A Behavior Change Mining Method Based on Complete Logs with Hidden Transitions and Their Applications in Disaster Chain Risk Analysis

Abstract

The aim of change mining is to discover changes in process models based on execution data recorded in event logs. There may be hidden transitions in the process models related to, for example, business integration and user requirements that do not exist in event logs. Behavioral change mining in the case of hidden transitions is a fundamental problem in the field of change mining. Existing research on change mining has not considered the effects of hidden transitions. This paper proposes a novel method based on complete logs with hidden transitions for mining behavioral changes. We analyze the behavioral relations of activities based on changed logs under the condition that the original model is unknown. Log-driven change mining is realized by calculating the log behavioral profile, minimum successor relation, and log-weighted coefficient, which allows the mining of hidden transitions, as well as changed behavioral relations. Finally, this method is applied to disaster chain risk analysis, and the evolution of disaster chains in different scenarios is mined from disaster logs to determine the type of disaster chain. The results of this paper provide a scientific basis for the strategy of chain-cutting disaster mitigation in the emergency management of disaster chains.

1. Introduction

With the continuous innovation and development of theory and workflow technology in business process management, an increasing number of large enterprises and management organizations are using process models to formalize internal business processes. However, business process models are constantly changing with the successful development of enterprise management and changes in regulations, policies, user requirements, and software maintenance [1]. These changing factors affect the behavior and structure of the models. Therefore, correctly identifying and mining process model changes is important for fault detection and diagnosis and the maintenance of business systems [2].

1.1. Problem Statement and Research Questions

Previous studies on changes in business process models have mainly focused on the change region, change propagation, change logs, and anomaly detection. In recent years, many scholars have focused on detecting the differences between different models in the change region and the change propagation analysis of process models [3,4,5]. Meanwhile, in the case that the process model is out of sync and inconsistent, the change queue has been used to propagate changes and achieve synchronous continuity. The model change analysis technology proposed in this paper is beneficial for the detection of the abnormal behavior of process models in actual operation. Previously, a submodel of the labelled business process model was constructed on the basis of analyzing the behavioral characteristics of Petri nets, and the concept of the action mode was proposed to determine the minimum change region [3].

Once the model changes, model management technology becomes indispensable. A synchronization method based on model elements [4] has been used for change management between process models at different levels of abstraction. A method of change propagation [5] that detects existing changes between different models has been proposed to determine the change region and solve the inconsistency of a model in layered refinement. Fang et al. proposed a dynamic analysis method based on Petri net modules to search for the change region [6] and introduced the T invariant to optimize the method and thus obtain the change region most accurately. Their method also improved the accuracy and excellence of the model change detection. A change propagation technology based on software maintenance [7] has been proposed to provide a powerful tool in solving the change propagation of process models in software maintenance and evolution. In addition to the research on the change region and change propagation, several scholars have analyzed change fragments in process models in recent years [8,9,10]. Cross-organization collaboration becomes more complex as business requirements become more complex. The concept of configurable process fragments has been proposed to solve the changes in the complexity of similar process models [8]. Here, event logs are used as input to construct a configurable process model that contains change fragments. A method is presented which is based on the improved process structure tree and software product line [9] to automatically identify reusable variable fragments and merge similar fragments into main fragments. This method mainly starts from the change fragments and restructures the design of the model. Process fragments have been defined [10], and an improved fragment called the morphological fragment has been proposed for detecting process model changes and reusing process combinations. In the case that the original reference model is unknown [11], the morphological fragment provides a new cornerstone for research on business process change mining whereby business process changes can be discovered from the joint occurrence relations of incomplete event logs. BINet, a neural network architecture for real-time multi-perspective anomaly detection in business process event logs, has been introduced [12]. Additionally, a set of heuristics has been proposed for automatically setting the threshold of an anomaly-detection algorithm automatically. A novel approach to detecting event log anomalies in process event streams has been described [12]. This approach focuses on a general framework into which different anomaly-detection methods can be plugged. As early as 2018, Fang et al. investigated log mining model changes [13], but they compared system logs with the actual models to obtain possible change patterns.

In recent years, an increasing number of scholars have researched business process anomaly detection [12,14], workaround detection methods [15], and business process monitoring techniques [16]. Nolle et al. proposed a method [14] that uses autoencoders to detect and analyze anomalies. This method has been further refined in terms of performance and evaluated on more sophisticated datasets. Anomaly detection also focuses on detecting temporal workarounds in business processes. Weinzierl et al. proposed a deep-learning-based method [15] that helps to detect different workaround types in event logs. The method is accurate and functions most effectively in business processes, having fewer variations and a higher number of different activities. A technique for explainable predictive process monitoring was proposed in [16], where relevance values for process activities are extracted from a graph neural network. This method is the first to use gated graph neural networks (GGNNs) to make decisions more explainable. In short, anomaly detection research mainly focuses on business process detection and workaround detection. Change mining is a branch in data mining [17] that focus on researching the behavioral changes caused by changed logs. These are widespread research branches in business process management. By identifying outliers, researchers can gain important knowledge and make better data decisions.

A Petri net is also widely used in practical application scenarios of risk assessment and disaster chain analysis since this method dynamically simulates the evolution of disaster chains as a discrete modeling tool. Examples of its application can be seen for earthquakes [18], coal mining [19], floods [20], and oil spills [21]. A colored Petri net demonstrates the recovery process by simulating the behavior of a disaster and capturing the differences in resource allocation following an earthquake disaster [18]. At the same time, Petri net technology addresses delays in decision making, responses to conflicts, and limited resources during emergencies [19]. The construction of an evolutionary analysis model of a flood disaster chain [20] not only allows an analysis of disaster elements but also helps to quickly and effectively curb the spread of a disaster. These benefits are similar to those of an oil spill disaster chain model [21], with both models providing a scientific basis for a chain break mitigation strategy of disaster chain emergency management through a dynamic derivation of the evolutionary process of the disaster and an analysis of the maximum risk path.

However, previous studies on disaster chain risk analysis require a known Petri net model. In contrast, the actual reference model is unknown or contains hidden transitions in most business processes. The hidden transition is also called the invisible transition, and it mainly plays the role of routing. Research on the mining of business process changes is based on models [3,4,5,6,7,8,9,10] or logs [11,12,13,22] and fails to consider the effects of hidden transitions on model changes. In this paper, we propose a behavioral-change-mining method considering hidden transitions to improve existing methods under the condition of complete logs. We demonstrate the superior performance of our proposed method in experiments.

1.2. Contributions and Research Method

The innovations of the present study are summarized as follows.

• The concepts of the log minimum successor relation and log-weighted coefficient are proposed to quantify the occurrence dependencies of pairs of activities in logs.
• The behavioral relations of pairs of activities are quantitatively analyzed by calculating the log behavioral profiles and the log minimum successor relations. Additionally, the behavioral relations of pairs of activities are further refined.
• A change-mining method based on hidden transitions is proposed to mine different kinds of hidden transitions and solve the problem of searching for behavioral relation changes with hidden transitions in event logs.

The remainder of the paper is arranged as follows. Section 2 introduces a motivating example. Section 3 presents related knowledge on the event log, log behavioral profile, and log minimum successor relation. Section 4 constructs change-mining methods based on complete logs and presents examples. Section 5 presents an experiment to verify the correctness of the method. Section 6 describes a specific disaster case to validate the practicability of the proposed method. Section 7 concludes the paper with suggestions for future work.

2. Motivating Example

A hidden transition is also called an invisible transition. Since hidden transitions do not appear in any event trace, it is a challenging problem to discover behavioral changes that contain hidden transitions in the field of change mining. A complete log is a log that contains all transition activities and possible behavioral relations among all activities. In what follows, we illustrate the necessity of the change-mining method proposed in this paper by giving a detailed example.

Firstly, it is necessary to understand the history logs and actual logs of the system. To simplify notation, the history logs are denoted $L_{his}$, the actual logs are denoted $L_{act}$, a mapped letter set for logs is denoted $Y_L$, and the log behavioral profiles are denoted $B{P}_L$. For complete event logs $L_{his}=\left\{<ABD>,<ACD>\right\}$ and $L_{act}=\left\{<ABCD>,<ACBD>\right\}$, it is clear that $Y_{L_{his}}$ is equal to $Y_{L_{act}}$. If the mapping letters of the history logs and actual logs are equal, we need to further calculate the log behavioral profiles of $B{P}_{L_{his}}$ and $B{P}_{L_{act}}$. Behavioral profile relations are shown in

Table 1. Behavioral profile relations ($B{P}_{L_{his}}$).

	A	B	C	D
A		$\to$	$\to$	$\to$
B			$\to$	$\to$
C				$\to$
D

and

Table 2. Behavioral profile relations ($B{P}_{L_{act}}$).

	A	B	C	D
A		$\to$	$\to$	$\to$
B				$\to$
C				$\to$
D

.

A comparison of the behavioral relations in Table 1 and Table 2 show that $B{P}_{L_{his}}\ne B{P}_{L_{act}}$. The changed behavioral relations are marked with dotted boxes. The log behavioral profiles have changed when the model does not perform a “Delete”, “Move”, or “Insert” change operation. It is assumed that the occurrence of hidden transitions affects the actual log behavioral relations. Therefore, it is necessary to investigate the behavioral changes of the model with hidden transitions using complete event logs.

