Abstract: A method of generating process trace clusters includes receiving a set of process traces, where a process trace is an application level event log from a computer system; receiving an identification of node types and edge types of the application event log to generate a heterogeneous information network (HIN) graph, where a temporal node type value is a difference between a current system time and a reference timestamp divided by a user chosen time granularity parameter, performing dimension reduction of the HIN to generate clusters of new event types, generating a set of meta-paths that connect nodes of a same reduced event type in the application event log, calculating similarities between process traces using the new event type clusters, and clustering the set of process traces to generate a plurality of disjoint graph models of processes in the application event log based on the clusters of new event types.

Abstract: A method of generating process trace clusters includes receiving a set of process traces, where a process trace is an application level event log from a computer system; receiving an identification of node types and edge types of the application event log to generate a heterogeneous information network (HIN) graph, where a temporal node type value is a difference between a current system time and a reference timestamp divided by a user chosen time granularity parameter, performing dimension reduction of the HIN to generate clusters of new event types, generating a set of meta-paths that connect nodes of a same reduced event type in the application event log, calculating similarities between process traces using the new event type clusters, and clustering the set of process traces to generate a plurality of disjoint graph models of processes in the application event log based on the clusters of new event types.

Abstract: A computer-implemented method of generating process models from process event logs, including receiving an identification of node types and edge types of an application event log to generate a heterogeneous information network graph of the application event log, where node types include events and traces, where each trace is a finite sequence of event type nodes; reducing a number of event types of the set of input traces to generate clusters of new event types; and clustering the set of input traces to generate a plurality of disjoint partitions based on the clusters of new event types, where the clustering maximizes an average fitness of each partition and minimizes an average complexity of each partition, where each partition is a graph model of a process in the application event log.