TY - GEN
T1 - Multi instance anomaly detection in business process executions
AU - Böhmer, Kristof
AU - Rinderle-Ma, Stefanie
N1 - Publisher Copyright:
© Springer International Publishing AG 2017.
PY - 2017
Y1 - 2017
N2 - Processes control critical IT systems and business cases in dynamic environments. Hence, ensuring secure model executions is crucial to prevent misuse and attacks. In general, anomaly detection approaches can be employed to tackle this challenge. Existing ones analyze each process instance individually. Doing so does not consider attacks that combine multiple instances, e.g., by splitting fraudulent fund transactions into multiple instances with smaller “unsuspi-cious” amounts. The proposed approach aims at detecting such attacks. For this, anomalies between the temporal behavior of a set of historic instances (ex post) and the temporal behavior of running instances are identified. Here, temporal behavior refers to the temporal order between the instances and their events. The proposed approach is implemented and evaluated based on real life process logs from different domains and artificial anomalies.
AB - Processes control critical IT systems and business cases in dynamic environments. Hence, ensuring secure model executions is crucial to prevent misuse and attacks. In general, anomaly detection approaches can be employed to tackle this challenge. Existing ones analyze each process instance individually. Doing so does not consider attacks that combine multiple instances, e.g., by splitting fraudulent fund transactions into multiple instances with smaller “unsuspi-cious” amounts. The proposed approach aims at detecting such attacks. For this, anomalies between the temporal behavior of a set of historic instances (ex post) and the temporal behavior of running instances are identified. Here, temporal behavior refers to the temporal order between the instances and their events. The proposed approach is implemented and evaluated based on real life process logs from different domains and artificial anomalies.
KW - Multiple instances
KW - Runtime anomaly detection
KW - Secure business processes
KW - Temporal anomalies
UR - https://www.scopus.com/pages/publications/85048500931
U2 - 10.1007/978-3-319-65000-55
DO - 10.1007/978-3-319-65000-55
M3 - Conference contribution
AN - SCOPUS:85048500931
SN - 9783319649993
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 77
EP - 93
BT - Business Process Management - 15th International Conference, BPM 2017, Proceedings
A2 - Baltag, Alexandru
A2 - Seligman, Jeremy
A2 - Yamada, Tomoyuki
PB - Springer Verlag
T2 - 15th International Conference on Business Process Management, BPM 2017
Y2 - 10 September 2017 through 15 September 2017
ER -