3. Preliminaries of Models and Methods

We use event logs as our formal grounding. A class of Petri nets and a Petri net system is used for process modeling and analysis. This paper refers to basic definitions [23] of Petri nets, Petri net systems, and behavioral profiles. This section recalls some related concepts, whereas others are omitted for brevity.

Definition 1. 

(Event Log [24]) Let $T$ be the set of activities, where $\sigma \in T^{\ast }$ is an event trace. Let $L\in B\left(T^{\ast }\right)$ be an event log, where $B\left(T^{\ast }\right)$ is the set of event traces.

Definition 2. 

(Log Behavioral Profile ($BP$) [25]) Let $L_p=n_1,\cdots n_m$ be a log of a process model $P=\left(A,a_i,a_o,C,F,T\right)$. A pair $\left(x,y\right)\in \left(A_L\times A_L\right)$ has at most one of the following relations:

(1) 

The strict order relation ${\to }_L$, if $x{\succ }_{L}y,y{\cancel{\succ }}_{L}x$;

(2) 

The interleaving order relation $|{|}_L$, if $x{\succ }_{L}y,y{\succ }_{L}x$.

The set of relations is written as $B{P}_L=\left\{{\to }_L,{\parallel }_L\right\}$.

Definition 3. 

(Log Minimum Successor Relation ($MSR$) [26]) Let $\sigma \in L$ be a log trace and let $x\in \sigma ,y\in \sigma$ be the transitions, and $k\in N$. The log minimum successor relation is defined by: $x{\succ }_k^{\sigma }y\iff \exists 1\le i\le {\left|\sigma \right|}_{}\left[\sigma \left(i\right)=x\wedge \sigma \left(i+k\right)=y\right]$, and the log minimum successor relation is abbreviated as $MSR$. Therefore, $MS{R}_{\left(x,y\right)}=k$ in log $L$.

In Definition 3, if transitions $x$ and $y$ are contained in the trace $\sigma$, such as $\sigma =<x{x}_1{x}_2{x}_{3}y>$, it can be obtained that $\sigma \left(1\right)=x\wedge \sigma \left(1+4\right)=y$. The log minimum successor relation of $\left(x,y\right)$ is denoted as $MS{R}_{\left(x,y\right)}=4$.

4. Change-Mining Methods for Models with Hidden Transitions Based on Complete Logs

Before introducing the behavioral change-mining method in detail, we first provide the classification rules and the types of hidden transition.

4.1. Classification Rules of Hidden Transitions

Let $N=\left(P,T,F\right)$ be a labelled Petri net, where ${\tau }_i,i\in \left\{1,2,\cdots n\right\}$ denotes the hidden transition, $A\cup {\tau }_i$ denotes the set of all activities, and it holds that $t_i\in A$.

Rule 1. 

If both ${}^{•}\tau {}_1=t_1{}^{•}=1$ and ${\tau }_1{}^{•}={}^{•}t{}_2=1$ are satisfied, then ${\tau }_1$ is defined as a strict hidden transition. Figure 1 gives a demonstration for Rule 1.

Rule 2. 

If both ${}^{•}\tau {}_2=1$ and ${\tau }_2{}^{•}>1$ hold, then ${\tau }_2$ is defined as an and-split hidden transition. If both ${}^{•}\tau {}_3>1$ and ${\tau }_3{}^{•}=1$ hold, then ${\tau }_3$ is defined as an and-join hidden transition. Figure 2 gives a demonstration for Rule 2.

Rule 3. 

If ${}^{•}\tau {}_4\cap t_3{}^{•}\ne \varnothing$, ${}^{•}\tau {}_4\cap {}^{•}t{}_4=1$ and ${\tau }_4{}^{•}\cap t_4{}^{•}=1$ are all satisfied, then ${\tau }_4$ is defined as a skip hidden transition. Figure 3 gives a demonstration for Rule 3.

Rule 4. 

If both $t_5{}^{•}\cap {\tau }_5{}^{•}\ne \varnothing$ and ${}^{•}\tau {}_5\cap {}^{•}t{}_8\ne \varnothing$ are satisfied, then ${\tau }_5$ is defined as a loop hidden transition. Figure 4 gives a demonstration for Rule 4.

Rule 5. 

If both $t_{11}+t_{14}$ and$t_{11}{}^{•}={}^{•}\tau {}_6$, ${\tau }_6{}^{•}={}^{•}t{}_{14}$ are satisfied, then ${\tau }_6$ is defined as a switch hidden transition. Figure 5 gives a demonstration for Rule 5.

4.2. Constructing Change-Mining Methods

This section mainly investigates the behavioral changes of models with hidden transitions under complete event logs. Previous research in the field of change mining has mainly focused on changes in model behavior [6,7,8,9] when the original system models are known. Additionally, few studies have concentrated on mining model changes based on incomplete event logs [11]. On the one hand, previous studies did not consider the effects of hidden transitions on model changes. On the other hand, hidden transitions are difficult to mine because they do not appear in any event trace. In the following, the related concepts of the log-weighted coefficient and the behavior-relation-change-mining algorithm are proposed.

Definition 4. 

(Log-Weighted Coefficient) Let $L$ be an event log and let $t_i\in L\left(i=1,2,3\dots \right)$ be a transition. A coefficient is assigned to the arcs (drawn as directed edges) connecting transitions with others. This coefficient is called the log-weighted coefficient and denoted $r$.

Example 1. 

(Interpretation of the log-weighted coefficient) We first provide a workflow log $L= <{\sigma }_1,{\sigma }_2,{\sigma }_3,{\sigma }_4>$, which contains ${\sigma }_1=<ABHI>$, ${\sigma }_2=<ADGECI>$, ${\sigma }_3=<ADEGCI>$, and ${\sigma }_4={}_{}<AGDECI>$. Transition activities (drawn as rectangles) are taken as the start and end points of each arc, and each arc is labelled with a coefficient (as shown in Figure 6), the log-weighted coefficient. It can be seen that $\left(G,D\right)$ and $\left(G,E\right)$ have the relations $G{\succ }_{L}D,D{\succ }_{L}G$ and $G{\succ }_{L}E,E{\succ }_{L}G$ according to ${\sigma }_2,{\sigma }_3,{\sigma }_4$. These relations are written as $G\parallel D$ and $G\parallel E$, respectively. Therefore, there are behavioral relations $G\underset{a}{\stackrel{a}{\rightleftarrows }}D$$G\underset{b}{\stackrel{b}{\rightleftarrows }}E$ (where $a,b$ are the weighted coefficients of arc $G,D$ and $G,E$ respectively). It is clear that $a=a$ and $b=b$ hold, and the relations of $\left(G,D\right)$ and $\left(G,E\right)$ are called a strict order relation and inverse strict order relation such that the values $\stackrel{a}{\to }$ and $\stackrel{a}{\leftarrow }$ offset each other. The following does not consider a pair of transitions with an interleaving order a behavioral relation.

Figure 6 gives a demonstration of Definition 4. The arcs of $A\to B\to H\to I$ are generated by the trace ${\sigma }_1$, and each arc is labelled with a weighted coefficient of 1/3. Specifically, there are three arcs connected to transition A, namely arc AB, arc AD, and arc AG, whose coefficients are $r_{AB}=\frac{1}{3}$, $r_{AD}=\frac{1}{3}$, and $r_{AG}=\frac{1}{3}$.

Definition 5. 

(Rules for Determining the Log-Weighted Coefficient) For a complete event log $L$, if the weighted coefficients are given for each arc, the weighted coefficients of the event logs are uniquely determined. The log-weighted coefficients need to be determined according to the two following rules.

Rule 6. 

The coefficients of the output arcs are equal.

In a complete event log, the log-weighted coefficients of the strict order structures generated by single transition nodes are equal. Generally, the value of the output arc coefficient of the transition is 1. If the transition has n output arcs, then the coefficients of these output arcs are $r_1=r_2=r_3=\cdots =r_n=\frac{1}{n}$.

Rule 7. 

The sum of the coefficients of the arcs is conserved.

For any initial transition, the weighted coefficients of the output arcs are equal to the weighted coefficients of the input arcs of the final transition. Suppose there are n output arcs with coefficients $r_1{r}_2\cdots r_n$ and m input arcs with coefficients $b_1{b}_2\cdots b_m$ that satisfy ${\displaystyle \sum _{i=1}^n{a}_i={\displaystyle \sum _{j=1}^m{b}_j}}$.

