US20110197207A1 - System and method for producing audit trails - Google Patents

System and method for producing audit trails Download PDF

Info

Publication number
US20110197207A1
US20110197207A1 US13/026,562 US201113026562A US2011197207A1 US 20110197207 A1 US20110197207 A1 US 20110197207A1 US 201113026562 A US201113026562 A US 201113026562A US 2011197207 A1 US2011197207 A1 US 2011197207A1
Authority
US
United States
Prior art keywords
event
correlator
component
audit trail
events
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US13/026,562
Inventor
Rajeev Bhargava
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Decision Zone Inc
Original Assignee
Decision Zone Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to US11/530,885 priority Critical patent/US7908160B2/en
Application filed by Decision Zone Inc filed Critical Decision Zone Inc
Priority to US13/026,562 priority patent/US20110197207A1/en
Publication of US20110197207A1 publication Critical patent/US20110197207A1/en
Priority claimed from US13/462,543 external-priority patent/US20120284790A1/en
Application status is Abandoned legal-status Critical

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/36Preventing errors by testing or debugging software
    • G06F11/3604Software analysis for verifying properties of programs
    • G06F11/3612Software analysis for verifying properties of programs by runtime analysis
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06QDATA PROCESSING SYSTEMS OR METHODS, SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL, SUPERVISORY OR FORECASTING PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL, SUPERVISORY OR FORECASTING PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00Administration; Management
    • G06Q10/06Resources, workflows, human or project management, e.g. organising, planning, scheduling or allocating time, human or machine resources; Enterprise planning; Organisational models
    • G06Q10/063Operations research or analysis
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06QDATA PROCESSING SYSTEMS OR METHODS, SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL, SUPERVISORY OR FORECASTING PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL, SUPERVISORY OR FORECASTING PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00Administration; Management
    • G06Q10/06Resources, workflows, human or project management, e.g. organising, planning, scheduling or allocating time, human or machine resources; Enterprise planning; Organisational models
    • G06Q10/063Operations research or analysis
    • G06Q10/0631Resource planning, allocation or scheduling for a business operation
    • G06Q10/06316Sequencing of tasks or work

Abstract

Business Processes handle business transactions. The life cycle of a transaction is controlled by state of the process and events. Events represent information exchange between systems. The states determine when the exchange should take place. Key issues are to identify whether a transaction is anomalous and if so, determining the trace to the root cause To detect anomalies, current approaches evaluate transaction data statistically. To validate whether the transaction is indeed anomalous requires significant storage, processing power and human resources. The new approach audits events as they happen against the business process definition. Events that do not follow the right sequences and conditions of the process definition are identified to be anomalous. The generated audit trail traces the root cause of the transaction anomaly. Businesses can now protect or re-engineer their strategic business processes using audit trail traces.

