2. 1. From programming to
assembling.
2. From data orientation to
process orientation.
3. From design to redesign
and organic growth.
3. “a software system that manages and executes operational processes involving
people, applications, and/or information sources on the basis of process models.
“ [1].
Process-Aware Information System, PAIS, merupakan sistem perangkat yang
mengelola dan mengeksekusi proses-proses operasional yang melibatkan
orang, aplikasi, dan/atau sumber daya informasi dengan mengacu pada model
proses.
4. Users
...
Anwendungen / Application Server
Instance 4
Instance 3
Instance 2
Instance 1
Instance 6
Instance 5
Instance 11
Instance 10
Instance 9
Instance 8
Instance 7
Instance 14
Instance 13
Instance 12
Process-aware Information System (PAIS)
Process Execution Engine
Msg Queuing
Time MgmtAuthorization
Late Modeling Web Clnt API
Validatíon
Dyn. Change APIModeling API
Admin. API
Exceptions Audit Trail ...
Process Engineer
Process Composer
Create Process Schema
Modify Process Schema
Check Process Schema
…
Process Repository
Process Schemas
Application
Components
5. Early work in ’70s and ’80s use Petri Nets
Poor technology support
Organizations focused on tasks, not processes
Lack of unified modeling
Business Process Reengineering (BPR) in ’90s
Factoring overspecialized tasks into coherent and globally visible
processes
Maturation of tools: modeling & workflow management
Enterprise process architecture in ’00s
Missing standards for BPM
Constrained tools emphasize serial processing
5
Still about people, processes, and systems
8. People vs Software Applications
Unframed person-to-person (P2P)
person-to-application (P2A)
application-to-application (A2A)
Structure and Predictability of Processes
Unframed
Ad hoc framed
Loosely framed
Tightly framed
PAIS Types vs Development Tools
9.
10. validation, i.e., testing whether the process behaves as expected,
verification, i.e., establishing the correctness of a process definition,
performance analysis, i.e., evaluating the ability to meet requirements with
respect to throughput times, service levels, and resource utilization
11. Process Discovery
Conformance Checking
Fitness (Is the observed behavior possible according to the model?)
Appropriateness (Is the model “typical” for the observed behavior?)
also possible to check conformance based on organizational models, predefined
business rules, temporal formulas, Quality of Service (QoS) definitions
Extension
decision mining,
Performance analysis,
user profiling
13. A business process, or business method, is a model
composed by a collection of related, structured activities or
tasks that produce a specific service or product (serve a
particular goal) for a particular customer or customers.
Business Processes are designed to add value for the
customer and should not include unnecessary activities.
The outcome of a well designed business process is
increased efectiveness (value for the customer) and
increased efficiency (less costs for the company).
Business Processes can be modeled through a large
number of methods and techniques. For instance, the
Business Process Modeling Notation is a Business Process
Modeling technique that can be used for drawing business
processes in a workflow.
15. Management processes, the processes that govern the
operation of a system. Typical management processes
include "Corporate Governance“ and "Strategic
Management“
Operational processes, processes that constitute the
core business and create the primary value stream.
Typical operational processes are Purchasing,
Manufacturing, Marketing, and Sales.
Supporting processes, which support the core
processes. Examples include Accounting, Recruitment,
Technical support.
16.
17.
18.
19. non-alignment of business and IS/IT strategy;
poor levels of management commitment;
constraints imposed by legacy systems;
risks associated with business and IS/IT change;
limited scope for team work between business and IS/IT people;
negative employee attitude;
red tape and bureaucracy within functionally oriented organisations;
lack of frameworks for integrating BP&ISR
22. What is BPM
Business Process Management is a generic term, that encompasses the
techniques, structured methods, and means to streamline operations and
increase efficiency.
BPM techniques and methods enable you to identify and modify existing
processes to align them with a desired (improved) future state.
23. Business Process Management (BPM)
Software and strategy for modeling, automating, managing and
optimizing business processes across organizational divisions,
systems and applications.
