Process Mining and Security: Visualization in Database Intrusion Detection

Process mining in healthcare: A literature review

Insider threats have gained prominence and pose the most challenging threats to a database system. In this paper, we have proposed a new approach for detecting intrusive attacks in databases by fusion of information sources and use of belief update. In database intrusion detection, only intra-transactional features are not sufficient for detecting attackers within the organization as they are potentially familiar with the day-to-day work. Thus, the proposed system uses inter-transactional as well as intra-transactional features for intrusion detection. Moreover, we have also considered three different sensitivity levels of table attributes for keeping track of the malicious modification of the highly sensitive attributes more carefully. We have analyzed the performance of the proposed database intrusion detection system using stochastic models. Our system performs significantly better compared to two intrusion detection systems recently proposed in the literature.

Data stream management systems (DSMSs) are conceived for running continuous queries (CQs) on the most recently streamed data. This model does not completely fit the needs of several modern data-intensive applications that require to manage recent/historical/static data and execute both CQs and OTQs joining such data. In order to cope with these new needs, some DSMSs have moved toward the integration of database management systems (DBMSs) functionalities to augment their capabilities. In this paper we adopt the opposite perspective and we lay the groundwork for extending DBMSs to natively support streaming facilities. To this end, we introduce a new kind of table, the streaming table , as a persistent structure where streaming data enters and remains stored for a long period, ideally forever. Streaming tables feature a novel access paradigm: continuous writes and one-time as well as continuous reads. We present a streaming table implementation and two novel types of indices that efficiently support both update and scan high rates. A detailed experimental evaluation shows the effectiveness of the proposed technology.

combining with the data mining application in database intrusion detection, for the most representative association rule Apriori algorithm in the data mining technology, this paper presents an improved association rule algorithm, based on which constructs a database intrusion detection system on the basis of association rules, and carries out a small range test. Experimental results show that the system can greatly improve the efficiency of the entire intrusion detection process.

This exploratory study analyzes student behavior in a Massive Open Online Course (MOOC). MOOCs represent a global educational phenomenon transforming teaching and inspiring new research perspectives on learning methods in higher education institutions. Understanding how students organize their learning sequences and how these relate to their academic performance is crucial for optimizing digital educational processes. The objective of this study is to identify and characterize the learning sequences performed by students during their study sessions in a MOOC, using process mining (PM) techniques. The methodology involved analyzing a dataset collected between July 2017 and January 2018, comprising 27,922 students and approximately 3.5 million recorded interactions. Process mining techniques were employed to examine these learning sequences. Results indicate that most interactions correspond to assessments and video lectures, while forums were the least utilized activity. Additionally, two student profiles were identified: “Comprehensive” learners, who follow expected sequences and engage in longer, more intensive study sessions, and “Strategic” learners, who prioritize assessments. This study advances the current understanding of online learning and situates its findings within the broader literature by contrasting them with similar classification patterns reported by other authors.

In many applications, the information required by the user cannot be found in just one source, but has to be retrieved from many varying sources. This is true not only of formatted data in database management systems, but also of textual documents and multimedia data, such as images and videos. We propose a mediator system that provides the end-user with a single query interface to an integrated view of multiple heterogeneous data sources. We exploit the capabilities of the MOMIS integration system and the MILOS multimedia data management system. Each multimedia source is managed by an instance of MILOS, in which a collection of multimedia records is made accessible by means of similarity searches employing the query-by-example paradigm. MOMIS provides an integrated virtual view of the underlying multimedia sources, thus offering unified multimedia access services. Two features are that MILOS is flexible--it is not tied to any particular similarity function--and the MOMIS's mediator query processor only exploits the ranks of the local answers.

Semantics has been a major challenge when applying the process mining (PM) technique to real-time business processes. The several theoretical and practical efforts to bridge the semantic gap has spanned the advanced notion of the semantic-based process mining (SPM). Fundamentally, the SPM devotes its methods to the idea of making use of existing (semantic) technologies to support the analysis of PM techniques. In principle, the semantic-based process mining method is applied through the acquisition and representation of abstract knowledge about the domain processes in question. To this effect, this paper demonstrates how the semantic concepts and process modelling (reasoning) methods are used to improve the outcomes of PM techniques from the syntactic to a more conceptual level. To do this, the study proposes an SPM-based framework that shows to be intelligent with a high level of semantic reasoning aptitudes. Technically, this paper introduces a process mining approach that uses information (semantics) about different activities that can be found in any given process to make inferences and generate rules or patterns through the method for annotation, semantic reasoning, and conceptual assertions. In turn, the method is theoretically applied to enrich the informative values of the resultant models. Also, the study conducts and systematically reviews the current tools and methods that are used to support the outcomes of the process mining as well as evaluates the results of the different methods to determine the levels of impact and its implications for process mining.

Process mining techniques enable the analysis of a wide variety of processes using event data. For example, event logs can be used to automatically learn a process model (e.g., a Petri net or BPMN model). Next to the automated discovery of the real underlying process, there are process mining techniques to analyze bottlenecks, to uncover hidden inefficiencies, to check compliance, to explain deviations, to predict performance, and to guide users towards “better” processes. Dozens (if not hundreds) of process mining techniques are available and their value has been proven in many case studies. However, existing techniques focus on the analysis of a single process rather than the comparison of different processes. In this paper, we propose comparative process mining using process cubes. An event has attributes referring to the dimensions of the process cube. Through slicing, dicing, rolling-up, and drilling-down we can view event data from different angles and produce process mining results that can be compared. To illustrate the process cube concept, we focus on educational data. In particular, we analyze data of students watching video lectures given by the first author. The dimensions of the process cube allow us to compare the process of students that passed the course versus the process of students that failed. We can also analyze differences between male and female students, between different parts of the course, and between Dutch students and international students. The initial analysis provided in this paper is used to elicit requirements for better tool support facilitating comparative process mining.