Description

    CROSS-REFERENCE TO RELATED APPLICATION
  • This application is a continuation of U.S. patent application Ser. No. 11/530,885, filed Sep. 11, 2006, the contents of which is incorporated herein by reference.
  • FIELD OF THE INVENTION
  • The invention relates to systems and methods for processing data stored in electronic format, and in particular systems and apparatus for correlating such data using process description and providing output representing data audit traces.
  • BACKGROUND OF THE INVENTION
  • A business process represents a collection of related, structured activities—a chain of events—that produce a specific service or product for a particular customer or customers. The design of the business process can be captured using various modeling technologies and can be automated using an engine or set of engines—business process engines. The automation is optional—only one part can be automated or even none. The state of the business process is changed every time an event is generated and it will end when a final state is reached.
  • For audit purposes, currently, sample data is retrieved and analyzed manually by a third-party team of domain experts. The result of this lengthy and fault-prone process is an audit report that confirms or rejects the assumption that the process is executed according to the design specifications.
  • Current audit methodologies are not automated and have a big latency factor that precludes them from being used for real time transactional validation.
  • SUMMARY OF THE INVENTION
  • The present invention improves upon heretofore known audit systems by providing a real-time, automated business process audit system, and more particularly a computerized business process audit system that detects anomalies and provides audit trails based on event data received from one or more sources.
  • The present invention in one embodiment can be characterized as a system for anomaly detection in structured sets of events. Such system employs a set of event listeners that collect raw event data, a correlator and a notification component. The notification component sends audit events comprised from raw events grouped and annotated with correlation attributes. These audit events are processed or logged on a downstream location.
  • The correlator loads the process definition from an external file. This file format can be any of the business process definition language formats available: XMI/BPMN/BPEL but not limited to those. The loaded process definition contains the cause-effect relationships between the events specified. Also it contains any guard conditions that are used to validate the events during the execution phase.
  • The event listeners can be real-time or historical and are configured using a mapping file. The real-time event listeners will trigger the correlation component immediately after an event was received. The historical event listeners simulate ‘virtual events’ from historical storage (databases/logs/ . . . ) and will not trigger the correlation component.
  • In a variation of the system of the one embodiment, the system further employs a causal pattern detection layer that applies pattern expressions on the audit grouped raw events contained in the audit event. The result of the pattern expression evaluation is considered to be a filtered instance of a causal audit event. This filtered audit events are then pushed through a notification component to be sent for further processing on a downstream location.
  • In an additional variation of the system of the one embodiment, the system further employs a behavior analysis layer that monitors changes in the model associated to the audit event flow. This layer collects data to build a clustering model for the configured fields from the audit event. After enough data was collected and a model was built, without human intervention, this layer will signal when an input (audit) event can be considered as a large variation from the rules captured in the model. Periodically, when new data is available, this processing layer will update its model thus adapting to the changing environment.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • The invention is illustrated in the figures of the accompanying drawings which are meant to be exemplary and not limiting, in which like references are intended to refer to like or corresponding parts, and in which:
  • FIG. 1 is a schematic block diagram of an automated process audit system of one embodiment in accordance with the present invention.
  • FIG. 2 is a schematic block diagram of the ‘listeners’ component of the process audit system of one embodiment in accordance with the present invention.
  • FIG. 3 is a schematic block diagram of the ‘correlator’ component of the process audit system of one embodiment in accordance with the present invention.
  • FIG. 4 is a sample business process diagram as captured by most modeling tools. Usually uses notations compatible to UML statechart diagram specifications.
  • Corresponding reference characters indicate corresponding components throughout the several views of the drawings.
  • DETAILED DESCRIPTION OF THE INVENTION
  • The following description of the presently contemplated best mode of practicing the invention is not to be taken in a limiting sense, but is made merely for the purpose of describing the general principles of the invention. The scope of the invention should be determined with reference to the claims.
  • Referring first to FIG. 1, a block diagram is shown of an automated process audit system 1 and method in accordance with one embodiment of the present invention. The automated process audit system is broken in sequential processing blocks: Listeners 4, Correlator 8, Notification 12.
  • During the business process lifecycle, external systems 2 involved in the choreography of actions and events 3 exchange messages and generate or update data in various storage mediums. The cause and effect relationships between the events that trigger state changes are captured using various modeling tools in a form of a business process definition. This triggering of the state change—transition—can be ‘guarded’ by a condition that controls the state changing based on the result of the guard condition expression evaluation. The guard condition expression can include references to data internal or external to the process.
  • This business process definition usually can be used for but not limited to: automating the business process execution, documentation or—as described in this invention—for audit purposes.
  • As an example, the FIG. 4 illustrates a business process comprised of:
      • initial state 80 (pseudo state)
      • states 82, 84, 86, 93, 94. (94 is a composite state an the process audit will drill down and handle it as a regular business process)
      • pseudo states 90, 98
      • final states 99, 100 (pseudo state)
      • transitions 81, 83, 85, 87, 89, 91, 92, 88, 95, 96, 97
  • Not specified in the diagram in the FIG. 4 are the trigger events associated with the transitions.
