# Improving Vulnerability Management Through Process Mining
## 3 Process Mining  
A common definition of process mining is that its goal is to \"discover, monitor and improve real processes (i.e., not assumed processes) by extracting knowledge from event logs\" [9] (p. 172). It is the bridge between business process modeling (BPM) and data mining in that it uses data mining techniques to support and enhance BPM. BPM includes managing, controlling, and supporting business processes. The goal is usually to increase productivity and decrease the cost of processes. BPM often uses information technology (IT) to reach its goal, e.g., to analyze or automate a process. According to the BPM life cycle (Figure 1), in the design phase, a process is designed and a process model is drawn. This model is then integrated into a support system in the implementation phase. The running processes are monitored in the enactment/monitoring phase. Small changes can be made in the adjustment phase. In the evaluation/requirements phase, the process gets evaluated for necessary bigger changes, which are then implemented in the redesign phase in a new cycle. Figure 1 also shows that BPM includes creating a process model and process data that are again used in different phases of the management cycle. The data and models do not interact, however. There, process mining comes in. Process mining uses the data created in a process to create, monitor, and improve process models. By means of data mining, predictions can be calculated, and thus decision making can be supported. Supervised methods work with labeled data, and unsupervised methods with unlabeled data. Data mining methods include classification, regression, clustering, or association rule mining. None of these techniques, however, look at end-to-end process models. As such, data mining differs from process mining, although process mining uses some existing data mining techniques for BPM support. However, there are specific methods for process mining. They use an event log to obtain insights on an end-to-end process. An event log is a \"set of traces [...] consisting of the sequence of events related to a given case\" [29] (p. 1). The simplest event log is a list of events in the order that they happened with their corresponding cases [30]. The left table in Figure 2 shows such a simple event log with twelve events. Each event is related to one of three cases (1, 2, 3) and refers to one of four activities (\(a\), \(b\), \(c\), \(d\)). Following each case from top to bottom, two different traces appear: <\(abcd\)> (case 1 and 3) and <\(acdb\)> (case 2). This simple event log can also be notated as a set of traces like \(L=\{\)_abcd>\({}^{2}\)_, <\(acdb\)>\({}^{1}\}\). The right table of Figure 2 shows an aggregated event log. Using this event log, a process model can be drawn using Business Process Modeling Notation (BPMN). In addition to case and activity, event logs can also contain more attributes, such as a timestamp, resource usage, and user data [30]. Event logs like these are created in most modern information systems. Consequently, the data required for process mining are usually available. There are three major categories of process mining found in the literature: process discovery, process conformance, and process enhancement [30; 31]. Figure 3 describes the different inputs and outputs of the approaches. Each approach takes an event log as input. As shown in Figure 2, process discovery creates a process model out of this event log [9; 29]. Process conformance takes an event log and a model as input [9; 32]. This model might be the target process or a discovered trace. The output are diagnostics about how much the input model matches the event log [32]. The third category is process enhancement. Figure 1: BPM life cycle. The input is again an event log and a model [30]. This model is usually the discovered model, which gets enriched with more information through process enhancements, such as throughput time, bottlenecks, and frequencies [9].