In the following, Algorithm 1 details the procedures of hidden transition change mining. The purpose of Algorithm 1 is to mine different types of hidden transitions and changed behavioral relations. To make it more readable, Algorithm 1 is divided into five phases. Taking the second phase as an example, we need to first determine whether the log $L_{his}$ and $L_{act}$ are equal. If $L_{his}$ is not equal to $L_{act}$, $BP$, $MSR$, and $r$ of the logs must be calculated (Definitions 2–4). If there is a pair of transition activity ($a_i,b_j$) satisfying $B{P}_{L_{his}}\left(a_i,b_j\right)=\varnothing$ and $B{P}_{L_{act}}\left(a_i,b_j\right)=\left\{{\parallel }_{L_{act}}\right\}$ under the condition of $MS{R}_L{}_{{}_{act}}\ne MS{R}_L{}_{{}_{his}}$, $r_L{}_{{}_{act}}\ne r_L{}_{{}_{his}}$, this leads to the conclusion that the hidden transition is and-split and the changed behavioral relation is $R_{ch}=B{P}_{L_{act}}-B{P}_{L_{his}}=B{P}_{L_{act}}\left(a_i,b_j\right)=\left\{{\parallel }_{L_{act}}\right\}$.

Algorithm 1 Behavior-Relation-Change-Mining Algorithm Considering Hidden Transitions (BRCM algorithm)

Input: $\mathrm{Original} \mathrm{complete} \mathrm{event} \log L_{his}$$, \mathrm{actual} \mathrm{complete} \mathrm{event} \log L_{act}$ Output: $\mathrm{Changed} \mathrm{behavioral} \mathrm{relations} R_{ch}$ $\mathrm{First}, \mathrm{calculate} \mathrm{the} \log \mathrm{behavioral} \mathrm{profiles}, \mathrm{denoted} B{P}_L{}_{{}_{his}}$$\mathrm{and} B{P}_L{}_{{}_{act}}$$, \mathrm{the} \mathrm{minimum} \mathrm{successor} \mathrm{relations}, \mathrm{denoted} MS{R}_L{}_{{}_{his}}$$\mathrm{and} MS{R}_L{}_{{}_{act}}$$, \mathrm{and} \mathrm{the} \log -\mathrm{weighted} \mathrm{coefficients}, \mathrm{denoted} r_L{}_{{}_{his}}$$\mathrm{and} r_L{}_{{}_{act}}$.

Mining strict hidden transitions: $1: \mathrm{Judge} \mathrm{the} \mathrm{equivalence} \mathrm{of} L_{his}$$\mathrm{and} L_{act}$. $2: \mathit{If} L_{act}=L_{his}\wedge {\sigma }_i\in L_{act}\wedge {\sigma }_j\in L_{his}\left(i=j=1\right)$ hold, $3: \mathit{then} \mathrm{it} \mathrm{can} \mathrm{be} \mathrm{deduced} B{P}_L{}_{{}_{act}}=B{P}_L{}_{{}_{his}}\wedge MS{R}_L{}_{{}_{act}}=MS{R}_L{}_{{}_{his}}\wedge r_L{}_{{}_{act}}=r_L{}_{{}_{his}}$ hold, $4: \mathit{return} R_{ch}=\varnothing$$,{\sigma }_1={\sigma }_2$, and the hidden transition is a strict transition.

Mining and-split hidden transitions: $5: \mathrm{Suppose} \mathrm{that} \mathrm{a} \mathrm{set} \mathrm{of} \mathrm{transitions} \mathrm{are} \mathrm{mapped} \mathrm{to} Y_{L_{his}}$$\mathrm{and} Y_{L_{act}}$. $6: \mathit{If} Y_{L_{his}}=Y_{L_{act}}\wedge L_{act}\ne L_{his}\wedge L_{act}\not\subset L_{his}\wedge L_{his}\not\subset L_{act}\wedge MS{R}_L{}_{{}_{act}}\ne MS{R}_L{}_{{}_{his}}\wedge r_L{}_{{}_{act}}\ne r_L{}_{{}_{his}}$ hold, $7: \mathit{else}\mathit{if} \exists a_i,b_j\in Y_{L_{his}},i,j\in N$$, \mathrm{because} \mathrm{of} Y_{L_{his}}=Y_{L_{act}}$$. \mathrm{Similarly}, \exists a_i,b_j\in Y_{L_{act}},i,j\in N$$. \mathrm{This} \mathrm{will} \mathrm{not} \mathrm{be} \mathrm{described} \mathrm{subsequently}. \mathrm{Additionally}, B{P}_{L_{his}}\left(a_i,b_j\right)=\varnothing$$\mathrm{and} B{P}_{L_{act}}\left(a_i,b_j\right)=\left\{{\parallel }_{L_{act}}\right\}$. $8: \mathit{Return} R_{ch}=B{P}_{L_{act}}-B{P}_{L_{his}}$$. \mathrm{The} \mathrm{hidden} \mathrm{transition} \mathrm{is} \mathrm{an} \mathrm{and}-\mathrm{split} \mathrm{transition}. \mathrm{Using} \mathrm{the} \mathrm{same} \mathrm{method}, \mathrm{we} \mathrm{deduce} \mathrm{the} \mathrm{and}-\mathrm{join} \mathrm{hidden} \mathrm{transition} \mathrm{and} \mathrm{the} \mathrm{changed} \mathrm{behavioral} \mathrm{relations} R_{ch}$.

Mining skip hidden transitions: $9: \mathit{If}{Y}_{L_{his}}=Y_{L_{act}}\wedge L_{act}\ne L_{his}\wedge MS{R}_L{}_{{}_{act}}\ne MS{R}_L{}_{{}_{his}}\wedge r_L{}_{{}_{act}}\ne r_L{}_{{}_{his}}$ hold, $10: \mathit{else}\mathit{if}{L}_{act}\cap L_{his}=L_{his}\ne L_{act}$, $11: \mathit{return} B{P}_{L_{his}}\subseteq B{P}_{L_{act}}$. $12: \mathit{If} \exists a_i,b_j\in Y_{L_{his}},i,j\in N$$, B{P}_{L_{his}}\left(a_i,b_j\right)=\left\{{\to }_{L_{his}}\right\}=B{P}_{L_{act}}\left(a_i,b_j\right)$$, MS{R}_L{}_{{}_{his}}\left(a_i,b_j\right)=n$$, \mathrm{and}MS{R}_L{}_{{}_{act}}\left(a_i,b_j\right)<n$ hold, $13: \mathit{else}\mathit{if}\exists c_i,d_j,e_m\in Y_{L_{his}},i,j,m\in N$$. \mathrm{According} \mathrm{to} \mathrm{the} \mathrm{original} \mathrm{event} \log , \mathrm{the} \mathrm{value} \mathrm{of} \mathrm{the} \mathrm{weighted} \mathrm{coefficient} \mathrm{is} r_{L_{his}}\left(c_i,d_j\right)=1$$. \mathrm{However}, \mathrm{the} \mathrm{value} \mathrm{of} \mathrm{the} \mathrm{weighted} \mathrm{coefficient} \mathrm{is} r_{L_{act}}\left(c_i,d_j\right)=r_{L_{act}}\left(c_i,e_m\right)=\frac{1}{2}$ in the actual log. $14: \mathit{Return} R_{ch}=B{P}_{L_{act}}-B{P}_{L_{his}}$. The hidden transition is a skip transition.

Mining loop hidden transitions: $15: \mathit{If} Y_{L_{his}}=Y_{L_{act}}\wedge L_{act}\ne L_{his}\wedge MS{R}_L{}_{{}_{act}}\ne MS{R}_L{}_{{}_{his}}\wedge r_L{}_{{}_{act}}\ne r_L{}_{{}_{his}}$ hold, $16: \mathit{else}\mathit{if}\exists a_i or b_j\in Y_{L_{his}},i,j,m\in N$$. B{P}_{L_{his}}\left(a_i,a_i\right)=B{P}_{L_{his}}\left(b_j,b_j\right)=\varnothing$$, B{P}_{L_{act}}\left(a_i,a_i\right)\ne \varnothing ,B{P}_{L_{act}}\left(b_j,b_j\right)\ne \varnothing$, $MS{R}_{L_{his}}\left(a_i,a_i\right)=MS{R}_{L_{his}}\left(b_j,b_j\right)=\varnothing$$,MS{R}_{L_{act}}\left(a_i,a_i\right)\ne \varnothing$$, \mathrm{and} MS{R}_{L_{act}}\left(b_j,b_j\right)\ne \varnothing$ hold. $17: \mathrm{There} \mathrm{exist} a_i,b_j\in Y_{L_{his}},i,j\in N$$\mathrm{satisfying} \mathrm{one} \mathrm{of} \mathrm{the} \mathrm{following} \mathrm{behavioral} \mathrm{relations}: \left(1\right)B{P}_{L_{his}}\left(a_i,a_i\right)=\varnothing$$, B{P}_{L_{act}}\left(a_i,a_i\right)=\{\to \}$$; \left(2\right)a_i{\succ }_{L_{his}}{b}_j,b_j{\cancel{\succ }}_{L_{his}}{a}_i$$,a_i{\succ }_{L_{act}}{b}_j,b_j{\succ }_{L_{act}}{a}_i$$; \left(3\right) a_i{\cancel{\succ }}_{L_{his}}{a}_i,b_j{\cancel{\succ }}_{L_{his}}{b}_j$$, a_i{\succ }_{L_{act}}{a}_i,b_j{\succ }_{L_{act}}{b}_j$. $18: \mathit{Return}{R}_{ch}=B{P}_{L_{act}}-B{P}_{L_{his}}$, and the hidden transition is a loop transition.

