![](bg9.png)
to identify which events belong to the same pro-
cess execution (Alizadeh et al., 2018b). Solving
such challenges is far from being trivial.
• Features Selection: The choice of the features to
be considered depends on the application domain
and scope of the analysis. In particular, it requires
background knowledge of the underlying process
and prior knowledge of what to look for, which
is not always the case, especially in the security
context. On top of this, the analysis is constrained
by the information available in the log.
• Technique Choice: There is not a one-fit-all tech-
nique for all cases. The choice of the techniques
to be used for the analysis depends on the scope
of analysis and type of data. This requires expe-
rienced and highly skilled analysts, with a strong
background both in security and in data analysis
techniques.
More research efforts are necessary to explore and
systematize findings and results obtained so far and to
develop a more general framework. In future work,
we plan to investigate these issues. In particular, we
intend to further elaborate on the observations made
in this work to devise general guidelines to apply data
science to behavior analysis for security, taking into
account a larger range of techniques. At the same
time, we plan to perform an extensive experimental
evaluation on both synthetic and real-world logs.
ACKNOWLEDGMENTS
This work is partially supported by ITEA3 through
the APPSTACLE project (15017) and by ECSEL
through the SECREDAS project.
REFERENCES
Accorsi, R., Stocker, T., and M
¨
uller, G. (2013). On the ex-
ploitation of process mining for security audits: the
process discovery case. In Proceedings of Annual
ACM Symposium on Applied Computing, pages 1462–
1468. ACM.
Adriansyah, A., van Dongen, B. F., and Zannone, N. (2013).
Controlling break-the-glass through alignment. In
Proceedings of International Conference on Social
Computing, pages 606–611. IEEE.
Alizadeh, M., Lu, X., Fahland, D., Zannone, N., and van
der Aalst, W. M. P. (2018a). Linking data and process
perspectives for conformance analysis. Computers &
Security, 73:172–193.
Alizadeh, M., Peters, S., Etalle, S., and Zannone, N.
(2018b). Behavior Analysis in the Medical Sector:
Theory and Practice. In Proceedings of ACM/SIGAPP
Symposium On Applied Computing. ACM.
Association of Certified Fraud Examiners (2018). Report
to the Nations: 2018 Global study on occupational
fraud and abuse. http://www.acfe.com/report-to-the-
nations/2018/. Accessed: 2018-06-01.
Bolton, R. J. and Hand, D. J. (2001). Unsupervised profiling
methods for fraud detection. In Proceedings of Credit
Scoring and Credit Control, pages 235–255.
BPI Challenge 2012 (2012). Event log of a loan application
process. http://dx.doi.org/10.4121/uuid:3926db30-
f712-4394-aebc-75976070e91f.
Cao, L. (2010). In-depth behavior understanding and use:
The behavior informatics approach. Information Sci-
ences, 180(17):3067 – 3085. Including Special Sec-
tion on Virtual Agent and Organization Modeling:
Theory and Applications.
Chandola, V., Banerjee, A., and Kumar, V. (2009).
Anomaly detection: A survey. ACM Computing Sur-
veys, 41(3):15.
Costante, E., Fauri, D., Etalle, S., den Hartog, J., and Zan-
none, N. (2016). A hybrid framework for data loss
prevention and detection. In Proceedings of IEEE Se-
curity and Privacy Workshops, pages 324–333. IEEE.
Etalle, S. (2017). From intrusion detection to software de-
sign. In Computer Security, pages 1–10. Springer.
Ferreira, D. R. and Gillblad, D. (2009). Discovering pro-
cess models from unlabelled event logs. In Business
Process Management, pages 143–158. Springer.
Genga, L., Alizadeh, M., Potena, D., Diamantini, C., and
Zannone, N. (2018). Discovering anomalous frequent
patterns from partially ordered event logs. Journal of
Intelligent Information Systems.
Hompes, B., Buijs, J., van der Aalst, W., Dixit, P., and Buur-
man, J. (2015). Discovering deviating cases and pro-
cess variants using trace clustering. In Proceedings of
Benelux Conference on Artificial Intelligence, pages
5–6.
Lee, W., Stolfo, S. J., et al. (1998). Data mining approaches
for intrusion detection. In Proceedings of USENIX
Security Symposium, pages 79–93.
Mann, H. B. and Whitney, D. R. (1947). On a Test of
Whether one of Two Random Variables is Stochas-
tically Larger than the Other. Ann. Math. Statist.,
18(1):50–60.
Patcha, A. and Park, J.-M. (2007). An overview of
anomaly detection techniques: Existing solutions
and latest technological trends. Computer networks,
51(12):3448–3470.
Qu, D., Vetter, B. M., Wang, F., Narayan, R., Wu, S. F.,
Hou, Y., Gong, F., and Sargor, C. (1998). Statistical
anomaly detection for link-state routing protocols. In
Proceedings of International Conference on Network
Protocols, pages 62–70. IEEE.
Richardson, R. (2008). CSI Computer Crime and Security
Survey.
Shon, T., Kim, Y., Lee, C., and Moon, J. (2005). A ma-
chine learning framework for network anomaly detec-
tion using SVM and GA. In Proceedings from Annual
BASS 2018 - International Workshop on Behavioral Analysis for System Security
468