# Anomaly Detection for Service-Oriented Business Processes Using Conformance Analysis
## 4 Data Preparation
### Customer Diagnostic Process as an Example of Real-World Business Processes  
In this paper, a real-world customer diagnostic process (CDP) at BT is considered as a case study to, (a) determine how to extract the data from a complex business environment, and (b) analyse the underlying process execution. Data are extracted from the business process management system (BPMS) installed at the customer relationship department (CRD). CDP is a term referred to the service-related business process where customers interact with service providers for the solution of their service-related queries, using a semi-automated chat service.  
The event log generated as a result of the execution of CDP is collected at the database servers of the relevant department of the organisation. Customers use this semi-automated chat facility to contact CRD to solve their service-related queries. These queries could be of different types, compassing different products and services. A predefined set of system-generated questions is used to conduct diagnostics of the problem that customers face. As with chat servers, customers are initially asked for the standard information, such as their service type, location and nature of the problem they are currently facing. The flow of the questions depends on the answers given by the customer, so the flow of questions generated by the system is highly variable. During the series of questions and customer replies, the system identifies the possible workaround to resolve the service-related complaint. In Figure 2 the generic flow of CDP is presented.  
The majority of customers get their issues handled during the call, and this is considered successful execution of the diagnostic process. Whereas, it is also possible that the customer's query is not resolved during this process, which may happen due to several reasons. These reasons could include the customers failing to respond to the questions within the allotted time period or not providing discreet information about the problem. It is also possible that the system could not identify the root cause of the customer's problem, or a solution is not possible to be implemented remotely.  
In all such scenarios, process execution is considered either completely failed in resolving the issues or partially failed as the customers have been given some timeline for the diagnosis by involving human engineers. It is observed that the execution of such a diagnostic process can have a direct impact on customer satisfaction with the organisation, or even customer churn out in some cases. Each customer's interaction with CDP is referred to as a process instance, and it is recorded in the log by a unique case identifier.  
Each question in the process is a trigger that defines the execution of the process from that point; thus, each question is referred to as an _event_ that occurred during a process. A _Case_ID_ can have multiple events and each event belongs to a single _Case_ID_. The sample flow of events is presented in Figure 3 where each event is a representation of the questions initiated from the system and customers as required to reply. It is observed that events may repeat themselves within a process instance (represented as _Case_ID_). A series of these questions lead to the completion of the diagnostic process.  
The raw event log contained around 4155 instances referred to as cases in the collected dataset, 2,776,635 total events and 1933 unique events. These cases are related to several customer categories that interact with the organisation's call centre. The details of the products with the abstracted product names are mentioned in Table 2. The duration of the  
Figure 3: Flow of events in the customer diagnostic process—start point, end point and events.  
Figure 2: Cross functional diagram of a customer diagnostic process—an example of service-related business process.  
cases varied between 1 min and 280 min. approx. Figure 4 shows the time of customer instances in seconds.