E-business becomes an international business that covers and extends all over the world. It is necessary to find a suit framework and form to preserve the stakeholder’s rights and ethics. Financial institutions should support E-business processes to maximize profits while maintaining a degree of ethics. Ethics is a set of behaviors and principles that focus on values and moral feels, while morality is the implementation and translation of ethics into tangible acts and activities [1]. The rising number of available web services results in the need to facilitate web service presented to consumers to specify their required specification services. Different platforms are required to publish, view and compare services in order to enhance organizational profit [2]. Different semantic web services are proposed to define the automatic services by providing semantic descriptions with additional mechanisms to model services.

Social network sites provide a large dataset to predict major opportunities, challenges and enhancing interactive online business operations [3]. Through the revolution of technologies, E-business applications become the most important and popular way to share data between users [4]. The rapid development in technical and production mechanisms and processes, lead to update and develop the E-business and engineering activities.

Enhancing and predicting E-business operations depends mainly on managing and organizing the web server log of the E-business framework. Organizing the web server log operations can enhance and improve the process of user tracing to predict user behavior.

The web server log files collect webpage request history information in chronological order. Typically, the collected and stored information includes client IP, client name, request date and time, server site name, server computer name, server IP, server port, client server method, client serves URL stream, client server URL query, server client status, server client win32 status, server client bytes, the client server bytes, time taken, client server version, client server host, user agent, cookies, and the referring URL. In [5], these data are divided into different classes that are general statistics, software warning and system failure, safety instructions, approval of program execution, and Time-based functions. In [6], the challenges associated with that information have been identified. These challenges include merging extraneous information with useful ones, generating multiple server requests by a single user action, and the lack of recording local activities. The general characteristics of web log files are mentioned in [7].

This paper proposes a set of satisfaction relations to formalize rules that can trace and record different E-business processes. An event universe of quintuple parameters is presented to determine a complete tracing mechanism for predicting user behavior. The organization of the paper is as follows: Section 2 presents a set of related work in the field of E-business. In Section 3, we propose satisfaction relations to be applied to the log file. In Section 4, we present an event universe mechanism to trace all user actions with a set of formula patterns. In Section 5, we present a counting methodology based on the proposed event universe to record the frequency of the performed user actions that can lead to better user behavior prediction. In Section 6, the methodology for improving the user tracing processes is presented. In Section 7, we conduct the experimental results using clustering and classification algorithms on different data sets. In Section 8, the conclusion with recent points to be used in future works is introduced.

The role of E-business engineering in developing a new framework can provide more facilities to improve the cooperation between the company and consumer. E-business engineering can improve and develop systems optimization, security, privacy, and trust in systems. The main risks and challenges that may be faced are how to preserve the quality of services during its growth with respect to some security challenges or risks about keeping user’s data and information safe and preserving their privacy. As a result, the more accurate forecasting gives a more effective strategy and ameliorates the predicted situation [8]. Managers play a huge role in improving the firms of their business, by well understanding and evaluating the true market value of a firm’s security activity that will help them make the right market decisions [9]. The main important and required factor is how to formalize the log file so that all user records can be traced which can lead to a better expectation of user behavior [10].

To improve the performance, elasticity, maintainability, reusability, and scalability of the E-business, a three-layer E-business architecture is established. These layers are the presentation layer, business logic layer, and data layer; each layer has its responsibilities and role [11]. As well, they are used to record all user operations into a web server log or a log file.

The following subsections highlight key aspects of the web server log regarding its role and classifications, state-of-the-art mechanisms for analyzing the web server log, and the most recent researches that apply data mining and machine learning techniques to enhance prediction from data in the web server log.

In the E-business architecture, there are different processes or operations that can be executed during user transactions. For predicting user behavior, a log file is created based on different event actions. As presented in [35], most of the systems do not fully utilize the web serve log that contains all previously recorded information of user activities. As presented in Tab. 1, all user processes are recorded in the pre-defined log file based on different event categories. The browsing process (B) is based on viewing different items in the E-business structure levels. The action process is based on revising (R), payment (P), and executing (E) user transactions. Returning items (RI) are considered a major action in the E-business structure if there are defects in the items. There are other main actions to the administrator of the web service such as adding, removing, and modifying posts (AP), (RP), and (MP) respectively on the web service.

