17, wherein the activity data comprises a discrete event. [20] The apparatus of claim 17, wherein the case comprises first activity data including a set event paired with a delete event and second activity data nested within the first activity data. [21] The accessible machine-readable medium of claim 9, wherein the one or more instructions, when executed, further cause the device to: Displaying descriptive analyses on the user interface based on the case data; and Processing information based on process task data associated with a user of the IoT device. [22] The accessible machine-readable medium of claim 9, wherein the operation is a process mining operation. [23] The apparatus of claim 17, wherein the operation is a process mining operation.

Images