On the exploitation of process mining for security audits

Accorsi, Rafael; Stocker, Thomas F.; Müller, Günter

doi:10.1145/2480362.2480634

Cited by 36 publications

(27 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…1. This model represents a realworld loan application management process, which has been defined and validated through interviews with the managers of a bank [2]. The results discussed in this section can hence be considered, to a certain extent, representative of the outcome that can be obtained in real-world contexts.…”

Section: Methodsmentioning

confidence: 99%

Subgraph Mining for Anomalous Pattern Discovery in Event Logs

Genga

Potena

Martino

et al. 2017

New Frontiers in Mining Complex Patterns

View full text Add to dashboard Cite

Abstract. Conformance checking allows organizations to verify whether their IT system complies with the prescribed behavior by comparing process executions recorded by the IT system against a process model (representing the normative behavior). However, most of the existing techniques are only able to identify low-level deviations, which provide a scarce support to investigate what actually happened when a process execution deviates from the specification. In this work, we introduce an approach to extract recurrent deviations and generate anomalous patterns from them, which are able to provide meaningful diagnostics of what happened in the system. To detect anomalous behaviors, we apply frequent subgraph mining techniques together with an ad-hoc conformance checking technique. Anomalous patterns are then derived by applying frequent items algorithms to determine highly-correlated deviations, among which ordering relations are inferred. The approach has been validated by means of a set of experiments.

show abstract

Section: Methodsmentioning

confidence: 99%

Subgraph Mining for Anomalous Pattern Discovery in Event Logs

Genga

Potena

Martino

et al. 2017

New Frontiers in Mining Complex Patterns

View full text Add to dashboard Cite

show abstract

“…Conformance checking is an analytic method seeking to identify differences between the process definition and process execution in reality [23]. The benefits of conformance checking to internal auditing are many, including fraud detection, monitoring required separation of duties, and process improvement [11,3]. The informational perspective of process mining highlights the relationship between the data consumed and produced during execution of business process tasks, but there is scant literature on exploiting this perspective of business process mining [17].…”

Section: Related Workmentioning

confidence: 99%

Information behaving badly

Ard

Bishop

Gates³

et al. 2013

Proceedings of the 2013 New Security Paradigms Workshop

View full text Add to dashboard Cite

Traditionally, insider threat detection has focused on observing human actors -or, more precisely, computer accounts and processes acting on behalf of those actors -to model their "normal" behavior, then determine if they have performed some anomalous action and, further, if that action is malicious. In this paper, we shift the paradigm from observing human behavior to observing information behavior by modeling how documents flow through an organization. We hypothesize that similar types of documents will exhibit similar workflows, and that a document deviating from its expected workflow indicates potential data leakage.

show abstract

“…The communication between both systems can be described using a choreography language, like BPEL. Besides, the distribution list can be created automatically according to the optimal distribution formulas mentioned in subsection VI [13] [14].…”

Section: ) the Fourth Pattern Is The Cloud Based Model Where All The mentioning

confidence: 99%

Constructing and monitoring processes in BPM using hybrid architectures

Garro¹,

Bazán²

2013

SpecialIssue

View full text Add to dashboard Cite

Abstract-With the entrance of BPM in the Cloud, a change in the conception and design of Business Processes has been produced. Distributed environments, in this context offer computing possibilities which are advantageous for processes, especially in a decomposition context. This last concept has been introduced in BPM allowing processes to be executed in a cloud environment as well as in an embedded one. This situation takes advantage of both approaches under criteria like sensitive data, high computing performance and system portability. An unexplored aspect in current bibliography is process monitoring over a decomposed environment. In the present article we introduce the analysis of some concepts presented in current bibliography, and we propose also the architecture for a distributed process monitoring system. In this architecture we consider different design factors like location transparency, and the data needed for instance tracking over a cloud system.

show abstract

On the exploitation of process mining for security audits

Cited by 36 publications

References 44 publications

Subgraph Mining for Anomalous Pattern Discovery in Event Logs

Subgraph Mining for Anomalous Pattern Discovery in Event Logs

Information behaving badly

Constructing and monitoring processes in BPM using hybrid architectures

Contact Info

Product

Resources

About