# Improving Vulnerability Management Through Process Mining
## 3 Process Mining
### Process Discovery  
Process discovery is the most commonly used type [34]. As already shown in Figure 3, process discovery takes an event log as input and creates a process model as output. The focus is on the control-flow perspective. Process discovery is defined by [PERSON] [33] as follows:  
Figure 3: Three types of process mining.  
Figure 2: From event log to process model.  
\"Let \(L\) be an event log [...]. A process discovery algorithm is a function that maps \(L\) onto a process model such that the model is'representative' for the behavior seen in the event log. The challenge is to find such an algorithm\" [33] (p. 125).  
As described by [PERSON] et al. [29] and [PERSON] et al. [31], there are four quality criteria for process discovery commonly found in the literature: fitness, precision, generalization, and simplicity. As already defined by [PERSON] [33], fitness means that each trace in the log can be observed in the model. Precision is reached when the model does not allow for behavior that is unrelated to the event log. Generalization describes that the model should allow for similar, generalized behavior and not only cover the traces from the event log. Finally, simplicity means that the model should be kept as simple as possible.  
The challenge of process discovery algorithms is finding a trade-off between these four criteria. According to [PERSON] et al. [29], there are two common problems with current process discovery algorithms. Some discover large, spaghetti-like models that have good fitness, precision, and generalization but violate simplicity. This mainly reduces their usability, especially outside of the research context. Other algorithms create simple models that, however, do not properly match the event log (either low fitness, precision, or generalization). In addition to the algorithms, the representation used for the modeling also greatly impacts the quality of the mined model. This is called representational bias. If, e.g., concurrency is difficult to model in a certain notation, such as directly follows graphs, concurrency will be more difficult to find when using this notation for process mining. Once mined, however, the models can be converted into different representations and visualizations if such a conversion is possible (e.g., from Petri nets to BPMN models). The most commonly used process model notation for scientific process mining is Petri nets, followed by BPMN [29; 31; 33]. In commercial process mining software offered for businesses, however, the most often used notations are directly follows graphs (DFGs) [35].  
The most used process discovery algorithm is the heuristic miner, first introduced by [PERSON] et al. [36]. The heuristic miner takes an event log as input and creates a causal net as output. One important difference to the alpha algorithm is that it also considers the frequency of directly following activities. In order to achieve that, the first step of the algorithm is creating a dependency graph, which is a graph showing all directly following activities above a certain specified frequency threshold. During the second step, the algorithm turns the dependency graph into a causal net. It does so by checking a specified window of activities before and after each activity and counting how often the input and output activities occur on their own or together. An event log like \(L=\{\)_<acdes_>\({}^{10}\), _<aced_>\({}^{10}\), _<bcde_>\({}^{5}\), _<bced_>\({}^{5}\), _<abcde_>\({}^{1}\}\) will lead to the output shown in Figure 4.  
Figure 4: Output of heuristic miner.