Mining switch hidden transitions: $19: \mathit{If} Y_{L_{his}}=Y_{L_{act}}\wedge L_{act}\ne L_{his}\wedge L_{act}\cap L_{his}\ne \varnothing \wedge MS{R}_L{}_{{}_{act}}\ne MS{R}_L{}_{{}_{his}}\wedge r_L{}_{{}_{act}}\ne r_L{}_{{}_{his}}$ hold, $20: \mathit{else}\mathit{if}\mathrm{there} \mathrm{exists} \left(a_i,b_j\right)\in Y_{L_{his}},i,j\in N$$\mathrm{satisfying} B{P}_{L_{his}}\left(a_i,b_j\right)=\varnothing$, $21: \mathit{return}MS{R}_{L_{his}}\left(a_i,b_j\right)=\varnothing$$\mathrm{and} r_{L_{his}}\left(a_i,b_j\right)=\varnothing$. $22: \mathit{else}\mathit{if} B{P}_{L_{act}}\left(a_i,b_j\right)=\left\{{\to }_{L_{act}}\right\}\ne \varnothing \wedge MS{R}_{L_{act}}\left(a_i,b_j\right)=1\wedge r_{L_{act}}\left(a_i,b_j\right)>0$, $23: \mathit{return}{R}_{ch}=B{P}_{L_{act}}-B{P}_{L_{his}}$. The hidden transition is a switch transition.

4.3. Examples

We choose the specific event logs with hidden transitions for analysis in this section. Five groups of complete logs are selected for investigation, and each group of logs contains at least one execution trace.

Table 3. Original event logs and actual logs in group 1.

Symbol	Trace
${\sigma }_1$	$L_{his}=<<ABC>>$
${\sigma }_2$	$L_{act}=<<ABC>>$

provides the relevant information on the trace for the first group of event logs.

Table 3 shows that the original event log is $L_{his}=\{<ABC>\}$ and the actual log is $L_{act}=\{<ABC>\}$, where $L_{his}=L_{act}$, $MS{R}_L{}_{{}_{act}}=MS{R}_L{}_{{}_{his}}$ and $r_L{}_{{}_{act}}=r_L{}_{{}_{his}}$ hold. In terms of Algorithm 1, we conclude that the actual log $L_{act}$ contains a strict hidden transition and the changed behavioral relation is $R_{ch}=\varnothing$.

Table 4. Original event logs and actual logs in group 2.

Symbol	Trace
${\sigma }_3$	$L_{his}=<<ABCF>>$
${\sigma }_4$	$L_{his}=<<ADEF>>$
${\sigma }_5$	$L_{act}=<<ABDCEF>>$
${\sigma }_6$	$L_{act}=<<ABDECF>>$
${\sigma }_7$	$L_{act}=<<ADBCEF>>$
${\sigma }_8$	$L_{act}=<<ADBECF>>$

gives the relevant information of the trace for the second group of event logs.

Table 4 shows the original event log $L_{his}=\left\{<ABCF>,<ADEF>\right\}$ and the actual event log $L_{act}=\left\{<ABDCEF>,<ABDECF>,<ADBCEF>,<ADBECF>\right\}$. We calculate log behavioral profiles $B{P}_{L_{his}}$ and $B{P}_{L_{act}}$ according to Definition 2. The log minimum successor relations calculated using Definition 3 are given in

Table 5. Behavioral profiles ($B{P}_{L_{his}}$) and log minimum successor relations ($MS{R}_{L_{his}}$)_{(group 2)}.

	$A$	$B$	$C$	$D$	$E$	$F$
$A$		$\to$(1)	$\to$(2)	$\to$(1)	$\to$(2)	$\to$(3)
$B$			$\to$(1)			$\to$(2)
$C$						$\to$(1)
$D$					$\to$(1)	$\to$(2)
$E$						$\to$(1)
$F$

and

Table 6. Behavioral profiles ($B{P}_{L_{act}}$) and log minimum successor relations ($MS{R}_{L_{act}}$)_{(group 2)}.

	$A$	$B$	$C$	$D$	E	$F$
$A$		$\to$(1)	$\to$(3)	$\to$(1)	$\to$(3)	$\to$(5)
$B$			$\to$(1)	||(1)	$\to$(1)	$\to$(4)
$C$					||(1)	$\to$(3)
$D$		||(1)	$\to$(1)		$\to$(1)	$\to$(2)
$E$			||(1)			$\to$(1)
$F$

.

Table 6 shows the minimum successor relations of transition activities. For example, the behavioral relation between transition activities $A$ and $B$ is a strict order relation, and the value of minimum successor relation is 1, marked as $\to$(1). Figure 7 and Figure 8 present two case descriptions of log-weighted coefficients for $L_{his}$ and $L_{act}$ according to Definition 4.

A comparison of Table 5 and Table 6 clearly shows that there are two pairs of transition activities $\left(B,D\right)$ and $\left(C,E\right)$, satisfying $B{P}_L{}_{{}_{his}}\left(B,D\right)=\varnothing$, $B{P}_L{}_{{}_{act}}\left(B,D\right)=\{\parallel \}$, $B{P}_L{}_{{}_{his}}\left(C,E\right)=\varnothing$, and $B{P}_L{}_{{}_{act}}\left(C,E\right)=\{\parallel \}$. $MS{R}_L{}_{{}_{act}}\ne MS{R}_L{}_{{}_{his}}$ and $r_L{}_{{}_{act}}\ne r_L{}_{{}_{his}}$ are under the condition that $Y_{L_{his}}=Y_{L_{act}}$, where the actual log $L_{act}$ contains an and-split hidden transition and the changed behavioral relations are $R_{ch}=B{P}_{L_{act}}-B{P}_{L_{his}}=B{P}_{(B,D)}\left({\parallel }_{L_{act}}\right)+B{P}_{(B,E)}\left({\to }_{L_{act}}\right)+B{P}_{(C,E)}\left({\parallel }_{L_{act}}\right)+B{P}_{(D,C)}\left({\to }_{L_{act}}\right)$.

Table 7. Original event logs and actual logs in group 3.

Symbol	Trace
${\sigma }_9$	$L_{his}=<<ABC>>$
${\sigma }_{10}$	$L_{act}=<<ABC>>$
${\sigma }_{11}$	$L_{act}=<<AC>>$

shows the relevant information of the trace for the third group of event logs.

Table 8. Behavioral profiles ($B{P}_{L_{his}}$) and log minimum successor relations ($MS{R}_{L_{his}}$)_{(group 3)}.

	A	B	C
$A$		$\to$(1)	$\to$(2)
$B$			$\to$(1)
$C$

and

Table 9. Behavioral profiles ($B{P}_{L_{act}}$) and log minimum successor relations ($MS{R}_{L_{act}}$)_{(group 3)}.

	A	B	C
$A$		$\to$(1)	$\to$(1)
$B$			$\to$(1)
$C$

show the log behavioral profiles and log minimum successor relations calculated using Definitions 2 and 3, respectively.

We see that the original logs and actual logs satisfy $L_{act}\cap L_{his}=L_{his}$. According to Definition 5, the log-weighted coefficients are calculated as $r_{L_{his}}\left(A,B\right)=r_{L_{his}}\left(B,C\right)=1$ and $r_{L_{act}}\left(A,B\right)=r_{L_{act}}\left(A,C\right)=r_{L_{act}}\left(B,C\right)=\frac{1}{2}$. It is inferred that the actual log $L_{act}$ contains a skip hidden transition and the changed behavioral relation is $R_{ch}=B{P}_{L_{act}}-B{P}_{L_{his}}=\varnothing$. Meanwhile, the log minimum successor relations changed from $MS{R}_{L_{his}}\left(A,C\right)=2$ to $MS{R}_{L_{act}}\left(A,C\right)=1$.

Table 10. Original event logs and actual logs in group 4.

Symbol	Trace
${\sigma }_{12}$	$L_{his}=<<ABCD>>$
${\sigma }_{13}$	$L_{act}=<<ABCD>>$
${\sigma }_{14}$	$L_{act}=<<ABCBCBC\stackrel{·}{B}\stackrel{·}{C}>>$

and

Table 11. Original event logs and actual logs in group 5.

Symbol	Trace
${\sigma }_{15}$	$L_{his}=<<ABCDG>>$
${\sigma }_{16}$	$L_{his}=<<ABEFG>>$
${\sigma }_{17}$	$L_{act}=<<ABCDG>>$
${\sigma }_{18}$	$L_{act}=<<ABEFG>>$
${\sigma }_{19}$	$L_{act}=<<ABCFG>>$

present the log instances of groups 4 and 5, respectively. $\stackrel{·}{B}\stackrel{·}{C}$ indicates that the transition activity BC is enabled in an infinite loop in ${\sigma }_{14}$.

Table 12. Behavioral profiles ($B{P}_{L_{his}}$) and log minimum successor relations ($MS{R}_{L_{his}}$)_{(group 4)}.

	$A$	$B$	$C$	$D$
$A$		$\to$(1)	$\to$(2)	$\to$(3)
$B$			$\to$(1)	$\to$(2)
$C$				$\to$(1)
$D$

and

Table 13. Behavioral profiles ($B{P}_{L_{act}}$) and log minimum successor relations ($MS{R}_{L_{act}}$)_{(group 4)}.

