high processing loads, need for complicated and frequent updating, and high false alarm are some of the challenges in designing anomaly detection and misuse detection systems. we propose a new network-based intrusion detection system (ids) that resolves such shortcomings. our scheme fuses anomaly detection and misuse detection systems, which has not been utilized so far in existing systems. in ...

A large share of the literature on process mining based on declarative process modeling languages, like DECLARE, relies on the notion of constraint activation to distinguish between the case in which a process execution recorded in event data “vacuously” satisfies a constraint, or satisfies the constraint in an “interesting way”. This fine-grained indicator is then used to decide whether a cand...

This paper presents a formal forensic technique based on information flow analysis to detect leaks in business processes models. The approach can be uniformly applied both for the analysis of process specifications and of the log files generated during processes’ execution. Specifically, the special Petri net dialect IFnet provides a common basis for the formalization of isolation properties, t...

In this paper we use traffic analysis to investigate a stealthy form of data exfiltration. We present an approach to detect covert channels based on a Process Query System (PQS), a new type of information retrieval technology in which queries are expressed as process descriptions.

Nowadays, many organizations use Process Aware Information Systems (PAISs) to automate their business process. As any other information systems, security plays a major role in PAIS to provide a secure state and maintain the system in it. In order to provide security in a PAIS, a Process Aware Host-based Intrusion Detection (PAHID) model is proposed in this paper. The model detects host-based in...

Generally, the intruder must perform several actions, organized in an intrusion scenario, to achieve his or her malicious objective. We argue that intrusion scenarios can be modelled as a planning process and we suggest modelling a malicious objective as an attempt to violate a given security requirement. Our proposal is then to extend the definition of attack correlation presented in [2] to co...

This paper compares the efficacy of two anomaly detection classifiers with respect to the classification of processes as either intrusive or non-intrusive. To the task of process classification, both classifiers treat processes as system call sequences, encode those system call sequences as text documents, and apply the k-nearest neighbor text categorization method to classify the processes. In...

PURPOSE: Ultrasound offers a safe radiation-free approach to visualize the spine and measure or assess scoliosis. However, ultrasound assessment also poses major challenges. We propose a real-time algorithm and software implementation to automatically delineate the posterior surface patches of transverse processes in tracked ultrasound; a necessary step toward the ultimate goal of spinal curvat...