(2021) Mining Easily Understandable Models from Complex Event Logs.
|
Text
proseqo-wiegand,klakow,vreeken.pdf Download (829kB) | Preview |
Abstract
We consider the problem of discovering accurate, yet easily understandable graph-based models from complex event sequence data. Real-world event data, such as production logs, exhibit complex behaviors. These include sequences, choices, loops, optionals, and combinations thereof that make it hard to gain insight into what is going on, and how we can improve the process. Current approaches do not solve this problem satisfyingly, as their modeling language is too restricted to capture complex behavior or they return models that are still too difficult to understand. We formalize the problem in terms of the Minimum Description Length (MDL) principle, by which we say that the best model provides the shortest lossless description of the data. The resulting problem is NP-hard, and hence we propose the greedy PROSEQO algorithm to discover good models from data. PROSEQO iteratively simplifies the current description by removing nodes, edges, and applying patterns, until MDL tells us to stop. For whenever this result is still too complex, we propose PROSIMPLE, which iteratively removes further edges until we satisfy a user-specified threshold. Through an extensive set of experiments, we show both methods perform very well in practice. They return simple models that reconstruct the ground truth well, need only little data to do so, are robust against noise, and scale well. A case study shows that, unlike the state of the art, we discover easily understandable models that capture the key aspects of the data generation process.
| Item Type: | Conference or Workshop Item (A Paper) (Paper) |
|---|---|
| Divisions: | Jilles Vreeken (Exploratory Data Analysis) |
| Conference: | SDM SIAM International Conference on Data Mining |
| Depositing User: | Sebastian Dalleiger |
| Date Deposited: | 09 May 2021 10:26 |
| Last Modified: | 28 Mar 2022 11:46 |
| Primary Research Area: | NRA5: Empirical & Behavioral Security |
| URI: | https://publications.cispa.saarland/id/eprint/3413 |
Actions
Actions (login required)
 |
View Item |