Recently, several large companies have been involved in financial scandals related to mismanagement, resulting in financial damages for their stockholders. In response, certifications and manuals for best practices of governance were developed, and in some cases, tougher federal laws were implemented (e.g. the Sarboness Oxley Act). Companies adhered to these changes adopting the best practices for corporate governance by deploying Process Aware Information Systems (PAISs) to automate their business processes. However, these companies demand a rapid response to strategic changes, so the adoption of normative PAISs may compromise their competitiveness. On one hand companies need flexible PAISs for competitiveness reasons. On the other hand flexibility may compromise security of system because users can execute tasks that could result into violation of financial loses. In order to re-balance this trade-off, we present in this work how ProM tools can support anomaly detection in logs of PAIS. Besides, we present the results of the application of our approach with a real case.


Process mining anomaly detection auditing systems 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Dumas, M., van der Aalst, W., ter Hofstede, A.: Process-Aware Information Systems: Bridging People and Software through Process Technology. Wiley, Chichester (2005)CrossRefGoogle Scholar
  2. 2.
    Rozinat, A., van der Aalst, W.: Conformance checking of processes based on monitoring real behavior. Information Systems 33(1), 64–95 (2008)CrossRefGoogle Scholar
  3. 3.
    van der Aalst, W.M.P., van Dongen, B.F., Herbst, J., Maruster, L., Schimm, G., Weijters, A.J.M.M.: Workflow mining: A survey of issues and approaches. Data & Knowledge Engineering 47(2), 237–267 (2003)CrossRefGoogle Scholar
  4. 4.
    van der Aalst, W.M.P., Weijters, A.J.M.M.: Process mining: a research agenda. Computers in Industry 53(3), 231–244 (2004)CrossRefGoogle Scholar
  5. 5.
    Bezerra, F., Wainer, J.: Towards detecting fraudulent executions in business process aware systems. In: WfPM 2007 - Workshop on Workflows and Process Management, Timisoara, Romania (September 2007); In conjunction with SYNASC 2007Google Scholar
  6. 6.
    Bezerra, F., Wainer, J.: Anomaly detection algorithms in logs of process aware systems. In: SAC 2008: Proceedings of the 2008 ACM symposium on Applied computing, pp. 951–952. ACM Press, New York (2008)CrossRefGoogle Scholar
  7. 7.
    Bezerra, F., Wainer, J.: Anomaly detection algorithms in business process logs. In: ICEIS 2008: Proceedings of the Tenth International Conference on Enterprise Information Systems, Barcelona, Spain, June 2008. AIDSS, pp. 11–18 (2008)Google Scholar
  8. 8.
    van der Aalst, W.M.P., de Medeiros, A.K.A.: Process mining and security: Detecting anomalous process executions and checking process conformance. Electronic Notes in Theoretical Computer Science 121(4), 3–21 (2005)CrossRefGoogle Scholar
  9. 9.
    de Medeiros, A.K.A., van der Aalst, W.M.P., Weijters, A.: Workflow mining: Current status and future directions. In: Meersman, R., Tari, Z., Schmidt, D.C. (eds.) CoopIS 2003, DOA 2003, and ODBASE 2003. LNCS, vol. 2888, pp. 389–406. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  10. 10.
    van der Aalst, W.M.P., Weijters, T., Maruster, L.: Workflow mining: Discovering process models from event logs. IEEE Transactions on Knowledge and Data Engineering 16(9), 1128–1142 (2004)CrossRefGoogle Scholar
  11. 11.
    Cook, J.E., Wolf, A.L.: Discovering models of software processes from event-based data. ACM Trans. Softw. Eng. Methodol. 7(3), 215–249 (1998)CrossRefGoogle Scholar
  12. 12.
    Agrawal, R., Gunopulos, D., Leymann, F.: Mining process models from workflow logs. In: Schek, H.-J., Saltor, F., Ramos, I., Alonso, G. (eds.) EDBT 1998. LNCS, vol. 1377, pp. 469–483. Springer, Heidelberg (1998)Google Scholar
  13. 13.
    Cook, J.E., Du, Z., Liu, C., Wolf, A.L.: Discovering models of behavior for concurrent workflows. Computers in Industry 53(3), 297–319 (2004)CrossRefGoogle Scholar
  14. 14.
    Pinter, S.S., Golani, M.: Discovering workflow models from activities’ lifespans. Computers in Industry 53(3), 283–296 (2004)CrossRefGoogle Scholar
  15. 15.
    Herbst, J., Karagiannis, D.: Workflow mining with inwolve. Computers in Industry 53(3), 245–264 (2004)CrossRefGoogle Scholar
  16. 16.
    de Medeiros, A.K.A., Weijters, A.J.M.M., van der Aalst, W.M.P.: Genetic process mining: A basic approach and its challenges. In: Bussler, C.J., Haller, A. (eds.) BPM 2005. LNCS, vol. 3812, pp. 203–215. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  17. 17.
    Yang, W.S., Hwang, S.Y.: A process-mining framework for the detection of healthcare fraud and abuse. Expert Systems with Applications 31(1), 56–68 (2006)CrossRefGoogle Scholar
  18. 18.
    van Dongen, B., de Medeiros, A., Verbeek, H., Weijters, A., van der Aalst, W.: The prom framework: A new era in process mining tool support. In: Ciardo, G., Darondeau, P. (eds.) ICATPN 2005. LNCS, vol. 3536, pp. 444–454. Springer, Heidelberg (2005)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Fábio Bezerra
    • 1
  • Jacques Wainer
    • 1
  • W. M. P. van der Aalst
    • 2
  1. 1.Institute of Computing - UNICAMPCampinas, São PauloBrazil
  2. 2.Dep. of Mathmatics and Computer Science - TU/eEindhovenThe Netherlands

Personalised recommendations