Combining Abstract Argumentation and Machine Learning for Efficiently Analyzing Low-Level Process Event Streams

This contribution proposes a data-efficient neuro-symbolic approach that combines a machine learning sequence tagger with an abstract argumentation framework to precisely interpret low-level process event streams and refine candidate interpretations using prior knowledge, thereby overcoming the limitations of data scarcity and computational complexity.

The Gist

Imagine you are trying to understand a story, but instead of the actual plot, you only have a list of raw, low-level actions.

The Problem: The "Translation" Gap
Consider the workflow of a hospital patient. A computer log might record a sequence of tiny, specific actions: "Patient touched," "Blood drawn," "Pressure measured," "Needle inserted." These are the low-level events.

However, a doctor or manager does not want to see a list of tiny actions; they want to know the high-level story: "Preparation," "Inpatient Admission," and "Pre-Operative."

The problem is that a tiny action (like "Blood drawn") could occur in any of these three major phases. It is like seeing a character in a film pick up a cup. Are they drinking coffee before a meeting? Pouring tea for a guest? Or are they just cleaning up? Without context, it is a guessing game. If you guess wrong, the entire narrative of patient care becomes confused.

The Old Approaches
The paper describes two earlier ways to solve this problem, both of which had shortcomings:

1. The "Strict Rulebook" Approach (Abstract Reasoning):
   Imagine a very strict, logical detective who knows all the hospital rules.

   • Rule: "Before surgery, inpatient admission must occur."
   • Rule: "You cannot start pre-operative procedures if preparation is not completed."
     This detective checks every possible story against the rules. If a story breaks a rule, it is discarded.
   • The Shortcoming: Sometimes the rules are too loose. The detective might say: "Well, technically this could be an inpatient admission, or it could be a pre-operative phase, or it could be preparation." The detective gives you a huge list of 50 possibilities. It is accurate, but it is overwhelming and slow to compute.

2. The "Pattern Recognition" Approach (Machine Learning):
   Imagine a student who has read thousands of past patient stories.

   • How it works: The student sees "Blood drawn" and recalls: "Ah, in 80% of the stories I read, this happened during inpatient admission."
   • The Shortcoming: This student needs a massive library of past stories to learn. If the student hasn't seen enough examples, they might guess wrong. Furthermore, they do not know the strict rules. They might guess "Pre-Operative" for a "Blood drawn" event, even though the rules state that pre-operative procedures cannot happen yet.

The New Solution: The "Neuro-Symbolic" Team
The authors propose a collaboration between the strict detective (Reasoner) and the pattern recognition system (Machine Learning). They call this a "neuro-symbolic" approach.

Here is how they work together in real time:

1. The First Attempt: The pattern recognition algorithm (Machine Learning) looks at the current event and the history of what happened before. It says: "I am 80% sure this is an inpatient admission, 15% preparation, and 5% pre-operative." It provides a sorted list of the most likely stories.
2. The Reality Check: The strict detective (Reasoner) takes this short list and checks it against the hard rules.
   • "Wait," says the detective. "The rules state that pre-operative procedures cannot happen yet. So this 5% estimate is impossible. I will cross it out."
   • "Also," adds the detective, "the rules state that you cannot have two inpatient admissions in a row. So this 15% estimate is also invalid."
3. The Final Answer: The system presents the user with only the valid options, sorted by the probability the pattern recognition algorithm assigned to them.

Why This Is a Big Deal
The paper claims that this collaboration solves the weaknesses of the old methods:

• It is faster and clearer: Instead of the detective giving you 50 confusing possibilities, the pattern recognition algorithm reduces this to the top 3, and the detective simply confirms which of these 3 are legal. You receive a short, sorted list of the best answers.
• It works with less data: The pattern recognition algorithm usually needs thousands of examples to learn well. But since the strict detective is there to correct errors, the pattern recognition algorithm does not need to be perfect. Even if the student hasn't read many books, the detective can still prevent them from making silly mistakes. The paper's experiments show that this team performs significantly better than the student alone, even with very few training examples.
• It explains "Why": If the system rejects an idea, the detective can explain why (e.g., "I rejected 'Pre-Operative' because the rules state that 'Preparation' must happen first").

