Information Technology Reference
In-Depth Information
We propose in this section an inverted index handling correlation of message
aggregations (nodes in the ACG) instead of the original messages themselves.
We formalize such an index as a function
AggInvInd
mapping values to couples
of attributes and ACG nodes:
AggInvInd
:
V
−→
P
(
A
,
N
(
ACG
))
such that
∀
v
∈
V
,
∀
n
∈
N
(
ACG
)
,
∀
a
∈
A
,if
∃
m
∈
M
(
n
)and
V
(
a
,
m
)=
v
,then
(
a
,
n
)
⊂
SumInvInd
(
v
).
The proposed algorithm is building the
SCG
and while processing each mes-
sage sequentially, the index
AggInvInd
is incrementally populated and used. For
every message
m
M
, its attribute's values are used to access the inverted index
AggInvInd
, identify nodes correlated to the event and check if an existing node
in the ACG is suitable to be associated with the message.
∈
3.5
Using the ACG for Identifying Process Instances
In this section we discuss how the ACG can be used for identifying process
instances and the proper use of graph filtering.
Starting from the root node, the ACG is read as different branches, each of
them corresponding to a different sequence of correlation conditions revealing a
bunch of similarly correlated process instances. The following example of ACG,
illustrated in figure 3 (left) corresponds to an ACG generated from a log of 4000
messages. Such graph contains all sorts of correlations discovered from the log
and is not easy to read as many of those correlations are non frequent (small
node sizes). When the ACG contains a high number of nodes and edges, we
propose to apply filtering techniques allowing to reduce the number of edges
and nodes and make it clearer to read and easier to interpret.
Assuming that the relevance of a correlation condition depends on the weight
of its associated edges in the ACG, applying graph filtering techniques to the
ACG allows to discover relevant correlation conditions. Graph filtering tech-
niques can consist of removing low weighted edges, and consequently the poten-
tial resulting orphan nodes, those removed edges are non frequent cases. After
applying the filtering, it is then possible to read the filtered ACG and clearly
identify relevant correlations.
The relevance of a correlation conditions depends on the number of process in-
stances actually verifying that correlation condition in the log. Therefore, graph
filtering can play an important role in highlighting potentially relevant corre-
lation conditions from the ACG. An example of filtered ACG compared to an
unfiltered ACG is illustrated in figure 3. The size of a node in the graph corre-
sponds to the number of messages associated to it in the ACG. The thickness of
an edge corresponds to its weight in the ACG.
3.6
Discussion
In some cases, correlator attributes in the log could have the same value for a
large number of messages. This has a major consequence on the resulting ACG