For recording all user actions in the log file, a set of satisfaction processes should be defined for recording user operations. These satisfaction processes are considered an extension to [32,36] that proposed different LTL formula patterns for enhancing E-business structure performance. A satisfaction relation ⊨ is defined to verify whether a specific formula is correct or not.

Let ρ is the total propositions of event actions. Consider f₁ and f₂ are two formula patterns that evaluates the relationship between each two actions in the event universe.

Let σ is the tracing process for both formula patterns f₁ & f₂. The satisfaction relation ⊨ is defined based on the following rules:

Rule 1: 6⊨¬f1 if ¬(6⊨f1) means that the formula pattern f₁ may not be executed in the event universe.

Rule 2: 6⊨f1∩f2 if 6⊨f1 and 6⊨f2 means that the tracing process will be based on both formula patterns f1&f2.

Rule 3: If 6⊨Xf1 then 6⊨f2 where X is the preceding function. This means that the formula pattern f₂ will be executed if the preceding formula pattern f₁ is being executed.

Rule 4: 6⊨f1∪f2 means that at least 6⊨f1 or 6⊨f2 must be executed in the event universe.

Information systems-related application of E-business is applied based on event logs for determining the number of occurrences that an action may be performed by a user. In an event log, each executed process constitutes a condition. All actions related to this condition will be traced and recorded in the log file. To record all event actions, an event universe e is defined based on the following definition:

Definition 1 (Event Universe e): an event universe e based on quintuple parameters is presented in the following formula:

(1) e=(u,c,l,t,a)∀e∈U×C×L×T×A

where:

u is the user of the action under consideration.

As presented in [36], the E-business structure is based on different levels for presenting items and sub-items.

Based on the presented event universe and the several user processes, the statistical analysis of the overall processes will be based on the following definitions:

Definition 2 (Browsing Analysis): the percentage of browsing process (B_i) in the E-business web service is based on identifying the browsing process in the event universe e.

(2) ∀Bi∈e and v⊂l such that l∈l1,l2,…,ln

Definition 3 (Revise Analysis): the overall revise processes (R_i) must be analyzed based on the formula:

(3) ∀Ri∈e such that %Ri=%v∩%R

Definition 4 (Payment Analysis): the payment process (P_i) must be executed once the revise process is true. No payment process can be executed without revising processes. As a result, the payment must be executed with intersecting revise with browsing, revising, and payment processes based on the formula:

(4) ∀Pi∈e such that %Pi=%v∩%R∩%P

Definition 5 (Execute Analysis): as proposed in previous definitions, the execute process (E_i) must be followed by browsing, revise, payment processes based on the following formula:

(5) ∀Ei∈e such that %Ei=%v∩%R∩%P∩%E

Definition 6 (Rollback Analysis): the returning item (RI_i) mechanism has a Boolean parameter whether the item may be returned back or not. The RI_i must satisfy the condition that all preceding processes must be executed based on the formula:

(6) ∀RIi∈e such that %RIi=%v∩%R∩%P∩%E∩%RI

Based on the previous definitions, different activities can be traced as part of the event stream. As shown in Fig. 1, a visual event stream is proposed for analyzing user actions. Each trace Id represents a set of subsequent activities based on the quintuple parameters (u,c,l,t,a). As shown in Fig. 1, all E-business transactions are recorded starting from the browsing service at different levels with the assumption that the categories of the proposed E-business structure are embedded into four levels as presented in [36]. The remaining processes are revising, payment, executing, rolling back the process, adding post service, modifying post service, and removing post service.

Assuming that the E-business structure is based on four levels of categories, each browsing level k must be preceded by a browsing level i. As presented in Tab. 2, a set of event log tracing processes is recorded. Each distinct event log is called a trace with different activities based on the structure of the web service. As shown in Tab. 2, each trace process has a trace id, and the sequence of corresponding activities. Each activity is associated with the final action of the user behavior. For example, for a user who performs an E-business process until execution action, the user can perform different browsing processes, then perform the payment actions as shown in trace id 7 and 8. A timestamp is added to view the specific time for each tracing mechanism.

The web server log is converted into a set of web event logs and is conceptually divided into event blocks (EB) with a width w such that:

(7) w=plen

where: p is the total number of processes in the event log and len is the length parameter.

The basic structure of the user process counting is a set of entries of the form (e,u,δ) where:

e is an event action of the log stream that can be categorized based on the user behavior.

As shown in Tab. 3, a user process counting mechanism is performed to record all user behavior on behalf of the frequency of each E-business process. The MAC address is recorded with the username of the user, the action type, and the action frequency δ.

