Using Process Mining and Model Driven Engineering to Enhance Security of Web Information Systems.

1. Provider: Mr. S.Mostafa Sayyedi
Using Process Mining and Model Driven Engineering
to Enhance Security of Web Information Systems
Lesson: Special Topics
Professor: Mr. Zamani
May 2018

2. Abstract
In this Paper, We Propose a Method Based on Process Mining and Model Driven Engineering to Improve the Security of Web Information Systems.
Page: 1
Abstrac
t

3. Simona Bernardi
Centro Universitario de la Defensa
Zaragoza, Spain
Forest Company
Raul Piraces Alastuey
Universidad de Zaragoza
Zaragoza, Spain
Raquel Trillo-Lado
Universidad de Zaragoza
Zaragoza, Spain
2017 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)
Page: 2
About the Article

4. Page: 3
According to the Security Reports by Symantec, the Number of Attacks to Web Information Systems in 2015 is the Double as in 2014.
Introduction

5. Page: 4
According to the Security Reports by Symantec, the Number of Attacks to Web Information Systems in 2015 is the Double as in 2014.
Introduction

6. Page: 5
According to the Security Reports by Symantec, the Number of Attacks to Web Information Systems in 2015 is the Double as in 2014.
Introduction

7. Page: 6
According to the Security Reports by Symantec, the Number of Attacks to Web Information Systems in 2015 is the Double as in 2014.
Introduction

8. Page: 7
Web Information Systems are Usually Composed of Two Main Components:
Front-end Backend
Introduction

9. Contents
II RelatedWork
III
IV Getting a Normative Model
Method Overview
Page: 8

10. VI Identification andAnalysis of Deviations
VII
… Acknowledgment
Conclusion
VLog Processing
Page: 9

11. SIEM
Preventive Approaches Establish Rules in Security Information and Event Management (SIEM) Systems to Reduce or Remove the
Success Conditions of Cyberattacks
Page: 10
II. Related Work
The Proposed Method is Based on the Process Mining Discipline Which Provides Techniques for Process Discovery, i.e., Deriving
Process Models from Logs, Conformance Checking, i.e., Checking the Alignment of an Existing/Derived Process Model and Logs,
and Process Enhancement, i.e.

12. Three Types of Process Mining
II. Related Work
What is Process Mining?
Techniques Allow for Extracting Information from Event Logs.
Page: 11

13. Process Mining Tools Can Ingest information Once Prepared in This Simple
II. Related Work
What is Process Mining?
Example:
Page: 12

14. III. Method Overview
Page:

15. 1 2 3 4 5
Step1
Specification of the
System Behavior by
Means
of the Unified
Modeling Language
(UML)
Step2
Automatic Generation
of a Formal Model
from the UML-Based
Specification that
We Call Normative
Model.
Step3
Control and
Monitoring of the
Web Information
System to Get Data
Logs that Represent
its Operative (or
Real) Behavior.
Step4
Pre-processing of
the Logs of the
System to Get Event
Logs, Which Can be
Analyzed Using
Process Mining
Techniques.
Step5
Identification of
Deviations Between
the Normative Model
and the Operative
Behavior by Means of
Different Process
Mining Techniques.
III. Method Overview
Page: 14
The Proposed Method Consists of Five Main Phases or Steps:

16. Overview of the Proposed Method
III. Method Overview
Page: 15

17. SID BiD is a Web Information System Developed with Java Technologies Available at http://sid.cps.unizar.es/BiD/
III. Method Overview
Case
Study:
Page: 16

18. BDI research group website: http://bdi.si.ehu.es/bdi/
III. Method Overview
Case
Study:
Page: 17

19. OEG Research Group Website: http://mayor2.dia.fi.upm.es/oeg-upm/
III. Method Overview
Case
Study:
Page: 18

20. IV. Getting a Normative Model
Page: 19

21. Each Action Represents an HTTP Request from the User:
BiD System Main Functionalities
IV. Getting a Normative Model
Page: 20

22. SID BiD UML Activity Diagram:
BiD System Behavioral View (Partial)
IV. Getting a Normative Model
Page: 21

23. Describe Petri Net
Model
Page: 22

24. Describe Petri Net Model:
IV. Getting a Normative Model
Page: 23 Shop Card Reader System

25. The Petri Net Model has been Automatically Generated from the Activity Diagram by
Using the DICE Simulation Tool
Petri Net Normative Model
IV. Getting a Normative Model
Page: 24