Systems
Goals
Process
People
Information
Strategy Policies Compliance
28. Instance I1
A
D
B
x x EC
Instance I1
A
D
B
x x EC
Schema S‘:
A
D
B
x xC
Traditional Process
Lifecycle Support
Create
Instances
Process
Execution
Process engineer /
Process administrator
Process participant
Arbeitsliste
Tätigkeit 1
Tätigkeit 2
Tätigkeit 3
Tätigkeit 4
Integrated Process Lifecycle Support
Schema S:
A
D
B
x x EC
Instance I1
A
D
B
x x EC
Execution
Log
Process
Monitoring
Page 28
29. Instance I1
A
D
B
x x EC
Instance I1
A
D
B
x x EC
Schema S‘:
A
D
B
x xC
Traditional Process
Lifecycle Support
Create
Instances
Process
Execution
Process engineer /
Process administrator
Process participant
Arbeitsliste
Tätigkeit 1
Tätigkeit 2
Tätigkeit 3
Tätigkeit 4
Schema S:
A
D
B
x x EC
Instance I1
A
D
B
x x EC
Execution
Log
Process
Monitoring
Need for Exception Handling and
Ad-hoc Changes
Need for Process
Evolution
Some Flexibility Issues Along the Lifecycle
Need for Learning from
Instance Executions
(incl. Ad-hoc Changes)
Source: [WRWR09]
29
Need for Dealing
with Variations
Need for Decision
Deferral
30. Instance I1
A
D
B
x x EC
Instance I1
A
D
B
x x EC
Schema S‘:
A
D
B
x xC
Lifecycle Support in
adaptive PAISs
Create
Instances
Process
Execution
Process engineer /
Process administrator
Process
Monitoring
Change Log
Instance-
specific
Change
Exception:
Delete (I1, E)
Process participant
Arbeitsliste
Tätigkeit 1
Tätigkeit 2
Tätigkeit 3
Tätigkeit 4
Change
Propagation
Integrated Process Lifecycle Support
Schema S:
A
D
B
x x EC
Instance I1
A
D
B
x x EC
Execution
Log
31. Instance I1
A
D
B
x x EC
Instance I1
A
D
B
x x EC
Schema S‘:
A
D
B
x xC
Revised lifecycle for
dynamic processes –
The ProCycle
Approach
Create
Instances
Process
Execution
Process engineer /
Process administrator
Process
Monitoring
Change Log
Instance-
specific
Change
Exception:
Delete (I1, E)
Process participant
Arbeitsliste
Tätigkeit 1
Tätigkeit 2
Tätigkeit 3
Tätigkeit 4
Change
Propagation
Memorization and Change
Reuse
Case
Base
Derive Process Type Change
Integrated Process Lifecycle Support
Schema S:
A
D
B
x x EC
Instance I1
A
D
B
x x EC
Execution
Log
Migrate Case Base
33. Spezifi-
zieren Spezifiziert AngeliefertBestellen
Tür-Steuergerät
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Klima-Steuergerät
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Installieren
τ
τ
DatengetriebeneProzessstruktur
Installieren
Installieren
BestätigungMechanik
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Display
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Auswahl
Lieferant Ausgewählt Aufgebautτ
Labor-
test
Navigation
S E
Aufbau
Mechanik Aufgebaut GetestetTest
Mechanik Testfahrt
E-Klasse
S E
Auswahl
Lieferant Ausgewählt Aufgebautτ Labor-
test
Powertrain
S E
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Getriebe Steuergerät
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Installieren
Installieren
BestätigungMechanik
τ
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Motor-SG Benzin
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Installieren
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Multimedia-Einheit
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
τ
Spezifi-
zieren Spezifiziert AngeliefertBestellen
GPS Sensor
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Installieren
τ
Installieren
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Motor-SG Diesel
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Installieren
Installieren
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Verstärker
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Auswahl
Lieferant Ausgewählt Aufgebautτ Labor-
test
Innenraum
S E
τ
Installieren
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Tür-SG Beifahrer
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Klima-Steuergerät low
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Klima Display
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Getriebe Steuergerät 2
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Motor-SG Benzin 2
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Klima Bedieneinheit 2
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Klima Bedieneinheit 1
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Motor-SG Diesel 2
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Spezifi-
zieren Spezifiziert AngeliefertBestellen
Klima Bedieneinheit 3
S ESicht-
Prüfung
[i.O.]