In Short
The paper introduces a system that combines the intuition of a machine learning model (based on patterns) with the logic of a rule-based system (which checks against facts). This creates a tool that is intelligent enough to guess the right story, fast enough to do so in real time, and strict enough to ensure the story makes sense according to the rules. It is particularly useful when you do not have enough past examples to teach a computer everything on its own.

Technical Summary

Technical Summary: Combining Abstract Argumentation and Machine Learning for Efficient Analysis of Low-Level Process Event Streams

1. Problem Definition

The work addresses the challenge of Log Aggregation in Process Mining, specifically the interpretation of low-level event streams into high-level business activities. In many modern scenarios (e.g., Smart Factories, Healthcare), process traces consist of raw, low-level actions (events) that do not exhibit a direct, one-to-one mapping to high-level process activities. Instead, there is often a many-to-many relationship between event types and activity types, creating an "abstraction gap."

This gap leads to an interpretation problem: it must be determined which high-level activity instance generated a specific low-level event. Existing solutions face two primary limitations:

1. Knowledge-based approaches (e.g., Abstract Argumentation Frameworks or AAFs) can handle complex constraints and provide explanations, but often yield too many plausible interpretations with loose constraints, leading to information overload and high computational costs.
2. Example-based approaches (e.g., supervised Machine Learning sequence taggers) can rank probable interpretations but frequently fail when training data is scarce, noisy, or insufficient to capture complex process behaviors, and they lack mechanisms to enforce strict domain constraints or provide logical explanations for rejected interpretations.

The work proposes a neuro-symbolic approach to combine the strengths of both paradigms: Machine Learning (ML) provides context-aware, probabilistic candidate interpretations, while abstract argumentation refines these candidates based on formal domain knowledge to ensure validity and provide explanations.

2. Methodology

The proposed framework integrates two distinct AI components: a Trace Tagger (ML) and an AAF-based Reasoner (Symbolic).

2.1 Components

• The Trace Tagger (M): A sub-symbolic Machine Learning model (specifically a sequence tagging model) trained on annotated log traces. It predicts a probability distribution over possible activities for a current event $e_{curr}$, considering the context of previous events in the trace. Two architectures were tested:
  • $M_A$: An LSTM-based architecture capturing sequential dependencies.
  • $M_B$: A Deep Neural Network (DNN) architecture using fixed windows of event embeddings.
• The AAF-based Reasoner (R): A knowledge-based module based on Abstract Argumentation Frameworks. It encodes:
  • Type-level mappings: Relationships between event types and activity types (including lifecycle phases such as first, intermediate, last).
  • Declarative process models: Temporal constraints (e.g., must, not, precedence) defined over activity instances.
    The reasoner constructs an AAF where arguments represent candidate interpretations and attacks represent conflicts with domain knowledge. Valid interpretations correspond to the preferred extensions of the AAF.

2.2 The Hybrid Workflow (Online Analysis)

The core contribution is an interactive, online algorithm (Algorithm 1) that incrementally processes a running trace:

1. Initial Update: The reasoner updates its internal AAF with all candidate interpretations derived from global type-level mappings.
2. ML Prediction: The Trace Tagger $M$ predicts a probability distribution $p_d$ for the current event $e_{curr}$ based on the trace context.
3. Knowledge-based Revision: The reasoner $R$ filters the ML predictions. Any activity classified as invalid by domain knowledge (i.e., not present in a valid interpretation of the AAF) is assigned a probability of zero.
4. Smoothing and Normalization: To prevent the ML model from assigning a probability of zero to all valid candidates, a Laplace-like smoothing procedure is applied to the remaining probabilities, which are then normalized.
5. AAF Refinement: The reasoner rebuilds the AAF using only activities with non-zero probabilities (the Top-$k$ candidates). This significantly reduces the search space for the argumentation solver.
6. Output: The system presents the user with a ranked list of the most probable valid interpretations and enables interactive queries (e.g., "Is this event the start of activity A?") as well as explanations for why other interpretations were rejected.

