Discovering signature patterns from event logs

More and more information about processes is recorded in the form of so-called “event logs”. High-tech systems such as X-ray machines and high-end copiers provide their manufacturers and services organizations with detailed event data. Larger organizations record relevant business events for process improvement, auditing, and fraud detection. Traces in such event logs can be classified as desirable or undesirable (e.g., faulty or fraudulent behavior). In this paper, we present a comprehensive framework for discovering signatures that can be used to explain or predict the class of seen or unseen traces. These signatures are characteristic patterns that can be used to discriminate between desirable and undesirable behavior. As shown, these patterns can, for example, be used to predict remotely whether a particular component in an X-ray machine is broken or not. Moreover, the signatures also help to improve systems and organizational processes. Our framework for signature discovery is fully implemented in ProM and supports class labeling, feature extraction and selection, pattern discovery, pattern evaluation and cross-validation, reporting, and visualization. A real-life case study is used to demonstrate the applicability and scalability of the approach.