[Nicht i.O.]
Installieren
Installieren
Installieren
Installieren
Installieren
Installieren
InstallierenInstallieren
Installieren
Installieren
τ
τ
34. WMS orchestrates activities
to compose a process
rather than performs
data management.
Process Mining combines the strengths of both data mining and
process modeling by automatically creating process models based on
existing IT event log data. It yields live models connected to the
business and can be updated easily at any point in time.
35. WMS facilitates system to adapt with
rapid changes of business process.
WMS could decrease the chances
affecting human error by automating
several processes.
(Van der Weken, et al., 2009).
Nonetheless, Human Workflow in BPM
manages some processes
performed manually.
(Liu, et al., 2012).
36. Research (Green & Choi, 1997; Fanning & Cogger,
1998) propose neural network solution to detect fraud.
Data mining techniques are also used to investigate
some potentially fraudulent patterns (Lee, et al., 2001;
Wheeler & Aitken, 2000).
In addition to that, some techniques using machine
learning and genetic algorithm are also implemented
(Williams, et al., 2006; Gottlieb, et al., 2006).
37. A technique to obtain a
knowledge from event log,
where certain organizational
activities are recorded.
38. Process Mining comprises
How to Discover Process Model
How to Check the Conformance
between Actual Process Model and the
event logs
How to Utilize Event Logs for Continuous
Improvement of Process Modelling
Involves multiple perspectives (process,
data, resources, etc.)
42. 42
Organizational mining plug-ins can discover
Roles/Teams in organizations
Social networks for originators
Some metrics of social networks are based on ordering relations (e.g., the
ordering relations used by the Alpha algorithm)
Conformance Checker assesses how much a process model matches process
instances
LTL (Linear Temporal Logics) Checker uses logics to verify properties in event
logs
44. 44
Detection of data dependencies that affect the rounting the routing of
process instances
Which conditions
influence the choice
between a full check
and a policy only one?
45. 45
Make tacit knowledge explicit
Better understand the process model
47. 48
1. Read a log + model
2. Identify the decision points in a model
3. Find out which alternative branch has been taken for a given process
instance and decision point
4. Discover the rules for each decision point
5. Return the enhanced model with the discovered rules
48. 49
1. Read a log + model
2. Identify the decision points in a model
3. Find out which alternative branch has been taken for a given process
instance and decision point
4. Discover the rules for each decision point
5. Return the enhanced model with the discovered rules
How can we spot the
decision points in a
Petri net?
49. 50
1. Read a log + model
2. Identify the decision points in a model
3. Find out which alternative branch has been taken for a given process
instance and decision point
4. Discover the rules for each decision point
5. Return the enhanced model with the discovered rules
51. 52
1. Read a log + model
2. Identify the decision points in a model
3. Find out which alternative branch has been taken for a given process
instance and decision point
4. Discover the rules for each decision point
5. Return the enhanced model with the discovered rules
Which elements are the
classes and which are
the attributes?
57. 62
Motivation
Provide different Key Performance Indicators (KPIs) relating to the execution of
processes
Main idea
Replay the log in a model and detect
Bottlenecks
Throughput times
Execution times
Waiting times
Synchronization times
Path probabilities etc
58. 63
How can we spot the difference
between waiting and execution
times?
64. 69
Extension techniques enhance existing models with information discovered
from event logs
The Decision Point Analysis plug-in can discover the “business rules” for the
moments of choice in a process model
The Performance Analysis with Petri Nets plug-in provides various KPIs w.r.t.
the execution of processes
The results of both techniques can be used to create simulation models for
CPN Tools
65. Zeng, Qingtian, Sherry Sun, Hua Duan, Cong Liu, Huaiqing Wang “Cross-
Organizational Collaborative Workflow Mining from a Multi Source Log”,
Elsevier, vol. 54, Dec. 2012 pp.1280-1301.
