# A Goal-Oriented Evaluation Methodology for Privacy-Preserving Process Mining
## 4 Case Study
### Results Evaluation  
Our observations indicate that the implementation of privacy-preserving algorithms can yield a high degree of precision. However, elevated values for certain quality measures do not inherently indicate that the privacy-preserving algorithm maintains data utility, as its primary objective is to generate results that closely resemble the original data rather than to enhance the quality of the discovered models. At this stage, a specific instance of the GQM table is constructed based on the actual metric values, and the quantitative findings are systematically synthesized into responses addressing each question. (_Q1.1.1._) The findings reveal that as the value of \(k\) increases, a greater degree of generalization and suppression becomes necessary, leading to a reduction in the granularity of the trace data. Precision exhibits a more pronounced decline as the reduction in trace variety heightens the probability of the model accommodating unobserved behaviors, thereby leading to potential overgeneralization. In addition, since \(k\)-anonymity considers the contextual information, it is not scaled well for the event logs that include a higher number of instances. (_Q1.1.2._) The results show that precision diminishes as trace merging renders the discovered model more permissive, enabling the incorporation of behaviors that were not originally recorded in the log. However, for some event logs, generalization is adversely affected, as the suppression of low-frequency patterns diminishes the model's capacity to accommodate previously unseen yet plausible behaviors. In addition, since the \(l\)-diversity model considers the contextual information, it is not scaled well for the event logs that include a higher number of instances. (_Q1.1.2._) Our findings suggest that as the parameter \(t\) decreases, privacy is enhanced; however, the richness of trace-level behavioral patterns deteriorates, thereby adversely impacting the quality and expressiveness of the model's results. Generalization further declines as the omission of lower-frequency, nuanced behaviors diminishes the model's capacity to extend its applicability to previously unseen yet valid behavioral patterns. Also, for this model, the time performance did not scale well with respect to the number of instances. (_Q1.2.1._) As validated with the _PRETA_ PPPM model quality results, precision decreases over time, especially when the \(k\) parameter goes high. Thus, the more privacy is gained, the more utility decreases. In order to achieve higher \(k\)-values, the event log data are often generalized more. As the generalization increases, the data become less detailed, leading to a loss in precision. If the event log data have the maximum trace uniqueness percentage, _PRETA_ may be the right choice for privacy-utility trade-off. However, it did not show time performance efficiency for large event logs. (_Q1.2.2._) The _TLKC_ PPPM model needed higher trace uniqueness to produce optimum results due to the model's nature. Notably, despite the enforcement of stringent _TLKC_ constraints, certain anonymized event logs produced process models characterized by high precision. This phenomenon can be ascribed to the limited behavioral diversity present in the original log, as well as to the targeted influence of _TLKC_ on attribute-level generalization rather than on control-flow structures. In these cases, the prevailing trace variants are preserved, enabling the model to constrain behavior in a manner closely corresponding to the original log. (_Q2.1.1._) DP-Naive Bayes offers a viable approach to privacy-preserving classification, characterized by the following key attributes: effective for moderate \(\epsilon\) values and not ideal for strict privacy settings. On the other hand, due to exhibiting high computational efficiency, this model is particularly well suited for the rapid and cost-effective deployment of anonymized models.