  • For the process audit system 1 to reach the events 3 that are generated by the external systems 2, a ‘listeners’ component 4 needs to be configured by loading 6 event mapping configuration data 5 and guard condition expressions from the process definition 9. This data specifies how the process audit system will access the required middleware and what technology to use to gain access to the event 3.
  • After the ‘listeners’ component 4 has established the connectivity to the event sources throughout the enterprise, upon receiving of an event, the ‘listeners’ component 4 will manage the storage and access of the event payload.
  • The ‘listeners’ 4 component will notify 7 the correlator 8 when a new event or an anomaly was detected at the listener level. The correlator 8 component loads 10 the process definition 9 as configuration data. When triggered by the ‘listeners’ 4 component or externally through the external trigger interface 15, the correlation algorithm will be executed on the available data. The result 11 in form of event sets assembled together by the correlation component—according to their receive order and relationships defined in the process definition—is supplied to the notification 12 component to be converted to an external format and pushed 13 for further downstream processing 14.
  • Referring to FIG. 2, the preferred architecture but not limited to, for the ‘listeners’ component 4 consists of multiple event listeners 40 created according to the configuration data. Each event listener 40 consists of the following processing blocks:
      • Event provider 41—its role is to connect to a physical system and extract (listen for) events. The event data will be converted to a normalized format internal.
      • Guard evaluation 42—if there is a guard condition defined for the transition associated with the configured event, this component will load 10 the guard condition 51 from the process definition 9. Always, the data available as the event payload can be accessible to the guard condition expression evaluation. In addition, the system can be configured to expand the guard condition 51 expression evaluation scope to the payload of all related events pre-correlated by the correlator component 8. External data can be accessed during the expression evaluation. The language and preprocessing directives can be specified in the process definition 9 data. This component 42 can load the appropriate expression evaluator and setup the required resources for expression evaluation.
      • Queue 43—Historical storage for the events that passed the guard expression evaluation. It offers a query interface 45 used to locate and consume an event. Typically a limit is enforced on the number of events stored into the queue and when this limit is exceeded, an overflow event 47 will be generated. The implementation of the queue is configurable and plug-in based.
      • Expiry checks 46—for queues that store events that have an expiry period associated with them, this component verifies periodically the contents of the queue 43 for event that have exceeded their preset storage time. All expired event will be removed from the storage queue and tagged as expired and an ‘event expired’ 48 event will be generated.
  • When an external system generates an event, the event provider 41 will receive it and convert it to a normalized format internal ready for guard expression evaluation. If there is no guard condition associate to the corresponding transition, the guard evaluation 42 component will assume a successful validation of the transition. If the guard condition evaluation was successful, the event will be stored in the associated queue 43 for later retrieval. If an expiry period is configured for this event listener, periodically, the contents of the queue 47 are verified by ‘expiry checks’ 46 so that no event older than the expiry period is in queue. If an event is found to be ‘expired’, then it is removed from the queue 43 and an ‘event expired’ 48 is generated.
  • Referring to FIG. 3, the preferred architecture but not limited to, for the ‘Correlator’ 50 component consists of a main event correlator 52 and an expired event correlator 51. Since the order of the events is relevant for any process audit, for real-time business process audit, a jitter compensator 53 will delay processing to accommodate for the uneven propagation delays in the middleware systems.
  • The correlator 50 loads 10 the process definition 9 data to be used during the correlation of the events 47, 48, 49 coming from event listeners 40.
  • On receive of an ‘event added’ 49, the main event correlator will check if the associated transition from the process definition has as a target a final state 99, 100. If true, the main correlator will traverse the process definition 9 in reverse, towards the ‘initial’ state 80 of the business process. For every transition, the correlator will check the event listener 40—associated to the event for that transition—for available event data. This query 57 is performed through the query interface 45. When the process traversal is completed, all identified events are marked as consumed and a normal execution audit trail event 55 is generated. This event contains the list of all events causally related according to the business process specifications 9.
  • If during the process traversal, an instance of an event specified in business process definition 9 in is not found in the associated event listener 40 queue (queried through the query interface), the processing is suspended 59 by the jitter compensator 53. When the jitter period has expired, the correlation resumes 54. If at that time, the required event data is still not found, then the correlation process ends and an anomaly audit trail event 56 is generated. This event has the same structure as a normal execution audit trail event 55 but it is flagged by an ‘anomaly=true’ attribute.
  • On receive of an ‘event expired’ 48 or ‘overflow event’ 47, the expired event correlator will start the correlation process by traversing the process definition 9 in upwards towards the ‘initial’ state 80 of the business process and downwards, towards the ‘final’ state 99, 100. For every transition, the correlator will check the event listener 40—associated to the event for that transition—for available event data. This query 58 is performed through the query interface 45. When no more events are found, the process traversal is completed, all identified events are marked as consumed and an anomaly audit trail event 56 is generated. This event contains the list of all events causally related according to the business process specifications 9. It will be flagged by an ‘anomaly=true’ attribute.
  • Referring to FIG. 1, the notification component 12 accepts events 11 of type anomaly 56 or normal 55 execution audit trail and translates their content in a native middleware message format using an user configurable technology adapter. The resulting message 13 is pushed for downstream processing 14 on external systems.

