Process mining is a sub-field of data mining that focuses on analyzing timestamped and partially ordered data. This type of data is commonly called event logs. Each event is required to have at least three attributes: case ID, task ID/name, and timestamp to apply process mining techniques. Thus, any missing information need to be supplied first. Traditionally, events collected from different sources are manually correlated. While this might be acceptable in an offline setting, this is infeasible in an online setting. Recently, several use cases have emerged that call for applying process mining in an online setting. In such scenarios, a stream of high-speed and high-volume events continuously flow, e.g. IoT applications, with stringent latency requirements to have insights about the ongoing process. Thus, event correlation must be automated and occur as the data is being received. We introduce an approach that correlates unlabeled events received on a stream. Given a set of start activities, our approach correlates unlabeled events to a case identifier. Our approach is probabilistic. That implies a single uncorrelated event can be assigned to zero or more case identifiers with different probabilities. Moreover, our approach is flexible. That is, the user can supply domain knowledge in the form of constraints that reduce the correlation space. This knowledge can be supplied while the application is running. We realize our approach using complex event processing (CEP) technologies. We implemented a prototype on top of Esper, a state of the art industrial CEP engine. We compare our approach to baseline approaches. The experimental evaluation shows that our approach outperforms the throughput and latency of the baseline approaches. It also shows that using real-life logs, the accuracy of our approach can compete with the baseline approaches.

Events produced from business process execution need identification of process instance. With the lack of a central execution, it is hard to correlate these events to specific cases. Monitoring business processes is useful in conformance checking, compliance enforcement, risk management, and performance analysis. However, all these techniques and approaches need a set of correlated events. We present an approach to fill the gap in real life situations, between execution of unmanaged events and the stack of techniques and approaches that need labeled events at runtime to generate further analysis. This approach works on the unlabeled events, either online (as a stream of events) or offline (as a batch file of events). It deduces the case identifier for each unlabeled event, and displays the results of possible case identifiers with their rankings. Also the generated events can be filed in different event logs with different rankings to be further analyzed by other techniques and approaches.