	$A$	$B$	$C$	$D$
$A$		$\to$(1)	$\to$(2)	$\to$(3)
$B$		$\to$(2)	||(1)	$\to$(2)
$C$		||(1)	$\to$(2)	$\to$(1)
$D$

show the calculated log behavioral profiles and log minimum successor relations of group 4, respectively.

It is inferred that $Y_{L_{his}}=Y_{L_{act}}$, $L_{act}\ne L_{his}$, $MS{R}_L{}_{{}_{act}}\ne MS{R}_L{}_{{}_{his}}$, and $r_L{}_{{}_{act}}\ne r_L{}_{{}_{his}}$ hold. Moreover, the transition activity $B,C$ satisfies $B{P}_{L_{his}}\left(B,B\right)=B{P}_{L_{his}}\left(C,C\right)=\varnothing$, $B{P}_{L_{act}}\left(B,B\right)\ne \varnothing$, $B{P}_{L_{act}}\left(C,C\right)\ne \varnothing$, $MS{R}_{L_{his}}\left(B,B\right)=MS{R}_{L_{his}}\left(C,C\right)=\varnothing$, $MS{R}_{L_{act}}\left(B,B\right)\ne \varnothing$, and $MS{R}_{L_{act}}\left(C,C\right)\ne \varnothing$. The pair transition activity $\left(B,C\right)$ satisfies $B{\succ }_{L_{act}}C,C{\succ }_{L_{act}}B$, $B{\succ }_{L_{his}}C,C{\cancel{\succ }}_{L_{his}}B$, $B{\cancel{\succ }}_{L_{his}}B,C{\cancel{\succ }}_{L_{his}}C$, and $B{\succ }_{L_{act}}B,C{\succ }_{L_{act}}C$.

Additionally, Table 12 and Table 13 show that the changed behavioral relations are $R_{ch}=B{P}_{L_{act}}-B{P}_{L_{his}}=B{P}_{(B,B)}\left({\to }_{L_{act}}\right)+B{P}_{(B,C)}\left({\parallel }_{L_{act}}\right)+B{P}_{(C,C)}\left({\to }_{L_{act}}\right)$ in the actual logs and contain the loop hidden transition.

Table 14. Behavioral profiles ($B{P}_{L_{his}}$) and log minimum successor relations ($MS{R}_{L_{his}}$)_{(group 5)}.

	$A$	$B$	$C$	$D$	$E$	$F$	$G$
$A$		$\to$(1)	$\to$(2)	$\to$(3)	$\to$(2)	$\to$(3)	$\to$(4)
$B$			$\to$(1)	$\to$(2)	$\to$(1)	$\to$(2)	$\to$(3)
$C$				$\to$(1)			$\to$(2)
$D$							$\to$(1)
$E$						$\to$(1)	$\to$(2)
$F$							$\to$(1)
$G$

and

Table 15. Behavioral profiles ($B{P}_{L_{act}}$) and log minimum successor relations ($MS{R}_{L_{act}}$)_{(group 5)}.

	$A$	$B$	$C$	$D$	$E$	$F$	$G$
$A$		$\to$(1)	$\to$(2)	$\to$(3)	$\to$(2)	$\to$(3)	$\to$(4)
$B$			$\to$(1)	$\to$(2)	$\to$(1)	$\to$(2)	$\to$(3)
$C$				$\to$(1)		$\to$(1)	$\to$(2)
$D$							$\to$(1)
$E$						$\to$(1)	$\to$(2)
$F$							$\to$(1)
$G$

show the calculated log behavioral profiles and log minimum successor relations of group 5, respectively.

For the logs of group 5, $Y_{L_{his}}=Y_{L_{act}}$, $L_{act}\ne L_{his}\wedge L_{act}\cap L_{his}=L_{his}\ne \varnothing$, and $MS{R}_L{}_{{}_{act}}\ne MS{R}_L{}_{{}_{his}}$. According to Definition 4, the log-weighted coefficients are calculated as $r_L{}_{{}_{act}}\ne r_L{}_{{}_{his}}$. A comparison of Table 14 and Table 15 clearly shows that $B{P}_{L_{his}}\left(C,F\right)=\varnothing$ is satisfied.

However, in the actual log $L_{act}$, $B{P}_{L_{act}}\left(C,F\right)=\left\{{\to }_{L_{act}}\right\}\ne \varnothing$ and $MS{R}_{L_{act}}\left(C,F\right)=1\wedge r_{L_{act}}\left(C,F\right)>0$ are satisfied. The changed relation is written as $R_{ch}=B{P}_{L_{act}}-B{P}_{L_{his}}=B{P}_{(C,F)}\left({\to }_{L_{act}}\right)$ and the changed transition, called a switch hidden transition, is mined in the actual log.

In this section, we discussed several behavioral-change-mining methods. The behavioral relation between the strict hidden transition and other transitions is usually a strict order relation, such that the strict hidden transition does not affect the model behavior. Meanwhile, the effects of four types of hidden transitions, namely the and-split, skip, loop, and switch transitions, on the model behavior can be divided into four categories:

(1)

Strict order relation $\{\to \}$$\Rightarrow$ interleaving order relation $\{\parallel \}$;

(2)

Interleaving order relation $\{\parallel \}$$\Rightarrow$ strict order relation $(\to )$;

(3)

$B{P}_{(a_1,a_2)}=\varnothing \Rightarrow B{P}_{(a_1,a_2)}=\{\parallel \}$ or $B{P}_{(a_1,a_2)}=\{\parallel \}\Rightarrow B{P}_{(a_1,a_2)}=\varnothing$;

(4)

$B{P}_{(a_1,a_2)}=\varnothing \Rightarrow B{P}_{(a_1,a_2)}=\{\to \}$ or $B{P}_{(a_1,a_2)}=\{\to \}\Rightarrow B{P}_{(a_1,a_2)}=\varnothing$.

5. Experimental Evaluation

The computing resource used in the experiments was an Intel Core I5 eight-generation central processing unit with 8 GB RAM and a Windows 10 64-bit operating system. The event logs used in the experiment were typical artificial structured control flow event logs, namely Artificial Structured Control Flow. Figure 9 presents the results obtained using the Inductive Miner method in the ProM process mining tool to model the artificial structured control flow event logs.

Figure 9 shows that the number of typical structured control flow event logs is large, the behavioral relations are relatively complex, and the workload of studying the overall behavior structure of the model is heavy. A representative local model is thus selected as the research object to further analyze and verify the effectiveness of the algorithm proposed in this paper. Figure 10 is a partial view of the ProM simulation diagram mined from the artificial structured control flow event logs.

Table 16. Original event logs $L_{his}$ obtained by CPN Tools.

Symbol	Trace	Symbol	Trace
${\sigma }_1$	$L_{his}=<<a_3{a}_{15}{a}_{21}{a}_{22}{a}_{13}>>$	${\sigma }_{10}$	$L_{his}=<<a_3{a}_{17}{a}_{21}{a}_{22}{a}_{13}>>$
${\sigma }_2$	$L_{his}=<<a_3{a}_{15}{a}_{21}{a}_{12}{a}_{19}>>$	${\sigma }_{11}$	$L_{his}=<<a_3{a}_{17}{a}_{21}{a}_{12}{a}_{19}>>$
${\sigma }_3$	$L_{his}=<<a_3{a}_{15}{a}_{21}{a}_{23}{a}_{24}>>$	${\sigma }_{12}$	$L_{his}=<<a_3{a}_{17}{a}_{21}{a}_{23}{a}_{24}>>$
${\sigma }_4$	$L_{his}=<<a_3{a}_{20}{a}_{21}{a}_{22}{a}_{13}>>$	${\sigma }_{13}$	$L_{his}=<<a_3{a}_{18}{a}_{21}{a}_{22}{a}_{13}>>$
${\sigma }_5$	$L_{his}=<<a_3{a}_{20}{a}_{21}{a}_{12}{a}_{19}>>$	${\sigma }_{14}$	$L_{his}=<<a_3{a}_{18}{a}_{21}{a}_{12}{a}_{19}>>$
${\sigma }_6$	$L_{his}=<<a_3{a}_{20}{a}_{21}{a}_{23}{a}_{24}>>$	${\sigma }_{15}$	$L_{his}=<<a_3{a}_{18}{a}_{21}{a}_{23}{a}_{24}>>$
${\sigma }_7$	$L_{his}=<<a_3{a}_{16}{a}_{21}{a}_{22}{a}_{13}>>$	${\sigma }_{16}$	$L_{his}=<<a_3{a}_{14}{a}_{21}{a}_{22}{a}_{13}>>$
${\sigma }_8$	$L_{his}=<<a_3{a}_{16}{a}_{21}{a}_{12}{a}_{19}>>$	${\sigma }_{17}$	$L_{his}=<<a_3{a}_{14}{a}_{21}{a}_{12}{a}_{19}>>$
${\sigma }_9$	$L_{his}=<<a_3{a}_{16}{a}_{21}{a}_{23}{a}_{24}>>$	${\sigma }_{18}$	$L_{his}=<<a_3{a}_{14}{a}_{21}{a}_{23}{a}_{24}>>$

presents model logs obtained using the online simulation tool CPN Tools, denoted $L_{his}$.