Claims (17)

1. A method for generating audit trails, comprising:
establishing a connection between an event listener component and at least one event source;
collecting event data for one of a plurality of events from the at least one event source at the event listener component;
responsive to collecting the event data, transmitting an event notification from the event listener component to a correlator;
loading a process definition at the correlator, the process definition defining a plurality of state transitions each associated with different ones of the plurality of events;
generating, by a computer, at least one audit trail event at the correlator, based on the event data collected at the event listener component; and
transmitting the at least one audit trail event to a notification component.
2. The method of claim 1, further comprising:
prior to establishing the connection, loading event mapping data at the event listener component.
3. The method of claim 1, further comprising:
responsive to collecting event data, storing the event data in an event listener component queue at the event listener component.
4. The method of claim 3, wherein generating at least one audit trail event comprises:
responsive to receiving the notification, determining at the correlator if the event data is representative of a transition to a final process state;
when the determination is affirmative, traversing the process definition in reverse and, for each state transition, transmitting a query to the event listener component queue to retrieve the event associated with the state transition;
if all events associated with the plurality of state transitions are retrieved, generating a normal audit trail event; and,
if one or more events associated with the plurality of state transitions are not retrieved, generating an anomaly audit trail event.
5. The method of claim 4, wherein the query is transmitted via a query interface.
6. The method of claim 4, further comprising, for each state transition:
following transmission of the query to the event listener component queue, if the associated event is not retrieved, suspending further processing until a jitter period has expired;
following expiry of the jitter period, advancing to the next state transition.
7. The method of claim 1, further comprising:
receiving the at least one audit trail event at the notification component;
translating the received at least one audit trail event into a middleware message format; and
forwarding the translated at least one audit trail event to an external system.
8. The method of claim 1, wherein the event listener component further comprises an event provider and a guard evaluation component, and wherein collecting event data comprises:
receiving event data for the event from the at least one event source at the event provider;
loading a guard condition associated with the event at the guard evaluation component;
determining whether the guard condition is satisfied; and,
when the guard condition is satisfied, transmitting the event notification to the correlator and storing the event data in the queue.
9. A system for generating audit trails, comprising:
an event listener component for establishing a connection to at least one event source, the event listener component configured to collect event data for one of a plurality of events from the at least one event source and to transmit an event notification;
a correlator configured to load a process definition the process definition defining a plurality of state transitions each associated with different ones of the plurality of events;
the correlator further configured to receive the event notification and generate at least one audit trail event, based on the event data collected at the event listener component; the correlator further configured to transmit the at least one audit trail event; and,
a notification component configured to receive the at least one audit trail event from the correlator.
10. The system of claim 9, the event listener component being further configured to load event mapping data prior to establishing the connection.
11. The system of claim 9, wherein the event listener component comprises a plurality of event listeners, each event listener including an event queue and being configured to store the event data in the queue.
12. The system of claim 11, the correlator being further configured to:
determine, responsive to receiving the notification, if the event data is representative of a transition to a final process state;
when the determination is affirmative, to traverse the process definition in reverse and, for each state transition, to transmit a query to the event queue of the relevant event listener for retrieving the event associated with the state transition;
the correlator being further configured, if all events associated with the plurality of state transitions are retrieved, to generate a normal audit trail event;
and, if one or more events associated with the plurality of state transitions are not retrieved, to generate an anomaly audit trail event.
13. The system of claim 12, further comprising a query interface for carrying the query transmitted by the correlator.
14. The method of claim 12, the correlator being further configured:
for each state transition, following transmission of the query to the event listener component queue, if the associated event is not retrieved, to suspend further processing until a jitter period has expired; and
following expiry of the jitter period, to advance to the next state transition.
15. The system of claim 9, the notification component being further configured to receive the at least one audit trail event at the notification component, to translate the received at least one audit trail event into a middleware message format; and to forward the translated at least one audit trail event to an external system.
16. The system of claim 11, wherein each event listener further comprises:
an event provider configured to receive event data for the event from the at least one event source; and
a guard evaluation component configured to load a guard condition associated with the event, to determine whether the guard condition is satisfied, and, when the guard condition is satisfied, to transmit the event notification to the correlator and store the event data in the queue.
17. The system of claim 14, wherein the correlator comprises a main event correlator for generating at least one audit trail event and a jitter compensator for suspending further processing until the jitter period has expired.
US13/026,562 2006-09-11 2011-02-14 System and method for producing audit trails Abandoned US20110197207A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US11/530,885 US7908160B2 (en) 2006-09-11 2006-09-11 System and method for producing audit trails
US13/026,562 US20110197207A1 (en) 2006-09-11 2011-02-14 System and method for producing audit trails

