## 3 Shift Time Clustering on Event Logs
Assume that  
* \(D(i,j)=\min(|t_{i}-t_{j}|,tr+\min(t_{i},t_{j})-\max(t_{i},t_{j}))\)
* \(D(j,k)=\min(|t_{j}-t_{k}|,tr+\min(t_{j},t_{k})-\max(t_{j},t_{k}))\)
* \(D(i,k)=\min(|t_{i}-t_{k}|,tr+\min(t_{i},t_{k})-\max(t_{i},t_{k}))\)  
Evidently, the above equation satisfies the triangularity based on Figure 4 below. We use the distance function described in Equation (1) in the self-organizing map (SOM) and \(k\)-means algorithms to cluster the resources based on shift work. \(k\)-means is used because of its simplicity and its speed computation. SOM is used because then the number of clusters does not have to be determined. This algorithm can help realize dimensionality reduction, which can be used to determine the number of clusters automatically. \(k\)-means is more restricted in that the number of clusters needs to be defined. However, \(k\)-means can be used to determine the number of clusters automatically by incorporating the elbow method. The basic idea of SOM and \(k\)-means is to group the data by calculating the Euclidian distance between several attributes of data and the groups (weight in SOM or centroid in \(k\)-means). To measure the Euclidian distance correctly, the distance between the group and each attribute of data should be on the same scale to avoid bias toward a specific attribute. Thus, researchers generally normalize and standardize the attributes to ensure that all the attribute data are on the same scale. In this study, we use data normalization to [0, 1] using the equation given in [16]. The limitation of the normalization based on the equation in [16] is that, if we consider the input as the time value (without date), the result will not be useful, and an incorrect distance may be generated. The distance between two different time values is calculated by considering the threshold value, as shown in Equation (1). To cope with this problem, we modified the value for the time attribute and normalized it after the distance between two different time values was calculated. The equation is as follows, where \(D(i,j)\) is the distance function from Equation (1), \(\max(D(i,j))\) is the maximum distance among the data (it is similar to \(x_{\max}-x_{\min}\), but the formula is different for time values), and \(Dn(i,j)\) is the distance value after it is normalized. For example, if the data are 1 and 23, then \(\max(D(i,j))\) is 2, but if the data are 1, 13, 23, then \(\max(D(i,j))\) is 12. Here, the largest \(\max(D(i,j))\) that could be obtained for any combination of the time value data is 12. \[Dn(i,j)=\frac{D(i,j)}{\max(D(i,j))} \tag{2}\]  
SOM is a neural-network-based clustering technique widely used for visualization and data reduction of high-dimensional data [17; 18]. SOM comprises \(m\) neurons located at a low-dimensional map representation that are generally spread across a 2-D map in \(x\) and \(y\) coordinates [19]. The two common types of topologies generally used in SOM are rectangular and hexagonal topologies [19]. Figure 4: Illustration of the equation for satisfying the triangle inequality. Each neuron \(i\) has a \(p\)-dimensional weight vector \(w_{i}=(w_{i1},w_{i2},\cdots,w_{ip})\), where \(i=1,2,3,...,m\), which has the same dimension as the input space. If we have \(N\) input data with a \(p\)-dimensional attribute vector, then the following steps describe the modified SOM algorithm based on the conventional SOM algorithm [20]:  
1. Set the maximum number of iterations, \(s\). 2. Initialize the weight vectors \(w_{i}\) for each neuron. 3. Randomly select an input vector \(x_{j}\) among \(n\) data and check its distance from each weight \(w_{i}(s)\) of neurons. We modified the Euclidian distance by separating the calculation of the data of each attribute based on its characteristics. The attribute data that need to be evaluated with time (time-dependent) are grouped together (start from \(p=1\) until \(dmTm\)), whereas the attribute data that do not need to be evaluated with time (not time-dependent) are grouped into different groups (start from \(p=dmTm+1\) until \(dm\)).