The main objective of this paper is to improve the quality of predicting user activities based on the event log of two different data sets. These datasets are the Online Shoppers Purchasing Intention [37,38] and the Instacart Market Basket Analysis dataset of Kaggle [39]. As presented in Fig. 2, the proposed mechanism is based on applying different clustering algorithms such as density-based clustering, farthest first cluster, EM cluster and K-mean cluster. These methods groups similar objects into the same cluster. After applying the clustering algorithms, a set of classifications algorithms are applied to measure the predicted classes on the clustered data.

As presented in Fig. 2, the event log tracing is applied on both datasets and a clustering process is performed before the classification process for enhancing the performance of the user tracing process over infinite user transactions. The objective of applying clustering algorithms is to determine similar objects into a set of groups called clusters. The objects that are similar to each other are grouped into the same cluster for maximizing the intra-class similarity. In order to validate the proposed mechanism, two distinct datasets are applied on the clustering and classification algorithms to measure the accuracy of the algorithms in predicting and enhancing user behavior tracing activities. The first clustering-classification mechanism is applied by performing the clustering process using the Farthest First cluster algorithm [40], Expectation Maximization (EM) cluster algorithm [41], and K-mean cluster algorithm [42]. The clustered results are applied on eight classification algorithms: Bayes Net [43], Naïve Bayes [43], K* [44], Filtered Classifier [45], Decision Table [43], JRip algorithm [46], J48 [47], and Logistic Model Tree (LMT) [48]. The second clustering-classification mechanism is applied by performing the clustering process using density-based clustering [49]. The clustered results are embedded with five classification algorithms: Support Vector Machine (SVM) [50], Logistic Regression (LR) [51], K-nearest neighbor (KNN) [52], Random Forest (RF) [53], and Logistic Model Tree (LMT) [48]. Different performance metrics are used to measure and compare all clustering-classification results. The True Positive (TP) rate is used to measure the predicted classes correctly while the False Positive (FP) rate is incorrectly predicting the positive classes. The TP and FP are presented in Eqs. (8) and (9) as follows:

(8) TPR=TPTP+FN

where, TPR is the prediction of true positive classes into which the true positive classes are divided by the sum of both true positive and false negative classes.

(9) FPR=FPFP+TN

where, FPR is the prediction of false positive classes into which the false positive classes are divided by the sum of both false positive and true negative classes.

The Precision of the dataset is measured by dividing the true positive predictions by the true positive and false positive predictions as shown in Eq. (10):

(10) Precision=TPTP+FP

The Recall of the dataset is measured by dividing the true positive predictions by the true positive and false negative predictions as shown in Eq. (11):

(11) Recall=TPTP+FN

The F₁-Measure ratio is measured using the mean of both precision and recall as shown in Eq. (12):

(12) F1-Measure=2×Precision×RecallPrecision+Recall

The classifier accuracy is measured by the percentage of classes that were predicted correctly while the classifier error rate is the percentage of incorrect predicted classes as shown in the Eqs. (13) and (14).

(13) ClassifierAccuracy=(TP+TN)(TP+TN+FP+FN)

(14) ClassifierErrorRate=(FP+FN)(TP+TN+FP+FN)

The experimental results are conducted on two datasets: Online Shoppers and Instacart. Different clustering and classification algorithms are applied to measure the performance and accuracy of predicting user behavior and user tracing processes. The results are explained as follows:

E-business transactions are now necessary during the development of information systems and their related technologies. With the increasing need to develop different methods to deal with the intensity of business transactions, the log file that records all user processes must be well formulated to best utilize all transactions in the shortest possible time. Many research papers enhance the E-business structure in explaining business services without developing and enhancing a well-designed web server log that can record all user records. This paper proposed an event stream mechanism that can organize and record user and customer transactions based on a set of formula patterns. The paper visualizes an even stream to explore the overall enhanced tracing mechanism. The proposed mechanism is based on applying different clustering algorithms such as density-based clustering, farthest first cluster, EM cluster and K-mean cluster. After applying the clustering algorithms, a set of classifications algorithms are applied to measure the predicted classes on the clustered data. The experimental results proved high efficiency in improving user tracing processes and predicting user behavior in acquiring future products. Some enhancements can be applied to the proposed mechanism by adding mean-shift and agglomerative hierarchical clustering algorithms with the same classification algorithms and datasets to verify the efficiency of the user tracing processes.