Table 17. $B{P}_{L_{his}}$ and $MS{R}_{L_{his}}$ corresponding to the logs in Table 16.

$a_3$

$a_{12}$

$a_{13}$

$a_{14}$

$a_{15}$

$a_{16}$

$a_{17}$

$a_{18}$

$a_{19}$

$a_{20}$

$a_{21}$

$a_{22}$

$a_{23}$

$a_{24}$

$a_3$

$\to$(3)

$\to$(4)

$\to$(1)

$\to$(1)

$\to$(1)

$\to$(1)

$\to$(1)

$\to$(4)

$\to$(1)

$\to$(2)

$\to$(3)

$\to$(3)

$\to$(4)

$a_{12}$

$\to$(1)

$a_{13}$

$a_{14}$

$\to$(2)

$\to$(3)

$\to$(3)

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(3)

$a_{15}$

$\to$(2)

$\to$(3)

$\to$(3)

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(3)

$a_{16}$

$\to$(2)

$\to$(3)

$\to$(3)

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(3)

$a_{17}$

$\to$(2)

$\to$(3)

$\to$(3)

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(3)

$a_{18}$

$\to$(2)

$\to$(3)

$\to$(3)

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(3)

$a_{19}$

$a_{20}$

$\to$(2)

$\to$(3)

$\to$(3)

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(3)

$a_{21}$

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(1)

$\to$(1)

$\to$(2)

$a_{22}$

$\to$(1)

$a_{23}$

$\to$(1)

$a_{24}$

presents the behavioral profiles and log minimum successor relations of $L_{his}$ calculated using Definitions 2 and 3.

The actual logs that contain the hidden transitions are presented in

Table 18. Actual event logs $L_{act}$.

Symbol	Trace	Symbol	Trace
${\sigma }_1$	$L_{act}=<<a_3{a}_{15}{a}_{21}{a}_{22}{a}_{13}>>$	${\sigma }_{16}$	$L_{act}=<<a_3{a}_{17}{a}_{16}{a}_{21}{a}_{22}{a}_{13}>>$
${\sigma }_2$	$L_{act}=<<a_3{a}_{15}{a}_{21}{a}_{22}\stackrel{·}{a_{13}}>>$	${\sigma }_{17}$	$L_{act}=<<a_3{a}_{17}{a}_{16}{a}_{21}{a}_{22}\stackrel{·}{a_{13}}>>$
${\sigma }_3$	$L_{act}=<<a_3{a}_{15}{a}_{21}{a}_{12}{a}_{19}>>$	${\sigma }_{18}$	$L_{act}=<<a_3{a}_{17}{a}_{16}{a}_{21}{a}_{12}{a}_{19}>>$
${\sigma }_4$	$L_{act}=<<a_3{a}_{15}{a}_{21}{a}_{23}{a}_{24}>>$	${\sigma }_{19}$	$L_{act}=<<a_3{a}_{17}{a}_{16}{a}_{21}{a}_{23}{a}_{24}>>$
${\sigma }_5$	$L_{act}=<<a_3{a}_{15}{a}_{21}{a}_{12}{a}_{24}>>$	${\sigma }_{20}$	$L_{act}=<<a_3{a}_{17}{a}_{16}{a}_{21}{a}_{12}{a}_{24}>>$
${\sigma }_6$	$L_{act}=<<a_3{a}_{20}{a}_{21}{a}_{22}{a}_{13}>>$	${\sigma }_{21}$	$L_{act}=<<a_3{a}_{18}{a}_{21}{a}_{22}{a}_{13}>>$
${\sigma }_7$	$L_{act}=<<a_3{a}_{20}{a}_{21}{a}_{22}\stackrel{·}{a_{13}}>>$	${\sigma }_{22}$	$L_{act}=<<a_3{a}_{18}{a}_{21}{a}_{22}\stackrel{·}{a_{13}}>>$
${\sigma }_8$	$L_{act}=<<a_3{a}_{20}{a}_{21}{a}_{12}{a}_{19}>>$	${\sigma }_{23}$	$L_{act}=<<a_3{a}_{18}{a}_{21}{a}_{12}{a}_{19}>>$
${\sigma }_9$	$L_{act}=<<a_3{a}_{20}{a}_{21}{a}_{23}{a}_{24}>>$	${\sigma }_{24}$	$L_{act}=<<a_3{a}_{18}{a}_{21}{a}_{23}{a}_{24}>>$
${\sigma }_{10}$	$L_{act}=<<a_3{a}_{20}{a}_{21}{a}_{12}{a}_{24}>>$	${\sigma }_{25}$	$L_{act}=<<a_3{a}_{18}{a}_{21}{a}_{12}{a}_{24}>>$
${\sigma }_{11}$	$L_{act}=<<a_3{a}_{16}{a}_{17}{a}_{21}{a}_{22}{a}_{13}>>$	${\sigma }_{26}$	$L_{act}=<<a_3{a}_{14}{a}_{21}{a}_{22}{a}_{13}>>$
${\sigma }_{12}$	$L_{act}=<<a_3{a}_{16}{a}_{17}{a}_{21}{a}_{22}\stackrel{·}{a_{13}}>>$	${\sigma }_{27}$	$L_{act}=<<a_3{a}_{14}{a}_{21}\stackrel{·}{a_{22}{a}_{13}}>>$
${\sigma }_{13}$	$L_{act}=<<a_3{a}_{16}{a}_{17}{a}_{21}{a}_{12}{a}_{19}>>$	${\sigma }_{28}$	$L_{act}=<<a_3{a}_{14}{a}_{21}{a}_{12}{a}_{19}>>$
${\sigma }_{14}$	$L_{act}=<<a_3{a}_{16}{a}_{17}{a}_{21}{a}_{23}{a}_{24}>>$	${\sigma }_{29}$	$L_{act}=<<a_3{a}_{14}{a}_{21}{a}_{23}{a}_{24}>>$
${\sigma }_{15}$	$L_{act}=<<a_3{a}_{16}{a}_{17}{a}_{21}{a}_{12}{a}_{24}>>$	${\sigma }_{30}$	$L_{act}=<<a_3{a}_{14}{a}_{21}{a}_{12}{a}_{24}>>$

, and the corresponding behavioral profile relations and log minimum successor relations are presented in

Table 19. $B{P}_{L_{act}}$ and $MS{R}_{L_{act}}$ of $L_{act}$.

$a_3$

$a_{12}$

$a_{13}$

$a_{14}$

$a_{15}$

$a_{16}$

$a_{17}$

$a_{18}$

$a_{19}$

$a_{20}$

$a_{21}$

$a_{22}$

$a_{23}$

$a_{24}$

$a_3$

$\to$(3)

$\to$(4)

$\to$(1)

$\to$(1)

$\to$(1)

$\to$(1)

$\to$(1)

$\to$(4)

$\to$(1)

$\to$(2)

$\to$(3)

$\to$(3)

$\to$(4)

$a_{12}$

$\to$(1)

$\to$(1)

$a_{13}$

$\to$(1)

$a_{14}$

$\to$(2)

$\to$(3)

$\to$(3)

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(3)

$a_{15}$

$\to$(2)

$\to$(3)

$\to$(3)

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(3)

$a_{16}$

$\to$(2)

$\to$(3)

$\parallel$(1)

$\to$(3)

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(3)

$a_{17}$

$\to$(2)

$\to$(3)

$\parallel$(1)

$\to$(3)

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(3)

$a_{18}$

$\to$(2)

$\to$(3)

$\to$(3)

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(3)

$a_{19}$

$a_{20}$

$\to$(2)

$\to$(3)

$\to$(3)

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(3)

$a_{21}$

$\to$(1)

$\to$(2)

$\to$(2)

$\to$(1)

$\to$(1)

$\to$(2)

$a_{22}$

$\to$(1)

$a_{23}$

$\to$(1)

$a_{24}$

.

It is first inferred that $Y_{L_{his}}=Y_{L_{act}}$, $L_{act}\ne L_{his}\wedge L_{act}\not\subset L_{his}\wedge L_{his}\not\subset L_{act}$, $MS{R}_{L_{act}}\ne MS{R}_{L_{his}}$, and $r_L{}_{{}_{act}}\ne r_L{}_{{}_{his}}$ hold. The following conclusions are then drawn from the operation and analysis of Algorithm 1.

(1)

$a_{16},a_{17}\in Y_{his}$ are present. Similarly, $a_{16},a_{17}\in Y_{act}$ are present because $Y_{his}=Y_{act}$. Additionally, we obtain $B{P}_{L_{his}}\left(a_{16},a_{17}\right)=\varnothing$ and $B{P}_{L_{act}}\left(a_{16},a_{17}\right)=\left\{{\parallel }_{act}\right\}$. It is inferred from Algorithm 1 (5–8) that the hidden transition contained in the actual log is an and-split transition, and the changed behavioral relation is $R_{ch}=B{P}_{L_{act}}\left(a_{16},a_{17}\right)-B{P}_{L_{his}}\left(a_{16},a_{17}\right)=\{\parallel \}$.