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US13/026,562 US20110197207A1 (en) 2006-09-11 2011-02-14 System and method for producing audit trails
US13/462,543 US20120284790A1 (en) 2006-09-11 2012-05-02 Live service anomaly detection system for providing cyber protection for the electric grid

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US11/530,885 Continuation US7908160B2 (en) 2006-09-11 2006-09-11 System and method for producing audit trails

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US13/462,543 Continuation-In-Part US20120284790A1 (en) 2006-09-11 2012-05-02 Live service anomaly detection system for providing cyber protection for the electric grid

Publications (1)

Publication Number Publication Date
US20110197207A1 true US20110197207A1 (en) 2011-08-11

Family

ID=39170873

Family Applications (2)

Application Number Title Priority Date Filing Date
US11/530,885 Active 2030-01-13 US7908160B2 (en) 2006-09-11 2006-09-11 System and method for producing audit trails
US13/026,562 Abandoned US20110197207A1 (en) 2006-09-11 2011-02-14 System and method for producing audit trails

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US11/530,885 Active 2030-01-13 US7908160B2 (en) 2006-09-11 2006-09-11 System and method for producing audit trails

Country Status (1)

Country Link
US (2) US7908160B2 (en)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130211558A1 (en) * 2012-02-13 2013-08-15 International Business Machines Corporation Suspension of Processes in Industrial Control System When an Anomaly Occurs
US8595264B2 (en) * 2011-06-30 2013-11-26 Bm Software, Inc. Event processing based on meta-relationship definition
US8812466B2 (en) 2012-02-10 2014-08-19 International Business Machines Corporation Detecting and combating attack in protection system of an industrial control system
US20140380458A1 (en) * 2013-06-20 2014-12-25 Electronics And Telecommunications Research Institute Apparatus for preventing illegal access of industrial control system and method thereof
WO2018022116A1 (en) * 2016-07-27 2018-02-01 Wepay, Inc. Systems and methods for electronic payment processing based on typed graph of payment lifecycle
WO2018217239A1 (en) * 2017-05-23 2018-11-29 Wepay, Inc. Systems and methods for distributed electronic payment processing using hierarchical payment graph

