Computational Statistics & Data Analysis 51 (2007) 2670 – 2687 www.elsevier.com/locate/csda Discovery, visualization and performance analysis of enterprise workflow Ping Zhang a , Nicoleta Serban b, * a Data Analysis Research Department, Avaya Labs Research, 233 Mt. Airy Road, Basking Ridge, NJ 07920, USA b School of Industrial and Systems Engineering, Georgia Institute of Technology, Atlanta, GA, USA Received 12 May 2005; received in revised form 14 January 2006; accepted 14 January 2006 Available online 8 February 2006 Abstract This work was motivated by a recent experience where we needed to develop enterprise operational reports when the underlying business process is not entirely known, a common situation for large companies with sophisticated IT systems. We learned that instead of relying on human knowledge or business documentation, it is much more reliable to learn from the flow structure of event sequences recorded for work items. An example of work items are product alarms detected and reported to a technical center through a remote monitoring system; the corresponding event sequence of a work item is an alarm history, i.e. the alarm handling process. We call the flow of event sequences recorded for work items, workflow. In this paper, we developed an algorithm to discover and visualize workflows for data from a remote technical support center, and argue that workflow discovery is a prerequisite for rigorous performance analysis. We also carried out a detailed performance analysis based on the discovered workflow.Among other things, we find that service time (e.g. the time necessary for handling a product alarm) fits the profile of a log-mixture distribution. It takes at least two parameters to describe such a distribution, which leads to the proposed method of using two metrics for service time reporting. © 2006 Elsevier B.V.All rights reserved. Keywords: Business process rediscovery; Data visualization; Queueing system; Mixture model; Cure model 1. Introduction 1.1. Motivation In this study, we analyze data collected from the ticketing system used to support a business that specializes in the maintenance of communication equipments. Here, the work items are product alarms detected and reported to a technical support center through a remote monitoring system. Our goals are two-fold. First, we want to understand the structure of the workflow. In other words, we try to discover and reconstruct the underlying workflow by analyzing the event sequence data recorded for the product alarms. It is important to realize that the term workflow often means different things to different people. Here, we take an operational view where the discovered workflow represents how the system is actually used to route work items, whereas workflow in the * Corresponding author. Tel./fax: +14043857255. E-mail address: nserban@isye.gatech.edu (N. Serban). 0167-9473/$ - see front matter © 2006 Elsevier B.V. All rights reserved. doi:10.1016/j.csda.2006.01.008