Process Mining and Security: Detecting Anomalous Process Executions and Checking Process Conformance

Abstract

One approach to secure systems is through the analysis of audit trails. An audit trail is a record of all events that take place in a system and across a network, i.e., it provides a trace of user/system actions so that security events can be related to the actions of a specific individual or system component. Audit trails can be inspected for the presence or absence of certain patterns. This paper advocates the use of process mining techniques to analyze audit trails for security violations. It is shown how a specific algorithm, called the α-algorithm, can be used to support security efforts at various levels ranging from low-level intrusion detection to high-level fraud prevention.

Secure and Compliant Implementation of Business Process-Driven Systems

“…There are several lines of related work, among them the development of support for system audits, e. g., by integrating analysis techniques such as [2,4]. In particular, process mining approaches appear to be particularly interesting: combing process mining with our business process animation, i. e., the visualization of attack traces, allows for interactively investigation deviations of the actual process execution with the intended one.…”

Improving Analysis and Visualizing of JVM Profiling Logs Using Process Mining

“…However, all event logs have one thing in common: they show occurrences of events at specific moments in time, where each event refers to a specific process and an instance thereof, i.e. a case (Van Der Aalst & De Medeiros, 2005).…”

“…ProM framework (De Medeiros et al, 2005) is a pluggable environment for process mining. Since each system has its own format for output log files, ProM framework works with a generic XML formats like MXML and XES (Van Der Aalst & Van Der Aalst, 2011).…”

“…ProM framework is a pluggable environment for process mining. This framework is flexible with respect to the input and output format, and is also open enough to allow for the easy reuse of code during the implementation of new process mining ideas (De Medeiros et al, 2005). This paper is mainly concerned with profilers that provide information about java program or JVM (HotSpotTM); these profilers mainly have three phases: collecting data, analyzing data and visualizing results.…”

Process Mining and Verification of Properties: An Approach Based on Temporal Logic

“…In [11] the results are extended to include time aspects. The notion of conformance has also been discussed in the context of security [4], business alignment [2], and genetic mining [26].…”