From Network Traffic Data to Business Activities: A Process Mining Driven Conceptualization

Event logs are the main source for business process mining techniques. However, they are produced by part of the systems and are not always available. Furthermore, logs that are created by a given information system may not span the full process, which may entail actions performed outside the system. We suggest that data generated by communication network traffic associated with the process can fill this gap, both in availability and in span. However, traffic data is technically oriented and noisy, and there is a huge conceptual gap between this data and business meaningful event logs. Addressing this gap, this work develops a conceptual model of traffic behavior in a business activity. To develop the model, we use simulated traffic data annotated by the originating activity and perform an iterative process of abstracting and filtering the data, along with application of process discovery. The results include distinct process models for each activity type and a generic higher-level model of traffic behavior in a business activity. Conformance checking used for evaluating the models shows high fitness and generalization across different organizational domains.