A Security-aware Simulation Method for Generating Business Process Event Logs

One of the difficulties at developing mechanisms for business process security monitoring and auditing is the existence of representative, realistic and controlled test runs. This paper presents ongoing work toward a business process simulation method geared to the synthesis of event logs. The novelty is that it considers the activity of an (internal) attacker able purposefully infringe the designated security requirements or simply manipulate the process’ control and data flow. The resultant logs can be, e.g., readily replayed on a reference monitor, business activity monitoring tool, or serve as input for process discovery tools.