Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
log-distance-measures
Advanced tools
Python package with the implementation of different distance measures between two event logs, from the control-flow, temporal, and queuing perspectives.
Package available in PyPI: https://pypi.org/project/log-distance-measures/. Install it with:
pip install log-distance-measures
Python package with the implementation of different distance measures between two event logs, from the control-flow, temporal, and queuing perspectives:
import pandas as pd
from log_distance_measures.config import EventLogIDs
# Set event log column ID mapping
event_log_ids = EventLogIDs( # These values are stored in DEFAULT_CSV_IDS
case="case_id",
activity="Activity",
start_time="start_time",
end_time="end_time"
)
# Read and transform time attributes
event_log = pd.read_csv("/path/to/event_log.csv")
event_log[event_log_ids.start_time] = pd.to_datetime(event_log[event_log_ids.start_time], utc=True)
event_log[event_log_ids.end_time] = pd.to_datetime(event_log[event_log_ids.end_time], utc=True)
Distance measure between two event logs with the same number of traces (L1 and L2) comparing the control-flow dimension (see "Camargo M, Dumas M, González-Rojas O. 2021. Discovering generative models from event logs: data-driven simulation vs deep learning. PeerJ Computer Science 7:e577 https://doi.org/10.7717/peerj-cs.577" for a detailed description of a similarity version of this measure).
from log_distance_measures.config import DEFAULT_CSV_IDS
from log_distance_measures.control_flow_log_distance import control_flow_log_distance
# Call passing the event logs, and its column ID mappings
distance = control_flow_log_distance(
original_log, DEFAULT_CSV_IDS, # First event log and its column id mappings
simulated_log, DEFAULT_CSV_IDS, # Second event log and its column id mappings
)
Distance measure between two event logs computing the difference in the frequencies of the n-grams observed in the event logs (
being the n-grams of an event log all the groups of n
consecutive elements observed in it).
n
, get all sequences of n
activities (n-gram) observed in each event log (adding artificial activities to the start and
end of each trace to consider these as well, e.g., 0 - 0 - A
for a trace starting with A
and an n = 3
).A - B - C
in the first
event log w.r.t. its frequency in the second event log).from log_distance_measures.config import DEFAULT_CSV_IDS
from log_distance_measures.n_gram_distribution import n_gram_distribution_distance
# Call passing the event logs, and its column ID mappings
distance = n_gram_distribution_distance(
original_log, DEFAULT_CSV_IDS, # First event log and its column id mappings
simulated_log, DEFAULT_CSV_IDS, # Second event log and its column id mappings
n=3 # trigrams
)
Distance measure computing how different the histograms of the timestamps of two event logs are, discretizing the timestamps by absolute hour.
02/05/2022 10:00:00
and 02/05/2022 10:59:59
go to the same
bin).from log_distance_measures.absolute_event_distribution import absolute_event_distribution_distance
from log_distance_measures.config import AbsoluteTimestampType, DEFAULT_CSV_IDS, discretize_to_hour
# Call passing the event logs, its column ID mappings, timestamp type, and discretize function
distance = absolute_event_distribution_distance(
original_log, DEFAULT_CSV_IDS, # First event log and its column id mappings
simulated_log, DEFAULT_CSV_IDS, # Second event log and its column id mappings
discretize_type=AbsoluteTimestampType.BOTH, # Type of timestamp distribution (consider start times and/or end times)
discretize_event=discretize_to_hour # Function to discretize the absolute seconds of each timestamp (default by hour)
)
This EMD measure can be also used to compare the distribution of the start timestamps (with AbsoluteHourEmdType.START
), or the end
timestamps (with AbsoluteHourEmdType.END
), instead of both of them.
Furthermore, the binning is performed to hour by default, but it can be customized passing another function discretize the total amount of seconds to its bin.
import math
from log_distance_measures.absolute_event_distribution import absolute_event_distribution_distance
from log_distance_measures.config import AbsoluteTimestampType, DEFAULT_CSV_IDS, discretize_to_day
# EMD of the (END) timestamps distribution where each bin represents a day
distance = absolute_event_distribution_distance(
original_log, DEFAULT_CSV_IDS,
simulated_log, DEFAULT_CSV_IDS,
discretize_type=AbsoluteTimestampType.END,
discretize_event=discretize_to_day
)
# EMD of the timestamps distribution where each bin represents a week
distance = absolute_event_distribution_distance(
original_log, DEFAULT_CSV_IDS,
simulated_log, DEFAULT_CSV_IDS,
discretize_event=lambda seconds: math.floor(seconds / 3600 / 24 / 7)
)
Distance measure computing how different the discretized histograms of the arrival events of two event logs are.