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8108833B2 (en) * 2007-04-20 2012-01-31 National Instruments Corporation Automatically generating a graphical data flow program from a statechart
US8413107B2 (en) * 2008-07-15 2013-04-02 Hewlett-Packard Development Company, L.P. Architecture for service oriented architecture (SOA) software factories
FR2945946B1 (en) 2009-05-29 2011-08-26 Univ Victor Segalen Bordeaux 2 Multi-compartment formulations based on functional amphiphilic molecules or macromolecules
US8321433B1 (en) * 2011-05-06 2012-11-27 Sap Ag Systems and methods for business process logging
US8452786B2 (en) * 2011-05-06 2013-05-28 Sap Ag Systems and methods for business process logging
US8626543B2 (en) * 2011-10-08 2014-01-07 Sap Ag Tracing software execution of a business process
US9747193B1 (en) * 2013-03-13 2017-08-29 Ca, Inc. System and method for automatic root cause detection
US9904724B1 (en) * 2013-09-30 2018-02-27 Emc Corporation Method and apparatus for message based security audit logging

Citations (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5893077A (en) * 1995-08-23 1999-04-06 Microsoft Corporation Method and apparatus for generating and collecting a billing event object within an on-line network
US6278977B1 (en) * 1997-08-01 2001-08-21 International Business Machines Corporation Deriving process models for workflow management systems from audit trails
US6494831B1 (en) * 1999-09-03 2002-12-17 Ge Medical Technology Services, Inc. Medical diagnostic system service connectivity method and apparatus
US20030050789A1 (en) * 2001-09-12 2003-03-13 International Business Machines Corporation Method and apparatus for monitoring execution of a business process managed using a state machine
US20030149604A1 (en) * 2002-01-25 2003-08-07 Fabio Casati Exception analysis, prediction, and prevention method and system
US20030195959A1 (en) * 2002-04-15 2003-10-16 International Business Machines Corporation Framework for managing data that provides correlation information in a distributed computing system
US6639975B1 (en) * 1999-01-29 2003-10-28 Microsoft Corporation Interactive billing control system
US20030236677A1 (en) * 2002-06-21 2003-12-25 Fabio Casati Investigating business processes
US20040260634A1 (en) * 2003-06-17 2004-12-23 Oracle International Corporation Impacted financial statements
US20050017810A1 (en) * 2003-07-21 2005-01-27 Feng Lin Phase detector for reducing noise
US20050058066A1 (en) * 2003-09-16 2005-03-17 Samsung Electronics Co., Ltd. Network device to support services according to quality of service, network system and method using the same
US20050171810A1 (en) * 2004-01-30 2005-08-04 Synthean, Inc. System and method for monitoring business activities
US20060184410A1 (en) * 2003-12-30 2006-08-17 Shankar Ramamurthy System and method for capture of user actions and use of capture data in business processes
US20080033995A1 (en) * 2006-08-02 2008-02-07 Fabio Casati Identifying events that correspond to a modified version of a process
US7441249B2 (en) * 2003-11-13 2008-10-21 International Business Machines Corporation Activity monitoring without accessing a process object

Patent Citations (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5893077A (en) * 1995-08-23 1999-04-06 Microsoft Corporation Method and apparatus for generating and collecting a billing event object within an on-line network
US6278977B1 (en) * 1997-08-01 2001-08-21 International Business Machines Corporation Deriving process models for workflow management systems from audit trails
US6639975B1 (en) * 1999-01-29 2003-10-28 Microsoft Corporation Interactive billing control system
US6494831B1 (en) * 1999-09-03 2002-12-17 Ge Medical Technology Services, Inc. Medical diagnostic system service connectivity method and apparatus
US20030050789A1 (en) * 2001-09-12 2003-03-13 International Business Machines Corporation Method and apparatus for monitoring execution of a business process managed using a state machine
US20030149604A1 (en) * 2002-01-25 2003-08-07 Fabio Casati Exception analysis, prediction, and prevention method and system
US20030195959A1 (en) * 2002-04-15 2003-10-16 International Business Machines Corporation Framework for managing data that provides correlation information in a distributed computing system
US20030236677A1 (en) * 2002-06-21 2003-12-25 Fabio Casati Investigating business processes
US20040260634A1 (en) * 2003-06-17 2004-12-23 Oracle International Corporation Impacted financial statements
US20050017810A1 (en) * 2003-07-21 2005-01-27 Feng Lin Phase detector for reducing noise
US20050058066A1 (en) * 2003-09-16 2005-03-17 Samsung Electronics Co., Ltd. Network device to support services according to quality of service, network system and method using the same
US7441249B2 (en) * 2003-11-13 2008-10-21 International Business Machines Corporation Activity monitoring without accessing a process object
US20060184410A1 (en) * 2003-12-30 2006-08-17 Shankar Ramamurthy System and method for capture of user actions and use of capture data in business processes
US20050171810A1 (en) * 2004-01-30 2005-08-04 Synthean, Inc. System and method for monitoring business activities
US20080033995A1 (en) * 2006-08-02 2008-02-07 Fabio Casati Identifying events that correspond to a modified version of a process

