# Anomaly Detection for Service-Oriented Business Processes Using Conformance Analysis
## 4 Data Preparation
### Event Log Generation  
Service-related data are generated when a business process is executed using several heterogeneous information systems. These data are generally in the form of unorganised information, which is usable as an input to other information systems such as analytical tools and dashboards. Data are mainly in several scattered output files; thus, combining them into a sequential data structure is vital for further analysis. Therefore, raw event data generated from real-world business process execution are not suitable for running process mining techniques without converting the data into a standard event log format. A sample event log from a public dataset BPI challenge 'Process Discovery Contest event log' 2019 is represented in Table 1.  
Three primary attributes must exist for an event log to be considered for process mining: (i) unique _Case_ID_, representing a single process instance including multiple events in an ordered sequence, (ii) _Event_ID_, the representation of a single event that belongs to a specific case. (iii) _Timestamp_, a description of the time when a particular event occurred during the execution of a process's instance. Event data extracted in this step are not specific to an underlying process model; thus, this is a generic approach that should be taken for all types of service-oriented business processes. A _Case_ID_ may contain several _Event_IDs_, and each _Event_ID_ may have several attributes reflecting the nature of an event, including Timestamp, description of the activity performed, resources involved during those activities and cost factor. Generally, events belonging to a specific _Case_ID_ have similar attributes throughout the process log, and they are also in the form of an order. The term 'trace' refers to an execution path of events that are part of a unique process instance. The trace reflects the order in which the activities of this path are executed from the start of the process till the end. Thus, a trace \([xyz]\) shows activities where \(x,y\) and \(z\) are related events. Event \(x\) is completed before starting an event \(y\), and that event \(y\) is executed  
\begin{table}
\begin{tabular  
before event \(z\). So an event log is an ordered execution of events that belongs to a case. Definitions of events, trace and event log are described by [PERSON] in [6] as:  
**Definition 1** (Event, attribute). : _Let \(\theta\) be the set of all possible events \(e\) in a trace. A trace \(t\) represents a sequence of activities or events such that \(\theta\). Events can be characterised by a variety of attributes, for example, an event may have an executor, as well as a cost and time stamp. Let AT be a set of names for attributes belonging to an event \(e\). Then, \(e\)\(\epsilon\)\(\theta\), and name of an attribute \(n\)\(\epsilon\) AT, \(\#_{n}(e)\) = value of attribute \(n\) for event \(e\), it is also possible that event \(e\) has no attribute named \(n\), then \(\#_{n}(e)=\perp\)\((null)\) For understanding, the following standard attributes of \(e\) are considered:_  
* \(\#_{activity}\)__\((e)\) _is the activity associated with event_ \(e\)_._
* \(\#_{time}\)__\((e)\) _is the timestamp associated with event_ \(e\)_._
* \(\#_{resource}\)__\((e)\) _is the resource associated with event_ \(e\)_._
* \(\#_{trans}\)__\((e)\) _is the transaction type associated with event_ \(e\)_._  
**Definition 2** (Case, Trace). : _Let \(\kappa\) be the set of all possible case identifiers in an event log. Like events, cases can also be characterised by various attributes, e.g., an event may have an executor, an associated cost and time stamp._  
_For any case \(c\) in a given log, \(c\)\(\epsilon\)\(\kappa\) and name \(n\)\(\epsilon\) AT so \(\#_{n}(c)\) is a value of attribute \(n\) for \(c\)._  
_Each case has a mandatory attribute trace, \(\#_{trace}(c)\)\(\epsilon\)\(\theta^{*}\),_  
_A trace is a finite sequence of events \(\sigma\)\(\epsilon\)\(\theta^{*}\).