02/05/2022 10:00:00
and 02/05/2022 10:59:59
go to the same
bin).from log_distance_measures.case_arrival_distribution import case_arrival_distribution_distance
from log_distance_measures.config import DEFAULT_CSV_IDS, discretize_to_hour
distance = case_arrival_distribution_distance(
original_log, DEFAULT_CSV_IDS, # First event log and its column id mappings
simulated_log, DEFAULT_CSV_IDS, # Second event log and its column id mappings
discretize_event=discretize_to_hour # Function to discretize each timestamp (default by hour)
)
Distance measure computing how different the histograms of the timestamps of two event logs are, comparing all the instants recorded in the same weekday together, and discretizing them to the hour in the day.
Extra 1: If there are no recorded timestamps for one of the weekdays in both logs, no distance is measured for that day. Extra 2: If there are no recorded timestamps for one of the weekdays in one of the logs, the distance for that day is set to 23 (the maximum distance for two histograms with values from 0 to 23)
from log_distance_measures.circadian_event_distribution import circadian_event_distribution_distance
from log_distance_measures.config import AbsoluteTimestampType, DEFAULT_CSV_IDS
distance = circadian_event_distribution_distance(
original_log, DEFAULT_CSV_IDS, # First event log and its column id mappings
simulated_log, DEFAULT_CSV_IDS, # Second event log and its column id mappings
discretize_type=AbsoluteTimestampType.BOTH # Consider both start/end timestamps of each activity instance
)
Similarly than with the Absolute Event Distribution Distance, the Circadian Event Distribution Distance can be also used to compare the
distribution of the start timestamps (with AbsoluteHourEmdType.START
), or the end timestamps (with AbsoluteHourEmdType.END
), instead of
both of them.
Distance measure computing how different the histograms of the relative (w.r.t. the start of each case) timestamps of two event logs are, discretizing the timestamps by absolute hour.
0
and 3599
go to the same bin).from log_distance_measures.config import AbsoluteTimestampType, DEFAULT_CSV_IDS, discretize_to_hour
from log_distance_measures.relative_event_distribution import relative_event_distribution_distance
# Call passing the event logs, its column ID mappings, timestamp type, and discretize function
distance = relative_event_distribution_distance(
original_log, DEFAULT_CSV_IDS, # First event log and its column id mappings
simulated_log, DEFAULT_CSV_IDS, # Second event log and its column id mappings
discretize_type=AbsoluteTimestampType.BOTH, # Type of timestamp distribution (consider start times and/or end times)
discretize_event=discretize_to_hour # Function to discretize the absolute seconds of each timestamp (default by hour)
)
Similarly than with the Absolute Event Distribution Distance, the Relative Event Distribution Distance can be also used to compare the
distribution of the start timestamps (with AbsoluteHourEmdType.START
), or the end timestamps (with AbsoluteHourEmdType.END
), instead of
both of them.
Distance measure computing how different the histograms of the number of active cases (computing the average active cases per window) of two event logs are.
01/01/2023 10:00:00
to
01/01/2023 10:59:59
).import pandas as pd
from log_distance_measures.config import DEFAULT_CSV_IDS
from log_distance_measures.work_in_progress import work_in_progress_distance
# Call passing the event logs, its column ID mappings, timestamp type, and discretize function
work_in_progress_distance(
original_log, DEFAULT_CSV_IDS, # First event log and its column id mappings
simulated_log, DEFAULT_CSV_IDS, # Second event log and its column id mappings
window_size=pd.Timedelta(hours=1) # Bins of 1 hour
)
Distance measure computing how different the cycle time discretized histograms of two event logs are.
import pandas as pd
from log_distance_measures.config import DEFAULT_CSV_IDS
from log_distance_measures.cycle_time_distribution import cycle_time_distribution_distance
distance = cycle_time_distribution_distance(
original_log, DEFAULT_CSV_IDS, # First event log and its column id mappings
simulated_log, DEFAULT_CSV_IDS, # Second event log and its column id mappings
bin_size=pd.Timedelta(hours=1) # Bins of 1 hour
)
FAQs
Python package with the implementation of different distance measures between two event logs, from the control-flow, temporal, and queuing perspectives.
We found that log-distance-measures demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.