Using Subsequence Mining to Identify Business Processes in Data Networks

Contents

1. Introduction

2. Motivation

2.1. Background

2.2. Related Work

2.3. Challenges

2.4. Requirements

3. Network Service Dependency Discovery

3.1. Technical Description

3.1.1. Network Model

3.1.2. Network Dependency Analysis

3.1.3. Business Processes

3.2. Implementation

3.2.1. Flow Extraction

3.2.2. Subnetwork Identifier

3.2.3. Potential Indirect Dependency Generator

3.2.4. Indirect Dependency Calculator

3.2.5. Stream-based MONA

3.2.6. Representation of Tasks

4. Evaluation

4.1. Ground Truth

4.1.1. Threshold Estimation

4.1.2. Validation of Threshold

4.2. Comparative Evaluation

4.2.1. Orion

4.2.2. Sherlock

4.2.3. NSDMiner

4.2.4. Sensitivity Analysis

4.2.5. MONA versus Orion

5. Conclusion

5.1. Summary

5.2. Future Work

A. Appendix

Objectives and Thematic Focus

The main objective of this work is to develop and implement a novel automated approach, called MONA (Mission Oriented Network Analysis), to identify business processes within corporate data networks by analyzing network traffic patterns, thereby overcoming the limitations of traditional process mining techniques that rely on event logs.

• Automated identification of business processes in network environments.
• Analysis of low-level communication patterns (header information) rather than application event logs.
• Utilizing normalized cross-correlation for identifying indirect service dependencies.
• Graphical representation of discovered business processes using BPMN (Business Process Modelling Notation).
• Evaluation of system precision and scalability through simulated network scenarios.

Excerpt from the Book

Summary of Chapters

1. Introduction: Presents the motivation for automated business process management and outlines the limitations of existing log-based mining techniques.

2. Motivation: Discusses background, related research in network dependency discovery, challenges in the field, and defines core requirements for the proposed approach.

3. Network Service Dependency Discovery: Details the technical framework, network modeling, identification of dependencies, implementation of core modules, and the representation of tasks using BPMN.

4. Evaluation: Explains the validation of the model through simulations and provides a comparative analysis against existing tools like Orion, Sherlock, and NSDMiner.

5. Conclusion: Summarizes the key contributions of the work and proposes potential future developments, particularly regarding Intrusion Detection Systems.

Keywords

Business Process Management, Process Mining, Network Service Dependency, MONA, Data Networks, Communication Patterns, Normalized Cross Correlation, BPMN, Indirect Dependency, Traffic Analysis, Network Modeling, Subnetwork Identification, Scalability, Automated Discovery, Task Dependency.

Frequently Asked Questions

What is the core purpose of this Master's thesis?

The thesis aims to facilitate the identification of business processes in large companies by analyzing network traffic instead of relying on application-level event logs, which are often unavailable or insufficient.

What are the primary thematic fields covered?

The work integrates knowledge from IT, management sciences, and network engineering, focusing on network service dependency discovery and process mining.

What is the main research question or goal?

The primary goal is to show that automated identification of business processes is tractable using polynomial-time algorithms that analyze communication patterns in network traffic.

Which scientific methodology is employed?

The author designs a model called MONA (Mission Oriented Network Analysis) that utilizes normalized cross-correlation to identify direct and indirect dependencies between network services based on communication patterns.

What are the key contents of the main part?

The main part covers the formal definition of network models and tasks, the technical implementation of four modules (flow extractor, subnet identifier, dependency generator, and calculator), and a comprehensive evaluation of the model against other approaches.

Which keywords best characterize the research?

Key terms include Business Process Management, Process Mining, Network Dependency Discovery, MONA, Traffic Analysis, and Normalized Cross Correlation.

How does the author handle potential false positives in dependency discovery?

The author uses an "Indirect Dependency Calculator" module that employs normalized cross-correlation against a robust threshold (0.85) to filter out incorrectly identified indirect dependencies.

Why does the author prioritize network traffic over application logs?

Many modern applications lack standardized log files, or log files are too technical/cumbersome for business analysts to interpret; network traffic, however, is universally available and contains actionable communication patterns.

How does MONA visualize the discovered business processes?

The system maps identified dependencies to the Business Process Modelling Notation (BPMN) standard, providing a high-level, intuitive view for business analysts.