Applying Process Mining Techniques to DNS Traces Analysis

Bustos-Jiménez, Javier; Saint-Pierre, Cecilia; Graves, Alvaro

doi:10.1109/sccc.2014.9

Cited by 5 publications

(7 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A research to study the DNS traces using process mining instead of traditional statistical approach has been presented [39]. One distinctive feature is the representation of type of each message as a node; this is different from the usual way of representing the data where each host is a node and the messages are represented as edges.…”

Section: Research Resultsmentioning

confidence: 99%

“…One distinctive feature is the representation of type of each message as a node; this is different from the usual way of representing the data where each host is a node and the messages are represented as edges. This data representation could also be applied to other types of data workflows, such as HTTP and SSH negotiation [39]. This could give a new insights into how much implementations differ from the standards, as well as into discovering or detecting different types of attacks [39].…”

Section: Research Resultsmentioning

confidence: 99%

“…This data representation could also be applied to other types of data workflows, such as HTTP and SSH negotiation [39]. This could give a new insights into how much implementations differ from the standards, as well as into discovering or detecting different types of attacks [39]. It is planned to study how this graph representation of DNS traces can be analysed by process mining and other technologies to discover new patterns and behaviours that are hard to identify otherwise: Different types of attacks may lead to different types of graphs [39].…”

Section: Research Resultsmentioning

confidence: 99%

“…This could give a new insights into how much implementations differ from the standards, as well as into discovering or detecting different types of attacks [39]. It is planned to study how this graph representation of DNS traces can be analysed by process mining and other technologies to discover new patterns and behaviours that are hard to identify otherwise: Different types of attacks may lead to different types of graphs [39]. Obtaining this information in real time or near real time could provide more information to take specific countermeasures to avoid the attack, whether by automatic or manual systems [39].…”

Section: Research Resultsmentioning

confidence: 99%

“…It is planned to study how this graph representation of DNS traces can be analysed by process mining and other technologies to discover new patterns and behaviours that are hard to identify otherwise: Different types of attacks may lead to different types of graphs [39]. Obtaining this information in real time or near real time could provide more information to take specific countermeasures to avoid the attack, whether by automatic or manual systems [39]. Similar to [39], an approach in using Passive Testing (used in protocol and software conformance checking) and Process Mining (used in enterprise workflow analysis) techniques for analysing DNS operation traces has been presented [44].…”

Section: Research Resultsmentioning

confidence: 99%

See 4 more Smart Citations

Systematic review on process mining and security

Kelemen¹

2018

ocg

View full text Add to dashboard Cite

Security is an important issue that every organisation should address. One approach to secure systems could be the use of process mining techniques. Process mining is an emerging discipline which can extract knowledge from event logs that are available in information systems. In the security context, process mining is used to analyse security trails to detect anomalies in process execution. While some of the data mining projects are already implemented in banking, insurance and telecom sector the interesting question is: What is happening in public sector? This paper investigates the research on process mining techniques in security domain and tries to discover the examples of its implementation especially in public sector. The systematic review has been conducted in order to give an overview of state-of-the-art process mining techniques used in security context, to classify the main areas of development, algorithms, tools and to identify possible future research course.

show abstract

Section: Research Resultsmentioning

confidence: 99%

Section: Research Resultsmentioning

confidence: 99%