User Activity Investigation of a Web CRM System Based on the Log Analysis

Transcription

1 User Activity Investigation of a Web CRM System Based on the Log Analysis Bogdan Trawiski and Marek Wróbel 1 1 Wrocław University of Technology, Institute of Applied Informatics, Wybrzee S. Wyspiaskiego 27, 5-37 Wrocław, Poland trawinski@pwr.wroc.pl, m.wrobel@icentrum.pl Abstract. There are many tools for the analysis of Web system log files based on statistical or web mining methods. However they do not always provide information specific for a given system. In the paper special method for investigation of the activity of web CRM system users is presented. The method has been designed and implemented in the web CRM system at a debt vindication company. There was basic foundation, that analysis should be carried in three time groups, i.e. working days in hours of work, working days beyond hours of work and idle days. Besides, system should make it possible to perform analysis for a chosen employee, position, day, hour and CRM system file. The results of investigation allowed to reveal anomalies in staff activity, what was not possible using common web log analyzer. 1. Introduction For years web logs have been the objects of numerous investigations which have provided valuable information used among others to assess quality of web site design, to trace user behaviour, to detect intrusions or adapt page content to user profiles [2,4,6,7,]. To carry research many tools and methods have been developed. These tools are based on statistical web log analysis and the methods of web log mining [1,5]. One of the most popular and rich in functions web log analyzers is the AWStats [3]. It enables to explore the logs of WWW, ftp and mail servers. Using the AWStats to investigate staff activity of a debt vindication company on the basis of Web CRM system logs has proved to be unsatisfactory [8]. So that, in order to obtain information needed by the company management, a new analytical module for the CRM system has been designed and implemented. Specific method has been elaborated to make it possible to compare the activity of individual employee and individual position with the average activity within an hour, a day, a month. 2. The Web CRM System Investigated The system investigated was a web CRM system used in a debt vindication company. The system has been designed specially for that company to meet its specific needs. It has been implemented using PHP script language and accommodated for cooperation

2 with Apache web server. It assures communication with PostgreSQL database management system. Therefore the system has an efficient database and functionality based on transactions and stored procedures. It has been deployed on the Linux operating system of Fedora distribution. The system consists of several functional modules: Communication announcement board, address book, phone book, document management, client, SMS gate, Office service clients, orders, meetings, Marketing client profitability analysis, company web site management, Accounting data exchange with the Videotel system, Call-center billings, Fax management incoming faxes, faxes sent, describing the content of faxes. Detailed data of the system usage have been collected from the start of its operation. Firstly, the Apache web server maintains logs of all requests. Its monthly logs are saved in text files of the size of approximately 5 MB. Secondly, the PHP code contains an audit procedure which is executed before each script. This procedure writes its own log which holds information of a user, data he sent to forms, etc. Results of exploration of data from the period of the month of May 24 contained in this log are discussed in the present paper. 3. Purpose and Method of the Analysis Analysis of the behaviour of employees is very important, because it provides a big amount of information which can be used to assess and compare their work as well as to find irregularities in their work. An anomaly takes place in such period of time, when an employee works otherwise than his colleagues or than he worked earlier. May be something wrong happens, for example a salesman intends to quit work and collects data of company clients. Important is also to know how heavily the system is used, because then it may be possible to prevent the situation, when overloaded system disturbs staff to work efficiently. The usage of the CRM system was explored using the AWStats analyzer [3]. However information delivered by the AWStats proved to be insufficient to analyze behaviour of employees [8]. In order to obtain information needed by the company management, a special module of analysis has been designed and programmed. There was basic foundation, that analysis should be carried in three time groups, i.e. working days in hours of work, working days beyond hours of work, idle days. In order to optimize the effectiveness of data processing, all data were aggregated for each hour of each day. Moreover, two fields were added to determine working days and working hours. In order to be able to compare data the measure of mean unit activity (MUA) was defined. The MUA is a number of file accesses within successive hour in a given day falling on one user operating this time. For example the MUA of 2 at sixteen o clock on May 6th means that the average number of file accesses per

