the idea is to observe an ECS in a controlled environment
for a certain period of time, and in this way, to obtain a
HLL generated by click path observation. The trained ECSEA
model can then be used to transform historic or future LLL
into (previously unknown) HLLs. This is possible because it
can be assumed that the LLL behavior of the ECS of the same
instance will not change over time. For other instances of the
same system type or for systems of a different vendor, the
observation can be repeated if the system configuration is too
different or customized.
In the remainder, Section II introduces ECS event logs
and outlines their characteristics. Section III reviews EA
approaches in the context of ECS logs. Section IV presents
the ECSEA approach, which is evaluated in Section V. We
conclude with a discussion in Section VI.
II. DATA UNDERSTANDING: ECS LOGS
In this section, the log characteristics of ECS are described.
First, we demonstrate an event log of HCL Connections as
an example (II-A). Then, we outline its special characteristics
(II-B).
A. ECS Event Log Example
ECS commonly use relational databases to store event logs.
Table I shows an excerpt of a corresponding event log table
of HCL Connections.
TABLE I: ECS LL log excerpt
ID USER_UUID ITEM_UUID C_ID EVENT_TS EVENT_NAME
104 33d689884-ef3... 072adbbd-715... 1337 2021-11-11 10:47:16 file.file.created
105 33d689884-ef3... 072adbbd-715... 1337 2021-11-11 10:47:17 file.collection.file.added
106 84f5d4ae2-434... 08441212-343... 1337 2021-11-11 10:47:18 wiki.page.created
107 33d689884-ef3... 072adbbd-715... 1337 2021-11-11 10:47:19 files.file.notification.set
108 84f5d4ae2-434... 08441212-343... 1337 2021-11-11 10:47:20 wiki.page.follow
109 33d689884-ef3... - 1337 2021-11-11 10:48:18 community.visit
110 65788ec84-a12... 08441212-343... 1337 2021-11-11 10:51:11 wiki.page.updated
111 65788ec84-a12... 08441212-343... 1337 2021-11-11 10:51:12 wiki.page.tag.added
112 33d689884-ef3... 08441212-343... 1337 2021-11-11 10:56:44 wiki.page.updated
In total, this particular database table contains 16 attributes.
For brevity, we reduced the example to the six most essential
attributes. Each event record is identified by a unique ID. The
log documents the user who initiated the event (USER_UUID),
the modified or created content item (ITEM_UUID), the
workspace in which the event occurred (C_ID), the timestamp
(EVENT_TS) and an activity (EVENT_NAME). The IDs in the
event log can be resolved to human-readable descriptors using
additional dimension tables. More details about ECS logs can
be found in related work on social collaboration analytics [17].
The log excerpt in Table I documents that a user was
uploading a file while another user was creating a wiki page
at the same time. Later, the first user updated the file and
created a comment to that file. This small example illustrates
some of the challenges for the interpretation of user activity
when using the LLL of HCL Connections. Although the first
user carried out only one activity (uploading a file), the log
recorded two additional events (adding the file to a collection
and setting a notification). For interpretation in the context
of PM, only the first event (104) is relevant as this event
represents the user’s intended action. The follow-up events
(105, 107) are tasks automatically performed by the system
(and they may occur in changing orders). However, they are
associated with the user. Such event sequences where multiple
LL events are recorded for one actual activity lead to spaghetti
models. Moreover, LL events are not distinct to only one
specific HL activity but can be part of different HL activities
(example see below). Furthermore, HCL Connections contains
more than 250 different LL activities. This is also an indicator
for the need to reduce the number of activities to the ones
that are useful for the interpretation of user activity. In ECS
event logs, certain events may have no meaning at all for
later interpretation. For instance, the activity community.visit
(e.g., event 109) occurs over and over again, while it does not
contribute to the understanding of the actual process. Given
this example event log as the first impression of an ECS event
log, the following subsection shows problems and challenges
that may occur in such event logs.
B. ECS Event Log Characteristics
As demonstrated in the example above, multiple LL events
can belong to one HL activity. We also observed that their
occurrence might differ depending on other events or previous
user activities (e.g., some activities are only triggered once
during a session). The following list summarizes the charac-
teristics and challenges with ECS LLLs in the context of PM.
While single mentions of some of these challenges were found
in related work [6], [18]–[20] and occur in traditional event
logs, ECS event logs contain all of the following challenges
at the same time:
C1 Multiple LL events: Particular HL events may result
in multiple LL events. Thus, a HL activity may be
expressed by multiple LL activities. Furthermore, a
particular HL activity may be expressed by different sets
of LL activities. Example: The LL events 104, 105 and
107 should be combined into one HL event.
C2 Overlapping events: Multiple LL events that are related
to two (or more) HL events may overlap temporally.
Moreover, the interval between the time-stamps of mul-
tiple LL events that are triggered by an activity is not
always the same. Example: The LL events 104, 105 and
107 (HL event A) and the LL events 106 and 108 (HL
event B) are overlapping.
C3 Different LL event ordering: The ordering of the LL
events might vary slightly. This is because the under-
lying system performs tasks independently so that other
activities may be logged first. Example: The LL sequence
⟨104, 105, 107⟩ may also occur as ⟨104, 107, 105⟩, while
both cases belong to the same HL event.
C4 Multiple LL to HL activity mappings: A LL activity
may be triggered by multiple HL activities. Thus, it is
possible that a LL activity is part of more than one map-
ping. This characteristic represents an m:n mapping. Ex-
ample: The HL activity gws.wiki.wikiarticle.tag.created
is composed of the LL activities wiki.page.updated and
wiki.page.tag.added (events 110 & 111). However, the
LL activity wiki.page.updated (event 112) is also part
of the HL activity gws.wiki.wikiarticle.updated.