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8595264B2 (en) * 2011-06-30 2013-11-26 Bm Software, Inc. Event processing based on meta-relationship definition
US8812466B2 (en) 2012-02-10 2014-08-19 International Business Machines Corporation Detecting and combating attack in protection system of an industrial control system
US8818972B2 (en) 2012-02-10 2014-08-26 International Business Machines Corporation Detecting and combating attack in protection system of an industrial control system
US20130211558A1 (en) * 2012-02-13 2013-08-15 International Business Machines Corporation Suspension of Processes in Industrial Control System When an Anomaly Occurs
US20130212668A1 (en) * 2012-02-13 2013-08-15 International Business Machines Corporation Suspension of Processes in Industrial Control System When an Anomaly Occurs
US20140380458A1 (en) * 2013-06-20 2014-12-25 Electronics And Telecommunications Research Institute Apparatus for preventing illegal access of industrial control system and method thereof
WO2018022116A1 (en) * 2016-07-27 2018-02-01 Wepay, Inc. Systems and methods for electronic payment processing based on typed graph of payment lifecycle
WO2018217239A1 (en) * 2017-05-23 2018-11-29 Wepay, Inc. Systems and methods for distributed electronic payment processing using hierarchical payment graph

Also Published As

Publication number Publication date
US20080065400A1 (en) 2008-03-13
US7908160B2 (en) 2011-03-15

Similar Documents

Publication Publication Date Title
Van der Aalst Business process management: a comprehensive survey
Verbeek et al. Xes, xesame, and prom 6
Rozinat et al. Conformance checking of processes based on monitoring real behavior
Michelson Event-driven architecture overview
Shen et al. Web service discovery based on behavior signatures
Scheidegger et al. Tackling the provenance challenge one layer at a time
Verbeek et al. Analyzing BPEL processes using Petri nets
Grigori et al. Business process intelligence
Schimm Mining exact models of concurrent workflows
US9223867B2 (en) Methods and systems for data processing
Wen et al. Detecting implicit dependencies between tasks from event logs
van der Aalst et al. Process equivalence: Comparing two process models based on observed behavior
US7610211B2 (en) Investigating business processes
Namiri et al. Pattern-based design and validation of business process compliance
US8346931B2 (en) Conditional computer runtime control of an information technology environment based on pairing constructs
Leitner et al. Monitoring, prediction and prevention of sla violations in composite services
US8763006B2 (en) Dynamic generation of processes in computing environments
Casters et al. Pentaho Kettle solutions: building open source ETL solutions with Pentaho Data Integration
van Aalst et al. Auditing 2.0: Using process mining to support tomorrow's auditor
de Medeiros et al. Semantic process mining tools: Core building blocks
US6725287B1 (en) Method and system for capturing streaming data by an actionable information engine
De Leoni et al. A general process mining framework for correlating, predicting and clustering dynamic behavior based on event logs
US8655825B2 (en) Efficient management of data quality for streaming event data
Castellanos et al. ibom: A platform for intelligent business operation management
Van der Aalst Business alignment: using process mining as a tool for Delta analysis and conformance testing

Legal Events

Date Code Title Description
STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION