Obstructions in Security-Aware Business Processes

This Open Access book explores the dilemma-like stalemate between security and regulatory compliance in business processes on the one hand and business continuity and governance on the other. The growing number of regulations, e.g., on information security, data protection, or privacy, implemented in increasingly digitized businesses can have an obstructive effect on the automated execution of business processes. Such security-related obstructions can particularly occur when an access control-based implementation of regulations blocks the execution of business processes. By handling obstructions, security in business processes is supposed to be improved. For this, the book presents a framework that allows the comprehensive analysis, detection, and handling of obstructions in a security-sensitive way. Thereby, methods based on common organizational security policies, process models, and logs are proposed. The Petri net-based modeling and related semantic and language-based research, as well as the analysis of event data and machine learning methods finally lead to the development of algorithms and experiments that can detect and resolve obstructions and are reproducible with the provided software

BProVe: A formal verification framework for business process models

Business Process Modelling has acquired increasing relevance in software development. Available notations, such as BPMN, permit to describe activities of complex organisations. On the one hand, this shortens the communication gap between domain experts and IT specialists. On the other hand, this permits to clarify the characteristics of software systems introduced to provide automatic support for such activities. Nevertheless, the lack of formal semantics hinders the automatic verification of relevant properties. This paper presents a novel verification framework for BPMN 2.0, called BProVe. It is based on an operational semantics, implemented using MAUDE, devised to make the verification general and effective. A complete tool chain, based on the Eclipse modelling environment, allows for rigorous modelling and analysis of Business Processes. The approach has been validated using more than one thousand models available on a publicly accessible repository. Besides showing the performance of BProVe, this validation demonstrates its practical benefits in identifying correctness issues in real models

The Design of Graphical Process Modeling Languages: from Free Composition to Modular Construction

Un Process Modeling Language (PML) grafico \ue8 un linguaggio specializzato per la modellazione di sistemi software in termini di processi. Tale linguaggio \ue8 detto grafico perch\ue8 la rappresentazione principale dei modelli consiste in diagrammi ottenuti combinando costrutti grafici e componenti precedentemente definiti. Un Process-Aware Information System (PAIS) \ue8 un sistema software guidato da modelli di processi con lo scopo di coordinare e supportare gli agenti nello svolgimento delle loro attivit\ue0. Tale sistema \ue8 responsabile della gestione simulatanea di diverse istanze di processo e del bilanciamento delle risorse disponibili. Un PML \ue8 l'interfaccia principale di un PAIS ed un aspetto fondamentale della sua progettazione, poich\ue8 \ue8 utilizzato da utenti finali, consulenti, e sviluppatori al fine di comprendere, implementare ed eseguire processi complessi. L'utilizzo di tecnologie PAIS pu\uf2 essere considerevolmente limitato dalle carenze di un PML nel descrivere casi complessi. Lo scopo principale della tesi \ue8 migliorare la progettazione di PML grafici al fine di costruire PAIS pi\uf9 efficaci. Tale obiettivo \ue8 perseguito attraverso tre percorsi interconnessi: per prima cosa, i PMLs esistenti e la loro teoria sottostante sono stati analizzati al fine di individuare pregi e difetti; successivamente, una tecnica di verifica molto diffusa in questo campo \ue8 stata consolidata ed estesa con una nuova tecnica per la correzione automatica di processi. Infine, una diversa soluzione per il design di PMLs \ue8 stata esplorata attraverso la definizione di un nuovo linguaggio, chiamato NestFlow, che migliora la modularit\ue0 e la comprensibilit\ue0 attraverso l'adozione di un approccio strutturato alla modellazione di processi. Un approccio modulare \ue8 possible solo se gli aspetti legati ai dati sono accettati come aspetto primario nel design di un PML. NestFlow cerca di semplificare l'attivit\ue0 di modellazione fornendo un insieme integrato di costrutti di control-flow e data-flow, promuovendo i secondi come aspetti principali nella modellazione di processi.A graphical Process Modeling Language (PML) is a language tailored for modeling software systems by means of process models. It is said to be graphical because the primary representation of models are diagrams obtained combining visual constructs and previously defined components. Graphical PMLs are interesting as they open the design space to new geometric representations of complex interrelated aspects like concurrency and interaction. A Process-Aware Information System (PAIS) is a software system driven by explicit process models with the aim to coordinate and support agents in performing their activities. It is responsible for managing several process model instances at the same time balancing the available resources. A PML is the primary interface of a PAIS and a main concern in its design, because it is used by end-users, consultants, and developers for understanding, implementing and enacting complex processes. The adoption of PAIS technology may be severely limited by the weakness of PMLs in describing complex use cases. The overall aim of this thesis is to improve the design of graphical PMLs in order to engineer more effective PAISs. This goal is pursued following three intertwined paths: firstly, mainstream PMLs and their theoretical foundations are analyzed for exposing their features and limits; secondly, a widespread PML verification method is consolidated and then extended with a novel technique for automating process correction; finally, an alternative PML design solution is explored through a proof-of-concept language, called NestFlow, that improves both modularity and comprehensibility by providing a more structured modeling approach. A modular approach is only possible if data-flow dependencies are accepted as a main concern in PML design. NestFlow tries to ease the modeling activity by providing a comprehensive set of tightly integrated control-flow and data-flow constructs, promoting the latter as first-class citizens in process modeling

Automated error correction of business process models

As order dependencies between process tasks can get complex, it is easy to make mistakes in process model design, especially behavioral ones such as deadlocks. Notions such as soundness formalize behavioral errors and tools exist that can identify such errors. However these tools do not provide assistance with the correction of the process models. Error correction can be very challenging as the intentions of the process modeler are not known and there may be many ways in which an error can be corrected. We present a novel technique for automatic error correction in process models based on simulated annealing. Via this technique a number of process model alternatives are identified that resolve one or more errors in the original model. The technique is implemented and validated on a sample of industrial process models. The tests show that at least one sound solution can be found for each input model within a reasonable response time

Täpne ja tõhus protsessimudelite automaatne koostamine sündmuslogidest

Töötajate igapäevatöö koosneb tegevustest, mille eesmärgiks on teenuste pakkumine või toodete valmistamine. Selliste tegevuste terviklikku jada nimetatakse protsessiks. Protsessi kvaliteet ja efektiivsus mõjutab otseselt kliendi kogemust – tema arvamust ja hinnangut teenusele või tootele. Kliendi kogemus on eduka ettevõtte arendamise oluline tegur, mis paneb ettevõtteid järjest rohkem pöörama tähelepanu oma protsesside kirjeldamisele, analüüsimisele ja parendamisele. Protsesside kirjeldamisel kasutatakse tavaliselt visuaalseid vahendeid, sellisel kujul koostatud kirjeldust nimetatakse protsessimudeliks. Kuna mudeli koostaja ei suuda panna kirja kõike erandeid, mis võivad reaalses protsessis esineda, siis ei ole need mudelid paljudel juhtudel terviklikud. Samuti on probleemiks suur töömaht - inimese ajakulu protsessimudeli koostamisel on suur. Protsessimudelite automaatne koostamine (protsessituvastus) võimaldab genereerida protsessimudeli toetudes tegevustega seotud andmetele. Protsessituvastus aitab meil vähendada protsessimudeli loomisele kuluvat aega ja samuti on tulemusena tekkiv mudel (võrreldes käsitsi tehtud mudeliga) kvaliteetsem. Protsessituvastuse tulemusel loodud mudeli kvaliteet sõltub nii algandmete kvaliteedist kui ka protsessituvastuse algoritmist. Antud doktoritöös anname ülevaate erinevatest protsessituvastuse algoritmidest. Toome välja puudused ja pakume välja uue algoritmi Split Miner. Võrreldes olemasolevate algoritmidega on Splint Miner kiirem ja annab tulemuseks kvaliteetsema protsessimudeli. Samuti pakume välja uue lähenemise automaatselt koostatud protsessimudeli korrektsuse hindamiseks, mis on võrreldes olemasolevate meetoditega usaldusväärsem. Doktoritöö näitab, kuidas kasutada optimiseerimise algoritme protsessimudeli korrektsuse suurendamiseks.Everyday, companies’ employees perform activities with the goal of providing services (or products) to their customers. A sequence of such activities is known as business process. The quality and the efficiency of a business process directly influence the customer experience. In a competitive business environment, achieving a great customer experience is fundamental to be a successful company. For this reason, companies are interested in identifying their business processes to analyse and improve them. To analyse and improve a business process, it is generally useful to first write it down in the form of a graphical representation, namely a business process model. Drawing such process models manually is time-consuming because of the time it takes to collect detailed information about the execution of the process. Also, manually drawn process models are often incomplete because it is difficult to uncover every possible execution path in the process via manual data collection. Automated process discovery allows business analysts to exploit process' execution data to automatically discover process models. Discovering high-quality process models is extremely important to reduce the time spent enhancing them and to avoid mistakes during process analysis. The quality of an automatically discovered process model depends on both the input data and the automated process discovery application that is used. In this thesis, we provide an overview of the available algorithms to perform automated process discovery. We identify deficiencies in existing algorithms, and we propose a new algorithm, called Split Miner, which is faster and consistently discovers more accurate process models than existing algorithms. We also propose a new approach to measure the accuracy of automatically discovered process models in a fine-grained manner, and we use this new measurement approach to optimize the accuracy of automatically discovered process models.https://www.ester.ee/record=b530061