3. Main Contributions

The work claims two main contributions:

1. Improved Interpretation via Ranking: By leveraging data-driven knowledge, the approach presents event interpretations in a ranked, partial form (Top-$k$), thereby addressing the information overload problem inherent in pure reasoning approaches with loose constraints.
2. Improved Data Efficiency: By utilizing process model knowledge (constraints), the approach improves the performance of example-based aggregation methods in scenarios where annotated training data is scarce or insufficient to learn a tight characterization of the process.

The authors position this as a neuro-symbolic strategy where the ML model serves as a "Learning for Reasoning" mechanism to accelerate exploration, while the reasoner acts as a "Reasoning for Learning" mechanism to correct and validate ML predictions.

4. Experimental Results

Experiments were conducted on synthetic datasets (inspired by a real process of an Italian regional authority) with varying trace lengths and different levels of mapping uncertainty (many-to-many relationships).

• Accuracy and Robustness: The hybrid approach (Tagger + Reasoner) consistently outperformed both the Tagger alone and the Reasoner alone in terms of accuracy, precision, recall, and F1-score. Notably, the reasoner significantly boosted performance when the Tagger performed poorly (e.g., due to a complex architecture like $M_A$ or limited data).
• Data Efficiency: In experiments where the size of the training dataset was reduced (from 100% to 20%), the hybrid approach maintained significantly higher accuracy than the Tagger alone. The performance curve of the hybrid method was much flatter, demonstrating robustness against data scarcity.
• Reduction of Information Overload: The approach significantly reduced the number of candidate interpretations an analyst must consider. For traces of length 60, the reduction in information overload (measured as the difference in rank position of the correct activity) exceeded 20 alternatives compared to using the reasoner alone.
• Computation Time: Although the hybrid approach is slower than the Tagger alone (due to the reasoning step), the average prediction time remained around 1 second, which is considered feasible in the context of business process analysis. The computational cost of the Tagger itself was negligible compared to the reasoning process.

5. Significance and Novelty

The work claims that this represents the first attempt to use a neuro-symbolic approach in the Process Mining context for interactive exploratory analysis of low-level traces.

Key distinguishing features compared to existing neuro-symbolic solutions include:

• Constraint Scope: The behavioral constraints encompass both input variables (past events) and output variables (current event), whereas many existing approaches only constrain the output.
• Runtime Enforcement: Constraints are enforced during the runtime of the interpretation session, not during model training. This enables flexibility, allowing users to change constraints without retraining the ML model.
• Query Capabilities: The framework supports expressive, process-oriented queries and provides explanations for rejected interpretations, going beyond simple probability estimates or sample generation.

The authors conclude that this framework advances the state of the art by enabling effective Human-in-the-Loop cooperation, combining the speed and context awareness of ML with the reliability and explainability of symbolic reasoning, particularly in complex engineering applications where data may be limited or processes loosely structured.

6. Limitations and Future Work

The authors acknowledge that the approach relies on the availability of domain knowledge (constraints). If constraints are too few or absent, the reasoner cannot effectively guide the tagger. Additionally, even the hybrid approach may struggle if annotated data is extremely scarce.

Directions for future work include:

• Semi-supervised Learning: Utilizing unlabeled log traces with entropy-regularization loss to improve tagger training.
• Active Learning: Developing strategies to select the most informative unlabeled traces for expert annotation to improve the tagger model.
• Probabilistic Constraints: Investigating mechanisms to directly incorporate probabilistic domain knowledge (e.g., "Activity A follows B in 80% of cases") into the AAF, as the current framework handles only deterministic constraints.