Process mining and security: detecting anomalous process executions and checking process conformance

W.M.P. Aalst, van der, A.K. Alves De Medeiros

Research output: Contribution to journalArticleAcademicpeer-review

88 Citations (Scopus)
2 Downloads (Pure)

Abstract

One approach to secure systems is through the analysis of audit trails. An audit trail is a record of all events that take place in a system and across a network, i.e., it provides a trace of user/system actionssothatsecurityeventscanberelatedtotheactionsofaspecific individual or system component. Audit trails can be inspected for the presence or absence of certain patterns. This paper advocates the use of process mining techniques to analyze audit trails for security violations. It is shown how a specific algorithm, called the a-algorithm, can be used to support security efforts at various levels ranging from low-level intrusion detection to high-level fraud prevention.
Original languageEnglish
Pages (from-to)3-21
JournalElectronic Notes in Theoretical Computer Science
Volume121
Publication statusPublished - 2005

Fingerprint Dive into the research topics of 'Process mining and security: detecting anomalous process executions and checking process conformance'. Together they form a unique fingerprint.

Cite this