## 3 Shift Time Clustering on Event Logs
The quality of cluster \(C_{i}\) can be measured using the within-cluster variation, which is the sum of squared errors (SSEs) between all the objects in \(C_{i}\) and the centroid \(c_{i}\), defined as follows:  
\[SSE=\sum_{i=1}^{k}\sum_{x\in C_{i}}\left(||x-c_{i}||\right)^{2} \tag{9}\]  
If the data consist of a dataset containing \(N\) observations and \(k\) is the number of clusters, the \(k\)-means algorithm operates based on the following procedure, where \(x^{j}\) is each datum contained in the dataset and \(c^{j}\) is the centroid label cluster for datum \(x^{j}\):  
* Arbitrarily choose \(k\) objects from the data as the initial cluster centers. * Assign each object to the cluster to which the object is the most similar, based on the mean value (centroid) of the objects in the cluster. We use the same distance function described in Equation (3), but the term weight (\(w\)) is changed to mean (\(\mu\)). * Update the cluster mean--that is, calculate the mean value of the objects for each cluster. For each \(i\) cluster, we modified the cluster mean updating by incorporating an incremental average. The incremental average is used because, by averaging the time value, we could not compute the mean directly for all the values. We must evaluate the average value one by one for each element, as shown in Equations (10) and (11), where \(A_{n}\) refers to the \(n\)th element among the elements that will be averaged. \[\mu_{i,p}= \begin{cases}\frac{\sum_{j=1}^{n}\{c^{j}=i\}\cdot x_{j}^{j}}{\sum_{j=1} ^{n}1\{c^{j}=i\}},&p\text{ is not time-dependent}\\ \muinc_{i,p}-tr,&p\text{ is time-dependent}\wedge\muinc_{i,p}(s)\geq tr\\ tr-\muinc_{i,p},&p\text{ is time-dependent}\wedge\muinc_{i,p}(s)\leq 0\end{cases}  \tag{10}\]  
\[disp_{x_{i,p},w_{i,p}}= \begin{cases}A_{n-1}+\frac{x_{p}^{n}-A_{n-1}}{n},&0 \leq|x_{p}^{n}-A_{n-1}|\leq 12\\ A_{n-1}-\frac{D(x_{p}^{n}-A_{n-1})}{n},&x_{p}^{n}-A_{n-1}>12\\ A_{n-1}+\frac{D(x_{p}^{n}-A_{n-1})}{n},&x_{p}^{n}-A_{n-1}<-12\end{cases}  \tag{11}\]  
4. Repeat steps b to c until the stopping criteria are found (for example, the cluster member is not changed). Several methods to define the number of clusters in \(k\)-means exist, such as the elbow method, gap statistic, silhouette coefficient, canopy, [PERSON]'s information criterion, and the Monte Carlo technique [23; 24]. As mentioned previously, we employed the elbow method to determine the number of cluster \(k\) in \(k\)-means clustering. Generally, the elbow method is based on the subjective visualization of the user. However, in this study, we performed the elbow method without subjective visualization. The elbow method used in this study is based on the method described in [24], using the square of the distance between the sample points in each cluster and the centroid of the cluster. In our case, the square of the distance between the sample points in each cluster and the centroid of the cluster is based on the SSE formula in Equation (9). Our program will monitor the SSE value for each increment of the \(k\) cluster and detect the place at which a rapid decline occurs, similar to the paper [25], but by using [PERSON]'s formula. The shift work generated based on our approach is conducted based on the clustering method. There is also interesting research conducted by other researchers that tried to mine the resource availability by considering the temporal perspective [26]. Our approach is different from the existing method in that our method is using not only specific on the single resource but aggregating the resource shift work using clustering. Our resource focuses on humans who usually work based on shift time. We are using a clustering method, so by incorporating the shift mining, the resource that only recorded a short time in the event log because of the limited job assigned to him/her will be automatically grouped into the quite similar cluster.