Dynamic adaptive process discovery and compliance

A method for modeling a process, comprising:

• collecting data pertaining to executed process steps from one or more activity log files;
• parsing the collected data to determine a set of process steps that have been performed;
• identifying process threads indicative of an order of performance of the performed process steps;
• determining an incidence value representing how many times each performed process step follows each of the other performed process steps within each identified process thread of the collected data;
• generating a graph representing a model of the executed process by representing each process step that has been performed as a node of the graph and each transition between process steps within each process thread as an edge on the graph, wherein for any given pair of nodes of the graph, the edge connecting the pair of nodes is assigned a number that depends upon the incidence value corresponding to how many times the process step represented by a first node of the pair is followed by the process step represented by a second node of the pair;
• and
• making the generated graph accessible to a user, wherein each of the above steps is performed using a computer system.,
• wherein the generated graph dated as additional data pertaining to the executed steps are added to the activity log files, wherein updating includes changes to one or more of the nodes, edges or the number assigned to the edges,
• wherein a plurality of snapshots comprising a representation of the updated graph at a particular moment in time is acquired at either predetermined intervals, at user-specified intervals, or upon satisfaction of a triggering criterion,
• wherein a numeric value representative of snapshot appearance is determined for each of the acquired snapshots by employing a transformation function,
• wherein each of the plurality of snapshots are stored within a tree-like data structure according to its numeric value, and
• wherein when there are more than a predetermined number of snapshots stored in a single bucket or bin of the tree-like data structure, an alert is generated.

A method for modeling a process, comprising:

• collecting data pertaining to executed process steps from one or mare activity log files;
• parsing the collected data to determine a set of process steps that have been performed;
• identifying process threads indicative of an order of performance of the performed process steps;
• determining an incidence value representing how many times each performed process step follows each of the other performed process steps within each identified process thread of the collected data;
• generating a graph representing a model of the executed process by representing each process step that has been performed as a node of the graph and each transition between process steps within each process thread as an edge on the graph, wherein for any given pair of nodes of the graph, the edge connecting the pair of nodes is assigned a number that depends upon the incidence value corresponding to how many times the process step represented by a first node of the pair is followed by the process step represented by a second node of the pair;
• and
• making the generated graph accessible to a user, wherein each of the above steps is performed using a computer system,
• wherein the generated graph is updated as additional data pertaining to the executed steps are added to the activity log files, wherein updating includes changes to one or more of the nodes, edges or the number assigned to the edges,
• wherein a plurality of snapshots comprising a representation of the updated graph at a particular moment in time is acquired at either predetermined intervals, at user-specified intervals, or upon satisfaction of a triggering criterion,
• wherein a numeric value representative of snapshot appearance is determined for each of the acquired snapshots by employing a transformation function, and
• wherein when the numeric value of a particular snapshot deviates by an amount in excess of a predetermined threshold from a numeric value representing a snapshot of a known state, an alert is generated.

A method for modeling a business process, comprising:

• collecting data pertaining to executed process steps from one or more activity log files;
• parsing the collected data to determine a set of process steps that have been performed;
• determining an incidence value representing how many times each performed process step follows each of the other performed process steps of the collected data;
• generating a graph representing a model of the executed process by representing each process step that has been performed as a node of the graph and each transition between process steps as an edge on the graph, wherein for any given pair of nodes of the graph, the edge connecting the pair of nodes is assigned a number that depends upon the incidence value corresponding to how many times the process step represented by a first node of the pair is followed by the process step represented by a second node of the pair;
• and
• displaying the generated graph, wherein each of the above steps is performed using a computer system,
• wherein the incidence value is calculated as an estimate of how likely the second node of the pair is to follow from the first node of the pair,
• wherein the generated graph is updated as additional data pertaining to the executed steps are added, wherein updating includes changes to one or more of the nodes, edges or the number assigned to the edges;
• and
• wherein the updated graph is continuously updated by automatically detecting changes to the activity log files and updating the graph using the additional data when the changes to the activity log files are detected.

A computer program product for modeling a business process, the computer program product comprising:

• a tangible computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
• computer readable program code configured to collect data pertaining to executed process steps from one or more activity log files;
• computer readable program code configured to parse the collected data to determine a set of process steps that have been performed;
• computer readable program code configured to determine an incidence value representing how many times each performed process step follows each of the other performed process steps of the collected data;
• computer readable program code configured to generate a graph representing a model of the executed process by representing each process step that has been performed as a node of the graph and each transition between process steps as an edge on the graph, wherein for any given pair of nodes of the graph, the edge connecting the pair of nodes is assigned a number that depends upon the incidence value corresponding to how many times the process step represented by a first node of the pair is followed by the process step represented by a second node of the pair;
• and
• computer readable program code configured to display the generated graph,
• wherein the incidence value is calculated as an estimate of how likely the second node of the pair is to follow from the first node of the pair,
• wherein the generated graph is updated as additional data pertaining to the executed steps are added, wherein updating includes changes to one or more of the nodes, edges or the number assigned to the edges;
• and
• wherein the updated graph is continuous updated by automatically detecting changes to the activity log files and updating the graph using the additional data when the changes to the activity log files are detected.