Prefix Imputation of Orphan Events in Event Stream Processing - Zaman, Rashid; Hassani, Marwan; Van Dongen, Boudewijn F. (Frontiers in Big Data, 2021)
In the context of process mining, event logs consist of process instances called cases. Conformance checking is a process mining task that inspects whether a log file is conformant with an existing process model. This inspection is additionally quantifying the conformance in an explainable manner. Online conformance checking processes streaming event logs by having precise insights on the running cases and timely mitigating non-conformance, if any. State of the art online conformance checking approaches bound the memory by either delimiting storage of the events per case or by limiting the number of cases to a specific window width. The former technique still requires unbounded memory as the number of cases to store is unlimited, while, the latter technique forgets running, not yet concluded, cases to conform to the limited window width. Consequently, the processing system may later encounter events that represent some intermediate activity as per the process model and for which the relevant case has been forgotten, to be referred to as orphan events. The naive approach to cope with an orphan event is to either neglect its relevant case for conformance checking or treat it as an altogether new case. However, this might result in misleading process insights, for instance, overestimated non-conformance. In order to bound memory yet effectively incorporate the orphan events into processing, we propose an imputation of missing-prefix approach for such orphan events. Our approach utilizes the existing process model for imputing the missing prefix. Further, we leverage the case storage management to increase the accuracy of the prefix prediction. We propose a systematic forgetting mechanism that distinguishes and forgets the cases that can be reliably regenerated as prefix upon receipt of its future orphan event. We evaluate the efficacy of our proposed approach through multiple experiments with synthetic and two real event logs, while simulating a streaming setting. Our approach achieves a considerably higher realistic conformance statistics than the state of the art while requiring the same storage.