3 one user within this hour was 2. The analysis was carried out for data for the period of May 24. Within this month the Web system was loaded heavily mainly during working days and the number of users was between 5 and 6. Every day the server received from 25 to 3 thousand requests, what generated 2-3 MB of data transfer. It means that for a working days there was approximately 1 request per second and the loading about KB. So the monthly data transfer reached 5 GB. 4. Results of the Investigation 4.1. The analysis of daily activity The purpose of first series of analysis was to show how the activity changed on a dayby-day basis within one month. Figures 1 and 2 show the distribution of activity (MUA) on working days in hours of work and working days beyond hours of work respectively. At first sight, it can be seen, that activity was unnatural big beyond hours of work on May 6 th w orking days in May 24 Fig. 1. Daily activity of whole staff during working days in hours of work in May w orking days in May 24 Fig. 2. Daily activity of whole staff during working days beyond hours of work Further analyses of the activity of work postings enabled to detect the position of work and the employee responsible for this anomaly (Fig. 3). In Figure 3 the dashed

4 line shows the activity of all postings while the continuous line presents the activity of the first posting only w orking days in May 24 Fig. 3. Daily activity of the first posting in May hours Fig. 4. Hourly activity of whole staff during work days in May The analysis of hourly activity The analysis provides information of what is the distribution of staff activity on individual hours of a day. Figure 4 shows how the activity changed on a hour-by-hour basis during working days in May 24. It can be easily noticed, that working day began at eight o clock and ended at sixteen o clock. The anomaly of greater activity at nineteen o clock can also be noticed. But the Figure 5 presenting hourly activity on May 6 th indicates the anomaly clearly. In the Figure 5 a continuous line shows the activity on a given day, while a dashed line presents an average activity within whole month. It can be seen that until seventeen o clock daily activity was similar to monthly one, but later it started to increase.

5 hours Fig. 5. Hourly activity of whole staff on May 6th The analysis of the activity of position, employee and file The analysis of the activity of position revealed that the activity of first position (negotiators) did not conform to the average activity. It led to the conclusion that exactly the negotiators were responsible for the anomaly. The graphs representing the behaviour of individual employees allowed to determine which negotiator worked abnormally. In turn the graph in Figure 6 indicated which files were used heavily that day. It turned out later, that instead of performing his usual work, the negotiator was describing the content of fax documents. number of uses Fig. 6. File activity on May 6th beyond working hours 5. Conclusions and Future Works All the tools and functions implemented to trace the behaviour of the company staff have proved to be useful. The anomalies could be detected and observed thoroughly. Due to the possibility to filter data and to compare individual data with average values, new information has been revealed. Such information was not available using common web log analyzer. The analysis carried separately for working days and idle days as well as for working hours has also turned out helpful. Using the measure of

6 mean unit activity (MUA) has produced statistics on which anomalies were shown clearly. It is planned to develop new analytical functions of our tools, as the possibility to define the range of days, hours, groups of employees and files. In order to make our investigations closer to human perception of time new fuzzy time periods have been designed. They are night, dawn, morning, lunch time, afternoon and evening. The definitions of the fuzzy time periods are shown in Figure 7. Besides, implementing of some intelligent mechanisms will enable us to detect anomalies automatically. degree of membership morning lunch time hours Fig. 7. Fuzzy definitions of time periods References 1. Ajith, A.: Business Intelligence from Web Usage Mining. Journal of Information & Knowledge Management 2 (23) Eirinaki M., Vazirgiannis M.: Web mining for web personalization. ACM Transactions on Internet Technology 3 (23) Free powerful and featureful tool that generates advanced web, ftp or mail server statistics, graphically (24) 4. Kruegel, C., Vigna, G.: Anomaly detection of web-based attacks. In Proceedings of the th ACM Conference on Computer and Communications Security (23) 5. Robertson, J.: The Value of Web Statistics (21) 222/km_2_27_2a.html 6. Srivastava, J., Cooley, R., Deshpande, M., Tan, P-T.: Web Usage Mining: Discovery and Applications of Usage Patterns from Web Data. SIGKDD Explorations 1 (2) Wong, C., Shiu, S., Pal, S.: Mining Fuzzy Association Rules for web access case adaptation. In Proceedings of the Workshop Program at the Fourth International Conference on Case- Based Reasoning (21) 8. Wróbel, M.: CRM Systems. Design and Implementation for a Chosen Company. M.Sc. Thesis (in Polish). Wrocław University of Technology (24). Zawitz, M. W.: Web statistics - Measuring user activity. Bureau of Justice Statistics (18)