# Improving Vulnerability Management Through Process Mining
###### Abstract  
With the number of cyber-attacks growing rapidly and the opportunities to attack companies widening, vulnerability management is gaining increased importance. It needs to reduce the variety of possibilities by remediating vulnerabilities found in IT infrastructures. Process mining is an established method used to discover, analyze, and manage data on (implemented) business processes. This paper proposes utilizing process mining for business-critical processes, including IT processes. This work explores how vulnerability management processes can be improved through process monitoring, targeting the operation time of processes, remediation, and the continuous management of the vulnerability process design. Thereby, process mining is applied for monitoring following the CRISP data mining approach. Process analysis includes process discovery, conformance checking, and process enhancement. Improving the vulnerability management process is based on the discovered vulnerability process, which is enhanced with throughput time data as well as priority, source, and assignment group data. Improvements concern changing the configuration of a source and better training for certain assignment groups. Process discovery can also be used to identify the cause for improper remediation of vulnerabilities. In this case, unwanted activity flows, which indicate that a major part of the vulnerability management process is being skipped, need to be identified. Finally, the continuous use of process mining allows for the monitoring of process modifications, including the impact of implemented improvements.  
vulnerability management; cyber-attacks; thread handling; process mining; process discovery; business process management; process optimization Article  
1  
<ccs2012> <concept>  
However, there is a lack of research in the improvement of vulnerability management through better process monitoring. Since every vulnerability poses a risk to the company until it is fixed, this remediation is time-sensitive. Improving vulnerability management can therefore be achieved by making the process faster [4]. Furthermore, vulnerability management needs to make sure vulnerabilities are remediated properly, which can be achieved by better conformance with a well-defined process.  
Therefore, the aim of this paper is to find out how to improve the vulnerability management process by using process mining as a monitoring method. Process mining is understood as a method used to \"discover, monitor and improve real processes [...] by extracting knowledge from event logs\" [9] (p. 172). It needs to be investigated how monitoring activities of operational processes can help to identify improvements of the vulnerability management process of a company. This requires respective data integration activities for process analysis to distill options for more effective vulnerability management processes. These activities are based on CRISP-DM (Cross-Industry Standard Process for Data Mining), a widely used framework for developing data mining and analytics projects by [PERSON] [10]. It provides a structured, six-phase approach: business understanding, data understanding, data preparation, modeling, evaluation, and deployment. Accordingly, these phases were applied in the course of our project.  
This paper is organized as follows. The second and third section provide existing findings on processes for managing vulnerability. Section 2 introduces vulnerability management as an operational objective, its significance, and an exemplary high-level process. It also briefly reflects on recent research in the field. Section 3 introduces process mining, providing a definition as well as explaining the main operational approaches by providing exemplary algorithms. Section 4 discusses a vulnerability management project carried out to demonstrate the effectiveness of process mining techniques for improving vulnerability management processes. Section 5 concludes this paper.