B.F .van Dongen, J. Mendling, W .M.P . Van der Aalst “Structural Patterns for
Soundness of Business Process Models”
W.M.P. van der Aalst, K.M. van Hee, A.H.M. ter Hofstede, N. Sidorova ,H.M.W.
Verbeek, M. Voorhoeve and M.T. Wynn “Soundness of Workflow
Nets:Classication, Decidability, andAnalysis”
Wil M.P. van der Aalst “Intra- and Inter-Organizational Process
Mining:Discovering Processes Within and Between Organizations”
Riyanarto Sarno, Bandung Arry Sanjoyo, Imam Mukhlash, hanim Maria
Astuti“Petri Net Model of ERP business Process Variation For Small and
Medium Enterproses”
68. The Indonesian National Police
(POLRI) officially announces
that there have been 71
fraudulent cases since 2003.
Indonesia becomes the second
biggest country in terms of
fraud frequency.
69. In 2012, there were 1,388 frauds across 96 countries causing
1,411,000 USD loss (ACFE, 2012).
70. One of factors causing
fraud is the
opportunity to
deceive or to embezzle
the system [ACFE 2012]. Type of
Fraud
Technologies
ATM &
Internet
Utilization:
counterfeit,
not present,
altered
Handling of
transaction:
lost or stolen,
not received
Transactions
Product: Credit
& Debit, Card,
and Check
Relationship to
accounts first,
second, and
third parties
Business
Process:
Application
Transaction
Embellishment,
theft, &
fabrication
78. DBMS CEP
Queries Ad hoc on stored data Continuous standing queries
Latency Seconds Milliseconds
Data Rate Hundreds per Second Tens of thousands per second
request
response
Event
output
stream
input
stream
80. Sequence Pattern Mining (SPM) is a data mining technique
to find pattern of related sequences.
(Marbroukeh & Ezeife, 2010)
Table of Traces
<a(bc)dc>
is a subsequence of
<a(abc)(ac)d(cf)>
Case ID Activities
10 <a(abc)(ac)d(cf)>
20 <(ad)c(bc)(ae)>
30 <(ef)(ab)(df)cb>
40 <eg(af)cbc>
Rule : <(ab)c>
Both explicit and implicit dependency are
investigated using rules.
81.
82. Creating Input Adapter
on CEP Engine
Applying Online
Heuristic Miner to
discover streaming
events
Implementing SPM for
Conformance Checking
Providing process-aware
workflow events
90. Check whether the
sequence of rules is a
subsequence of the
sequence of process model.
If it is not, then
categorized as a fraud.
And vice versa.
Storing Rules in
Repository
Storing Process in
Repository
Defining Rules
Discovering Process from
Incoming Events
is the Rule
a Subsequence of the Process
Notifying as
a Fraudulent Case
Notifying as
a Legitimated Case
Conformance
Checking
No Yes
91. No List of Traces
1 Create PO–Sign–Release–IR–SF-Pay
2 Create PO–Sign–Release–GR–IR–Pay
3 Create PO–Change Line–Sign–Release–IR–GR-Pay
4 Create PO–Change Line–Sign–Release–IR-Pay
No List of Legitimated Rules
1 <Create PO, Sign, Release, (IR,SF), Pay>
2 <Create PO, Sign, Release, (GR,IR), Pay>
3 <Create PO, Sign, Release, (SF, IR), Pay>
4 <Create PO, Sign, Release, (IR, GR), Pay>
4 Create PO–Change Line–
Sign–Release–IR-Pay
Is each sequence of legitimated rules
a sub sequence of
sequence of trace ??
96. 1. Several legitimated (not-fraud)
patterns are provided in the rule
repository.
2. Randomized events of ERP 2013,
which have role as a dataset, are
streamed through CEP engine.
3. Every Process Model discovered
from the events is compared to
every legitimated pattern.
Data Set
Engine
Rule
Repository
Result
97. Evaluate the proposed method
with several datasets from both
real and simulated events.
The datasets are deliberately
provided in cases of comparing
fraudulent event to legitimated
event.
98.
99. What event attributes are required to store in case of
fraud investigation?
How to capture workflow events immediately by using
Complex Event Processing?