Very powerful data base management systems (DBMS) now exist which allow medical personnel access to patient record data bases. DBMS's make it easy to retrieve either complete or abbreviated records of patients with similar characteristics. In addition, statistics on data base records are immediately accessible. However, the price of this power is a large computer with the inherent problems of access, response time, and reliability. If a general purpose, time-shared computer is used to get this power, the response time to a request can be either rapid or slow, depending upon loading by other users. Furthermore, if the computer is accessed via dial-up telephone lines, there is competition with other users for telephone ports. If either the DBMS or the host machine is replaced, the medical users, who are typically not sophisticated in computer usage, are forced to learn the new system. Microcomputers, because of their low cost and adaptability, lend themselves to a solution of these problems. A microprocessor-based intelligent terminal has been designed and implemented at the USAF School of Aerospace Medicine to provide a transparent interface between the user and his data base. The intelligent terminal system includes multiple microprocessors, floppy disks, a CRT terminal, and a printer. Users interact with the system at the CRT terminal using menu selection (framing). The system translates the menu selection into the query language of the DBMS and handles all actual communication with the DBMS and its host computer, including telephone dialing and sign on procedures, as well as the actual data base query and response. Retrieved information is stored locally for CRT display, hard copy production, and/or permanent retention. Microprocessor-based communication units provide security for sensitive medical data through encryption/decryption algorithms and high reliability error detection transmission schemes. Highly modular software design permits adapation to a different DBMS and/or host computer with only minor localized software changes. Importantly, this portability is completely transparent to system users. Although the terminal system is independent of the host computer and its DBMS, it has been linked to a UNIVAC 1108 computer supporting MRI's SYSTEM 2000 DBMS.

Process mining-driven analysis of COVID-19’s impact on vaccination patterns

Security is an important issue that every organisation should address. One approach to secure systems could be the use of process mining techniques. Process mining is an emerging discipline which can extract knowledge from event logs that are available in information systems. In the security context, process mining is used to analyse security trails to detect anomalies in process execution. While some of the data mining projects are already implemented in banking, insurance and telecom sector the interesting question is: What is happening in public sector? This paper investigates the research on process mining techniques in security domain and tries to discover the examples of its implementation especially in public sector. The systematic review has been conducted in order to give an overview of state-of-the-art process mining techniques used in security context, to classify the main areas of development, algorithms, tools and to identify possible future research course.

Data Warehouses (DWs) are used for producing business knowledge and aiding decision support. Since they store the secrets of the business, securing their data is critical. To accomplish this, several Database Intrusion Detection Systems (DIDS) have been proposed. However, when using DIDS in DWs, most solutions produce either too many false-positives (i.e., false alarms) that must be verified or too many false-negatives (i.e., true intrusions that pass undetected). Moreover, many approaches detect intrusions a posteriori which, given the sensitivity of DW data, may result in irreparable cost. To the best of our knowledge, no DIDS specifically tailored for DWs has been proposed. This paper examines intrusion detection from a data warehousing perspective and the reasons why traditional database security methods are not sufficient to avoid intrusions. We define the specific requirements for a DW DIDS and propose a conceptual approach for a real-time DIDS for DWs at the SQL command level that works transparently as an extension of the Database Management System (DBMS) between the user applications and the database server itself. A preliminary experimental evaluation using the TPC-H decision support benchmark is included to demonstrate the DIDS’ efficiency.

This paper gives an overview of relevant research in the area of process mining. Process mining techniques are able to extract knowledge from event logs. The major objective of process mining is to discover, monitor and improve real processes. Process mining aims to exploit event data in a meaningful way to identify and anticipate problems, and recommend countermeasures. Additionally, process mining places the existing massive volumes of data in the context of processes. Since extracting data is an integral part of any process mining procedure, data preparation or data pre-processing requires certain efforts. Examples have been given to indicate how the chosen process mining technique deals with incompleteness in the event log data. Experiments have been made on the real data collected from information system for accommodation services.

Process Mining is one research area to find useful information from various processes in business execution log data. As BPMS, ERP, SCM, etc so called process recognizing information system are widely spread, process mining research are getting emphasis recently. Also execution log data of one enterprise are frequently utilized for checking current status of management or analysis of resource efficiency. But since analysis result depends on measurement criteria and method, it is very important to select systematic process mining algorithm based on business model or enterprise strategy. In this paper many process mining techniques are introduced and compared using process mining tool, ProM.

Increasingly organizations are using process mining to understand the way that operational processes are executed. Process mining can be used to systematically drive innovation in a digitalized world. Next to the automated discovery of the real underlying process, there are process-mining techniques to analyze bottlenecks, to uncover hidden inefficiencies, to check compliance, to explain deviations, to predict performance, and to guide users towards “better” processes. Dozens (if not hundreds) of process-mining techniques are available and their value has been proven in many case studies. However, process mining stands or falls with the availability of event logs. Existing techniques assume that events are clearly defined and refer to precisely one case (i.e. process instance) and one activity (i.e., step in the process). Although there are systems that directly generate such event logs (e.g., BPM/WFM systems), most information systems do not record events explicitly. Cases and activities only exist implicitly. However, when creating or using process models “raw data” need to be linked to cases and activities. This paper uses a novel perspective to conceptualize a database view on event data. Starting from a class model and corresponding object models it is shown that events correspond to the creation, deletion, or modification of objects and relations. The key idea is that events leave footprints by changing the underlying database. Based on this an approach is described that scopes, binds, and classifies data to create “flat” event logs that can be analyzed using traditional process-mining techniques.