Flexibility and evolution have been a hot topic in the context of business process management. However, contemporary process mining techniques assume processes to be in a steady state, which will result in a mixed-model mined from the event log. Business process drift detection is a family of methods to detect changes by analyzing the event log, but existing methods have some disadvantages in dealing with concept drifts. First, most of these methods detect changes depending on an exploration of a potentially large feature space and are time consuming. Second, with the size of delay period becoming small, the accuracies of some methods will drop rapidly. In this article, we address these problems by proposing a novel drift detection technique called LCDD that significantly differs from existing methods. The core idea is to find out new features and disappeared features from traces after the log fragment meets local completeness. To begin with, we use the relations of direct succession as the lightweight feature, which are compared between two windows (complete window and detection window). Then, we find new direct successions and stable disappeared direct successions by just moving detection window. Finally, the forgetting mechanism is used to abandon some direct successions after finding a change point. An extensive empirical evaluation shows that LCDD is faster and more accurate.

Many activities in business process management, such as process retrieval, process mining, and process integration, need to determine the similarity between business processes. Along with many other relational behavior semantics, Transition Adjacency Relation (abbr. TAR) has been proposed as a kind of behavioral gene of process models and a useful perspective for process similarity measurement. In this article we explain why it is still relevant and necessary to improve TAR or pTAR (i.e., projected TAR) computation efficiency and put forward a novel approach for TAR computation based on Petri net unfolding. This approach not only improves the efficiency of TAR computation, but also enables the long-expected combined usage of TAR and Behavior Profiles (abbr. BP) in process model similarity estimation.

Event logs are the basis of process mining techniques and tools that extract process behavior information for better understanding and optimization of business processes. While it has been widely realized that the degree of completeness of event logs may largely determine the effectiveness of these techniques, how to estimate the completeness of event logs has not yet been fully addressed. This is mainly because ground-truth process models are usually unknown. To attack this problem, we pay a closer look to several concepts and implicit assumptions in the log completeness estimation problem and characterize it as a special case of the species estimation problem in the field of statistics. Although species estimation is still an open problem, a number of statistic models and techniques with approximate solutions have been available. To investigate the relevance of these methods for event log completeness estimation, we have designed and conducted a wide scope of empirical study and quantitative experiments on both real-world and synthesized event logs to compare the performance of these methods. In addition, the completeness estimation of several important and widely used real-world events logs are reported for the first time together with some best practice experience learned through this research.

Information source detection, which is the reverse problem of information diffusion, has attracted considerable research effort recently. Most existing approaches assume that the underlying propagation model is fixed and given as input, which may limit their application range. In this paper, we study the multiple source detection problem when the underlying propagation model is unknown. Our basic idea is source prominence, namely the nodes surrounded by larger proportions of infected nodes are more likely to be infection sources. As such, we propose a multiple source detection method called Label Propagation based Source Identification (LPSI). Our method lets infection status iteratively propagate in the network as labels, and finally uses local peaks of the label propagation result as source nodes. In addition, both the convergent and iterative versions of LPSI are given. Extensive experiments are conducted on several real-world datasets to demonstrate the effectiveness of the proposed method.

Provenance Based Access Control (PBAC) is a new access control mechanism wherein the access control decisions are made based on a set of assertions about provenance traces. Manually designing a variety of provenance based security policies is not trivial work for big data applications with large amount of provenance entity types and complex provenance dependencies. Policy retrieval can reduce such manual labor by automatically "learning" policies from previous provenance traces. In this paper, we look into the composition of PBAC rules to determine the relevant knowledge that should be mined from provenance traces for policy retrieval. We propose a baseline retrieval approach which composes the mined knowledge into candidate rules and verifies them by feeding them into a decision-tree classifier as candidate classification features. We show the feasibility and limitations of the baseline approach with experimenting and thereby present suggestions about the future work for PBAC policy retrieval research.