How to mine process of the incoming events in certain
observation time?
How to perform a conformance checking to investigate
internal frauds in Workflow Management System?
100. Streaming events should define a very basic and simple
attributes of the event.
Complex Event Processing could improve the
responsiveness of the system in cases of capturing
emitted events.
Process Mining empowers the system to discover the
actual process model from the incoming events.
Sequential Pattern Mining could be utilized to conform
between the actual model discovered by the incoming
events and that of the rules.
101. To define standard of streaming event attributes as efficient as
possible.
To increase system responsiveness in terms of catching workflow
events by integrating Workflow Management System with CEP
engine.
To combine the power of Process Mining in terms of process
auditing and the power of Complex Event Processing in terms of
real-time processing.
To implement Sequential Pattern Mining as a fraud-investigating
algorithm based on process, which is discovered from the
incoming events.
102. A new analysis to define standard attributes of streaming events for
purposes of providing process-aware WMS.
A special technique to integrate CEP engine and WMS will be
proposed to catch web services, which represent workflow
activities, and convert them into events.
A chain of procedures for discovering the sequences from the
incoming events and storing them in a repository is going to be
introduced.
A modified Sequential Pattern Mining technique would be applied,
as a conformance checking technique, in cases of fraud detection
in Workflow Management System.
103. The inspected cases belong to internal frauds, which are performed by human.
The method focuses on analyzing the sequential pattern rather than
investigating data. There will not be any invalid data on evaluation phase.
Every cases evaluates in this research belongs to internal fraud.
This research emphasizes on utilizing Complex Event Processing to catch
fraudulent events in Workflow Management System, instead of analyzing the
complexity of the investigating algorithm.
This research aims at fraud detection and not at fraud mitigation.
Every Case ID of event log has been labeled before mined.
In cases of evaluation, both real-time and stored events would be investigated.
Every activity, which performed by human, should be recorded in event logs. The
event logs enact as data set to evaluate the proposed method.
104. The practical ways to prevent
is providing SOP and limited
access on the Graphical User
Interface (GUI).
e.g., providing a limited option in a
combo box when choosing an
option, providing SOP to mitigate
fraud, etc.
New
Open…
Save
Save As…
Page Setup…
Print…
Exit
File
text
text
text
text
105. Nevertheless,
There is no one able to validate what
really occurs in the system, since there is
no proof based on actual data.
Therefore, we need to mine knowledge from
actual data (i.e., event log, audit trail, etc.).
Event Log
106. Huge amounts of data
Enterprise IT systems collect more and more data about the business processes they support. These data
usually reflect very closely what happened in “the real world” and can be a great source of insight for
understanding and improving the business.
Process perspective
Unlike data mining, process mining focuses on the process perspective: It includes the temporal aspect and
looks at a single process execution as a sequence of activities that have been performed. Most data mining
techniques extract abstract patterns in the form of, for example, rules or decision trees. In contrast, process
mining creates complete process models, and then uses them to precisely highlight where the bottlenecks are.
Also exceptions are important
In data mining, generalization is very important to avoid what is called “overfitting the data”. This means that
one wants to strip away all the examples that do not match the general rule. In process mining, generalization
is also necessary to deal with complex processes and understand the main process flows. However,
understanding the exceptions is often important to discover inefficiencies and points of improvement.
Focus on discovery
In data mining, models are often trained to make predictions about future similar instances in the same space.
Quite a few data mining and machine learning methods operate as a “black box” that spills out predictions
without the possibility to trace back the “why”.
107. It analyzes the control flow model of actual process.
Event logs are utilized as sources from which actual
model of workflow process is built.
To investigate a fraud, the control flow model is
examined in various perspectives.
It could analyze fraudulent patterns found in
workflow process.
108. Most of the algoritihms
could only be
conducted in
a batch processing,
not in a real-time
processing.
To mine process, a
complete set of event
log is required.
1 day’s
activities
Event log
for 1 day
Process
Mining
Engine
Fraud
Notification
110. It is impossible to store all
of the streaming events.
The events are evolving.
It is not operated in a
batch manner.
A model is discovered from
an incomplete event log.