26. V. Log Processing
Page: 25

27. Apply Process Mining Techniques an Event in an Event Log Must Refer to:
A case
A Case is a Particular Execution of a Process,
Thus Each Event Refers to a Trace (or Sequence) of Related
Events Associated to the Execution of a Process.
An activity
An Activity is an Action or Task to be Performed in a
Process (as a Process is a Set of Coordinated
Activities or Actions to Achieve a Particular Goal).
A Timestamp
A Timestamp is a Mark Indicating When the Event Happened
Other Information
Other Specific Data or Information Related to the
Execution of the Activity
01
02
03
04
Process Mining
V. Log Processing
Page: 26

28. Real Behaviour of System:
1) The Work Sessions of the Users. This Work Sessions are Studied to Analyze How a Particular
User Interacts With the System in a Work Session.
2) The Use Cases Executed by a User. This Parameter is Used to Analyze How a Particular User
Interacts With the System in a Work Session When She Wants to Achieve the Goals Associated to a
Particular Use Case.
V. Log Processing
Page: 27

29. Two Entries Belong to the Same User Session if and Only if:
IP
They Come from the Same
IP Address
Time
The Time Elapsed Between
the Two Entries is Less
than a Certain Threshold (in
Our Case We Considered 30
minutes)
User
They Have Been Performed
by the Same User if the
Studied Web Application
Allows Different Users
Browser
They Come from the Same
Browser
V. Log Processing
Page: 28

30. Heuristic
to Identify the Use Case Performed by a
User (HUseCase)
2
1) Updating the Code (the Implementation)
of the
Web Information Systems in Order to
Include the
Use Case Identifier Being Executed in the
Logs of
the Web Server
2) Tagging the Logs Entries With Use Case
Identifiers
Two Possible Strategies for
Heuristic:
V. Log Processing
Page: 29

31. Two Options Were Evaluated to Tag the Log Entries With an Appropriate
Case Use Identifier:1) Tagging Based on the Entry Web Pages (or
URL) of the Use Cases
Tagging Based on the Entry Web Pages of the Use
V. Log Processing
Page: 30

32. Two Options Were Evaluated to Tag the Log Entries With an Appropriate
Case Use Identifier:2) Tagging Based on the Longest Path of Consecutive
Activity Events of a User
Tagging Based on the Longest Path of
V. Log Processing
Page: 31

33. VI. Identification and Analysis of Deviations
Page: 32

34. A. Identification of
Deviations
Anomalous Trace
VI. Identification and Analysis of Deviations:
Page: 33

35. B. Attack Detection and Process
Enhancement
Fuzzy Model from Filtered Logs
(Partial Delivery)
VI. Identification and Analysis of Deviations:
Page: 34

36. http://www.website.com
Process Mining and MDE
In this Work, a Method Based on
Process Mining and
Model Driven Engineering has
been Proposed in Order to
Improve the Security of Web
Information Systems.
Java Enterprise Edition
Despite the Fact that the
Experimental Results have
been Obtained by Considering a
Particular Technology to Build
Web Information Systems (in
Particular, JEE), the Proposed
Approach is Technology
Independent ZABBIX
Our First Next Goal is
Incorporating a Security
Information and Event
Management System (SIEM),
Such
as Zabbix8, to Monitor the
Activity of the SID BiD System
Page: 35
VII. Conclusion

37. Acknowledgment
Page: 36

38. Acknowledgment
Page: 37
This Work has been Partially Funded by the Following
Projects:
“Desarrollo de tecnicas de detecci ´ on de ciber- ´
ataques en sistemas de informacion mediante miner ´ ´ıa
deprocesos” (UZCUD2016-TEC-06),
“Infraestructuras cr´ıticas
resistentes a ciber-ataques: Aplicando la miner´ıa de
procesos
y el diseno software orientado a la seguridad” [CyCriSec- ˜
TIN2014-58457-R], and “Developing Data-Intensive Cloud
Applications with Iterative Quality Enhancements”
[DICEH2020-644869]

39. Question
And
Answer

40. THANK YOU!
F o r Yo u r A t t e n t i o n