(2)

The following are present: $a_{13}\in Y_{L_{his}}$, $B{P}_{L_{his}}\left(a_{13},a_{13}\right)=\varnothing$, $B{P}_{L_{act}}\left(a_{13},a_{13}\right)=\{\to \}$, $MS{R}_{L_{his}}\left(a_{13},a_{13}\right)=\varnothing$, and $MS{R}_{L_{act}}\left(a_{13},a_{13}\right)=1\ne \varnothing$. It is inferred from Algorithm 1 (15–18) that the hidden transition is a loop transition, and the changed behavioral relation is $R_{ch}=B{P}_{L_{act}}\left(a_{13},a_{13}\right)-B{P}_{L_{his}}\left(a_{13},a_{13}\right)=\{\to \}$.

(3)

$\left(a_{12},a_{24}\right)\in Y_{L_{his}}$ satisfies $B{P}_{L_{his}}\left(a_{12},a_{24}\right)=\varnothing$ and $MS{R}_{L_{his}}\left(a_{12},a_{24}\right)=\varnothing$ such that we obtain $r_{L_{his}}\left(a_{12},a_{24}\right)=\varnothing$. However,$B{P}_{L_{act}}\left(a_{12},a_{24}\right)=\left\{{\to }_{L_{act}}\right\}\ne \varnothing$ and $MS{R}_{L_{act}}\left(a_{12},a_{24}\right)=1$ hold. $r_{L_{act}}\left(a_{12},a_{24}\right)=\frac{1}{6}$ is obtained from Definition 5. It is inferred from Algorithm 1 (19–23) that the hidden transition is a switch transition, and the changed behavioral relation is $R_{ch}=B{P}_{L_{act}}\left(a_{12},a_{24}\right)-B{P}_{L_{his}}\left(a_{12},a_{24}\right)=\{\to \}$.

To verify the correctness of the method, the artificial structured control flow event logs with hidden transitions are mined using ProM Tools, and the Petri net model shown in Figure 11 is obtained. The model shown in Figure 11 differs from that in Figure 10 due to the triggering of hidden transitions. As a more intuitive illustration, the model with hidden transitions in Figure 11 is drawn in Figure 12a, and the original model without hidden transitions is drawn in Figure 12b.

It is seen that and-split, loop, and switch hidden transitions are enabled in the actual model. The simulation results are consistent with the calculation results of the method presented in this paper regarding the types of change transitions and the model behavioral relations, which further verifies the correctness of the method.

6. Case Study

6.1. Basic Types of Disaster Chains

Research on disaster chains is still in its infancy, and further research in terms of risk assessment, disaster loss estimation, and chain-cutting disaster mitigation is necessary in conjunction with the adoption of other related technologies. The Petri net as a mathematical tool for modeling discrete and distributed systems has been widely used in risk assessment and disaster chain analysis in recent years. Additionally, the Petri net can model the disaster chains and express the triggering factors in the assessment of safety, reliability, and risk. Before conducting the actual disaster scenario analysis, four basic types of disaster chain are introduced from the perspective of disaster interrelationships, namely the causal disaster chain, concurrent disaster chain, exclusive disaster chain, and coupled disaster chain. These basic forms are shown in Figure 13.

Figure 13a shows the causal disaster chain: $DS{E}_{chain1}$ triggers $DS{E}_{chain2}$. The sequential structure of the causal disaster chain is relatively simple and can help to distinguish between precursor disasters and subsequent disasters, such as $Pre(DS{E}_{chain2})=DS{E}_{chain1}$ and $Sub(DS{E}_{chain1})=DS{E}_{chain2}$. Figure 13b shows the concurrent disaster chain:$DS{E}_{chain1}$ triggers $DS{E}_{chain2}$ and $DS{E}_{chain3}$.The probabilities of subsequent disasters are equal, i.e., $r\left(DS{E}_{chain1}DS{E}_{chain2}\right)=r\left(DS{E}_{chain1}DS{E}_{chain3}\right)$. Figure 13c shows the exclusive disaster chain, where the occurrence of disaster events A and B is exclusive, meaning that one disaster occurs and the other does not occur or diminishes. Figure 13d shows the coupled disaster chain where $DS{E}_{chain1}$ and $DS{E}_{chain2}$ together trigger $DS{E}_{chain3}$. The risk of a coupled disaster chain is higher than the risk posed by other disaster chains.

6.2. Application of the Method

The dynamic evolution of a disaster chain is analyzed for the environmental pollution and ecological damage caused by a petrochemical leak, taking the 2018 petrochemical leak of Donggang Petrochemical Chemical Industry Co., Ltd. in the city of Quanzhou, Fujian Province as an example. During this leak, petrochemicals spread to beaches, causing great harm to the coastal environment, local industries, and residents. The disaster events of the oil spill were mapped to log transition activities to clearly describe the effects of the petrochemical spill on the environment and the lives of the nearby residents.

Table 20. Disaster event logs of the oil spill.

$\mathbf{Event} \mathbf{Logs} {\mathit{L}}_{\mathit{d}\mathit{i}\mathit{s}}$
${\sigma }_1$	$t_0{t}_1{t}_9{t}_{10}{t}_{11}$	${\sigma }_{16}$	$t_0{t}_6{t}_{38}{t}_{39}$
${\sigma }_2$	$t_0{t}_1{t}_{10}{t}_9{t}_{11}$	${\sigma }_{17}$	$t_0{t}_7{t}_{40}$
${\sigma }_3$	$t_0{t}_2{t}_{12}{t}_{13}{t}_{15}$	${\sigma }_{18}$	$t_0{t}_8{t}_{46}{t}_{41}{t}_{42}{t}_{43}{t}_{44}{t}_{45}$
${\sigma }_4$	$t_0{t}_2{t}_{12}{t}_{14}{t}_{16}{t}_{17}{t}_{18}{t}_{19}{t}_{20}{t}_{21}{t}_{22}$	${\sigma }_{19}$	$t_0{t}_8{t}_{46}{t}_{41}{t}_{42}{t}_{43}{t}_{45}{t}_{44}$
${\sigma }_5$	$t_0{t}_2{t}_{12}{t}_{14}{t}_{16}{t}_{17}{t}_{18}{t}_{19}{t}_{20}{t}_{22}{t}_{21}$	${\sigma }_{20}$	$t_0{t}_8{t}_{46}{t}_{41}{t}_{42}{t}_{44}{t}_{43}{t}_{45}$
${\sigma }_6$	$t_0{t}_2{t}_{12}{t}_{14}{t}_{16}{t}_{17}{t}_{18}{t}_{19}{t}_{21}{t}_{20}{t}_{22}$	${\sigma }_{21}$	$t_0{t}_8{t}_{46}{t}_{41}{t}_{42}{t}_{44}{t}_{45}{t}_{43}$
${\sigma }_7$	$t_0{t}_2{t}_{12}{t}_{14}{t}_{16}{t}_{17}{t}_{18}{t}_{19}{t}_{21}{t}_{22}{t}_{20}$	${\sigma }_{22}$	$t_0{t}_8{t}_{46}{t}_{41}{t}_{42}{t}_{45}{t}_{43}{t}_{44}$
${\sigma }_8$	$t_0{t}_2{t}_{12}{t}_{14}{t}_{16}{t}_{17}{t}_{18}{t}_{19}{t}_{22}{t}_{20}{t}_{21}$	${\sigma }_{23}$	$t_0{t}_8{t}_{46}{t}_{41}{t}_{42}{t}_{45}{t}_{44}{t}_{43}$
${\sigma }_9$	$t_0{t}_2{t}_{12}{t}_{14}{t}_{16}{t}_{17}{t}_{18}{t}_{19}{t}_{22}{t}_{21}{t}_{20}$	${\sigma }_{24}$	$t_0{t}_8{t}_{41}{t}_{46}{t}_{42}{t}_{43}{t}_{44}{t}_{45}$
${\sigma }_{10}$	$t_0{t}_3{t}_{23}{t}_{24}{t}_{26}$	${\sigma }_{25}$	$t_0{t}_8{t}_{41}{t}_{46}{t}_{42}{t}_{43}{t}_{45}{t}_{44}$
${\sigma }_{11}$	$t_0{t}_3{t}_{23}{t}_{25}{t}_{27}{t}_{28}$	${\sigma }_{26}$	$t_0{t}_8{t}_{41}{t}_{46}{t}_{42}{t}_{44}{t}_{43}{t}_{45}$
${\sigma }_{12}$	$t_0{t}_4{t}_{29}{t}_{30}$	${\sigma }_{27}$	$t_0{t}_8{t}_{41}{t}_{46}{t}_{42}{t}_{44}{t}_{45}{t}_{43}$
${\sigma }_{13}$	$t_0{t}_4{t}_{29}{t}_{31}{t}_{32}{t}_{33}$	${\sigma }_{28}$	$t_0{t}_8{t}_{41}{t}_{46}{t}_{42}{t}_{45}{t}_{43}{t}_{44}$
${\sigma }_{14}$	$t_0{t}_5{t}_{34}{t}_{35}{t}_{36}{t}_{37}{t}_{38}{t}_{39}$	${\sigma }_{29}$	$t_0{t}_8{t}_{41}{t}_{46}{t}_{42}{t}_{45}{t}_{44}{t}_{43}$
${\sigma }_{15}$	$t_0{t}_5{t}_{34}{t}_{35}{t}_{37}{t}_{36}{t}_{38}{t}_{39}$

and

Table 21. Semantic descriptions.

Symbol	Semantic	Symbol	Semantic	Symbol	Semantic
$t_0$	Oil spill	$t_{16}$	Aquatic death	$t_{32}$	Injury and death
$t_1$	Nature reserve	$t_{17}$	Inflow into the market	$t_{33}$	Negative network public opinion
$t_2$	Amount of oil spill	$t_{18}$	Food contamination	$t_{34}$	Maritime traffic disruption
$t_3$	Volatility of oil	$t_{19}$	Negative network public opinion	$t_{35}$	Unconditional trigger
$t_4$	Flammability of oil	$t_{20}$	Market fluctuation	$t_{36}$	Freight break
$t_5$	Maritime traffic area	$t_{21}$	Unsalted aquatic products	$t_{37}$	Tourism damage
$t_6$	Scenic area	$t_{22}$	Social mass incidents	$t_{38}$	Unconditional trigger
$t_7$	Controversial area	$t_{23}$	Air pollution	$t_{39}$	Service industry damage
$t_8$	Shoreline	$t_{24}$	Oil spill responders	$t_{40}$	Foreign-related events
$t_9$	Ecological destruction	$t_{25}$	Coastal residential area	$t_{41}$	Shore beach pollution
$t_{10}$	Wildlife death	$t_{26}$	responder poisoning	$t_{42}$	Coastal industrial area
$t_{11}$	Animal epidemic event	$t_{27}$	Mass poisoning event	$t_{43}$	Industrial production damage
$t_{12}$	Water pollution	$t_{28}$	Negative network public opinion	$t_{44}$	School suspension
$t_{13}$	Urban water supply area	$t_{29}$	Hazardous chemicals explosion	$t_{45}$	Transport industry damage
$t_{14}$	Aquaculture	$t_{30}$	Negative network public opinion	$t_{46}$	Soil pollution
$t_{15}$	Urban water supply interruption	$t_{31}$	Human existence

show the execution traces of this oil spill disaster and the semantic description of transition activities, respectively.

Table 20 presents all the execution traces of the oil spill disaster event, denoted as $L=<{\sigma }_1,{\sigma }_2\cdots {\sigma }_{29}>$. The study of the dynamic evolution of the disaster chain from the perspective of the event logs intuitively obtains the primary disaster, secondary disaster, and derived disaster. Disaster event $t_0$, as the primary disaster of the overall disaster chain, triggers a series of subsequent disaster events. Taking event trace B as an example, the dynamic transformational relations of the disaster chain are shown in Figure 14. The chain is a typical causal disaster chain, which is the most common type of disaster chain in the logs.

There are many more event traces and transition activities in the disaster event logs, corresponding to a huge amount of data and a complex model. In view of the detailed introduction and calculation of the behavioral profile relations and log minimum successor relations described in Section 3, this section does not give the complete behavioral profile matrix but only calculates and analyzes some of the event traces. Taking the sequence of traces ${\sigma }_4$ to ${\sigma }_9$ as an example, we calculate the mutual behavioral profile relations and the log minimum successor relations of the transitions $t_{20}{t}_{21}{t}_{22}$, which satisfy $B{P}_{\left(t_{20},t_{21}\right)}=\parallel$, $MS{R}_{\left(t_{20},t_{21}\right)}=1$, $B{P}_{\left(t_{20},t_{22}\right)}=\parallel$, $MS{R}_{\left(t_{20},t_{22}\right)}=1$, $B{P}_{\left(t_{21},t_{22}\right)}=\parallel$, and $MS{R}_{\left(t_{21},t_{22}\right)}=1$. To gain a more intuitive understanding, the behavioral relations of $t_{20}{t}_{21}{t}_{22}$ are simulated using the Petri net model. The model structure shown in Figure 15 is obtained.

Similarly, the calculation rules and determination method in Algorithm 1 can be used to calculate exclusive and coupled disaster chains. However, it should be noted that for coupled disaster chains, the cause is the coupling of multiple disasters, and their risks and damage degree are thus higher [27]. This paper mainly introduces the method of change mining using log behavioral profile relations and does not discuss how to conduct risk assessment research for a coupled disaster chain or how to transform strong coupling into weak coupling or zero coupling, which are topics to be explored in further research.

The logical order of disaster events is usually different in different scenarios. Affected by different environmental and social factors, the previous and subsequent events of a disaster chain are slightly different: ${\sigma }_{10}=t_0{t}_3{t}_{23}{t}_{24}{t}_{26}$ and $BP\left(t26,t28\right)=\varnothing$ in $L_{dis}$. The trace indicates that the oil spill caused responder poisoning during the rescue process. In different situations, responder poisoning can directly lead to the occurrence of $t_{28}$ (negative public opinions on the network). Therefore, ${\sigma }_{10}{}^{\text{'}}=t_0{t}_3{t}_{23}{t}_{24}{t}_{26}{t}_{28}$ includes behavioral relations, denoted $BP\left(t26,t28\right)=\to ,MSR\left(t26,t28\right)=1\wedge r\left(t26,t28\right)>0$. An analysis of Algorithm 1 reveals that the occurrence of the switch hidden transition leads to behavioral changes. We can clearly observe that an oil spill eventually leads to the occurrence of social mass incidents from ${\sigma }_4$ to ${\sigma }_9$. The social mass incidents then lead to the continued fermentation of negative network public opinion. On the basis of this dynamic description, an execution sequence of $L=<{\sigma }_4,{\sigma }_5,{\sigma }_6,{\sigma }_7,{\sigma }_8,{\sigma }_9>$ occurs, where ${\sigma }_4=t_0{t}_2{t}_{12}{t}_{14}{t}_{16}{t}_{17}{t}_{18}\stackrel{·}{t_{19}}\stackrel{·}{t_{20}}\stackrel{·}{t_{21}}\stackrel{·}{t_{22}}$, ${\sigma }_5=t_0{t}_2{t}_{12}{t}_{14}{t}_{16}{t}_{17}{t}_{18}\stackrel{·}{t_{19}}\stackrel{·}{t_{20}}\stackrel{·}{t_{22}}\stackrel{·}{t_{21}}$, ${\sigma }_6=t_0{t}_2{t}_{12}{t}_{14}{t}_{16}{t}_{17}{t}_{18}\stackrel{·}{t_{19}}\stackrel{·}{t_{21}}\stackrel{·}{t_{20}}\stackrel{·}{t_{22}}$, ${\sigma }_7=t_0{t}_2{t}_{12}{t}_{14}{t}_{16}{t}_{17}{t}_{18}\stackrel{·}{t_{19}}\stackrel{·}{t_{21}}\stackrel{·}{t_{22}}\stackrel{·}{t_{20}}$, ${\sigma }_8=t_0{t}_2{t}_{12}{t}_{14}{t}_{16}{t}_{17}{t}_{18}\stackrel{·}{t_{19}}\stackrel{·}{t_{22}}\stackrel{·}{t_{20}}\stackrel{·}{t_{21}}$, and ${\sigma }_9=t_0{t}_2{t}_{12}{t}_{14}{t}_{16}{t}_{17}{t}_{18}\stackrel{·}{t_{19}}\stackrel{·}{t_{22}}\stackrel{·}{t_{21}}\stackrel{·}{t_{20}}$. We deduce from Algorithm 1 that the occurrence of the loop hidden transition may lead to changes in the disaster logs. However, because the disaster chain is a concurrent disaster chain, the location of the hidden transition has three possibilities, which are marked with dotted boxes in Figure 16 and Figure 17 showing the specific simulation results.

Figure 16 and Figure 17 are Petri net models of the disaster events with and without hidden transitions. Using Algorithm 1, we can mine the dynamic evolution process of disaster chains in different scenarios when only the disaster event logs are given, and we can clarify the basic types of disaster chain. For example, if there is a higher risk of a coupled disaster chain, the decision maker can make a reasonable judgment to cut this chain for disaster mitigation.

7. Conclusions

This paper proposed a method for mining behavioral changes based on complete logs with hidden transitions. Firstly, to capture the dependencies between transition activities more accurately, the method of calculating the log minimum successor relations was defined. Secondly, we proposed classification rules of hidden transitions and calculation rules of log-weighted coefficients. Process models with strict, and-split, and-join, skip, loop, and switch hidden transitions were then identified by combining the log behavioral profile, log minimum successor relation, log-weighted coefficient and changed behavioral relations. Finally, the correctness and feasibility of the approach were verified in experiments and a case study. There are three main aspects of future research: (1) improving the methodology so that it can be applied to non-freely chosen structures; (2) considering how to correctly mine hidden transitions and changed behavioral relations when the behavioral relations of logs are incomplete, and (3) considering further application of the methodology to disaster chain risk assessment by adding probabilistic constraints to estimate the probability of subsequent disaster events occurring.