Unsupervised 2D image-based 3D model retrieval (IBMR) aims to retrieve semantically relevant 3D shapes for a given 2D image query when 3D annotations are unavailable. This setting is challenging due to severe modality gaps, category-imbalanced mini-batches, inconsistent cross-domain decision boundaries, and mismatched semantic neighborhood structures. In this paper, we propose a unified framework that integrates Category-Aligned Sampling (CAS), Decision Boundary Alignment (DBA), and Graph Semantic Propagation (GSP) into a single optimization paradigm. CAS constructs category-consistent mini-batches to stabilize crossmodal learning. Built upon CAS, DBA leverages a masked Margin Disparity Discrepancy to regularize cross-domain class decision boundaries via an adversarial min-max objective, encouraging discriminative separation beyond marginal feature matching. To complement boundary-level regularization, GSP builds a crossdomain affinity graph over 2D and 3D samples and propagates supervision-induced relational structure through semantic message passing, explicitly preserving instance-level neighborhood consistency that is critical for retrieval. Extensive experiments on MI3DOR and MI3DOR-2 demonstrate consistent improvements over representative unsupervised IBMR baselines.

Adversarial attacks pose a significant threat to machine learning models by inducing incorrect predictions through imperceptible perturbations to input data. While these attacks are well studied in unstructured domains such as images, their behaviour on tabular data remains underexplored due to mixed feature types and complex inter-feature dependencies. This study introduces a comprehensive benchmark that evaluates adversarial attacks on tabular datasets with respect to both effectiveness and imperceptibility. We assess five white-box attack algorithms (FGSM, BIM, PGD, DeepFool, and C&W) across four representative models (LR, MLP, TabTransformer and FT-Transformer) using eleven datasets spanning finance, energy, and healthcare domains. The benchmark employs four quantitative imperceptibility metrics (proximity, sparsity, deviation, and sensitivity) to characterise perturbation realism. The analysis quantifies the trade-off between these two aspects and reveals consistent differences between attack types, with ℓ ∞ -based attacks achieving higher success but lower subtlety, and ℓ 2 -based attacks offering more realistic perturbations. The benchmark findings offer actionable insights for designing more imperceptible adversarial attacks, advancing the understanding of adversarial vulnerability in tabular machine learning.

With the proliferation of urban vehicles, traditional static edge computing faces significant challenges in ensuring service quality under high mobility. To address this issue, this paper investigates Non-Terrestrial Networks (NTNs) enabled by high-altitude platforms (HAPs) and unmanned aerial vehicles (UAVs), and proposes a Hotspot-Guided Collaborative Matching Offloading (HGCMO) framework for task hotspot regions (THRs). The objective is to jointly optimize energy consumption and computational latency. Specifically, we develop a stable matching-based UAV-Hotspot algorithm (UHRMA) and a density-delay-driven positioning scheme (DDUPO) to optimize resource allocation and deployment. Furthermore, a Dynamic Weighted Load-Aware Offloading Algorithm (DWLAO) is introduced to balance task delay and energy consumption under resource constraints. DWLAO dynamically balances latency and energy according to system load. The framework is evaluated under varying traffic intensity, user density, and UAV computing resources. Simulation results demonstrate that the proposed HGCMO-based scheme achieves significant performance gains compared with baseline methods, validating its effectiveness in hotspot-driven task offloading scenarios.

Large-scale Visual-Language Models (LVLMs) have achieved remarkable success in natural visual tasks, yet their application to industrial defect detection remains challenging due to two fundamental limitations: (i) the scarcity of large-scale industrial datasets that cover diverse defect categories across multiple domains, and (ii) the reliance on manual prompts (points, boxes, masks) that introduce subjective noise and lack text-visual interaction for fine-grained understanding. To address these challenges, we introduce a Large-Scale Multi-Modal Industrial Open-Closed benchmark (MMIOC-1 M) containing over one million samples across 14 super-categories, 29 industrial scenes, and 351 defect subcategories. To our knowledge, MMIOC-1 M is the first unified largest benchmark supporting both open-vocabulary and closed-set industrial detection, providing valuable pre-training data for LVLMs in industrial scenarios. Furthermore, we propose a Refined Text-Visual Prompt Network (RTVPNet) that incorporates three key innovations: (1) an expert-assisted domain projection mechanism that enables rapid adaptation of general vision models to industrial domains, (2) an energy-based sparse sampling strategy that automatically generates refined visual prompts without manual intervention, and (3) a bidirectional text-visual interaction module that enhances cross-modal semantic alignment and understanding. Extensive experiments demonstrate that RTVPNet achieves state-of-the-art performance on MMIOC-1 M, LVIS, and COCO benchmarks while maintaining computational efficiency.

Detecting malicious attacks is essential for protecting computer systems and ensuring device security. Federated Learning (FL)-based Intrusion Detection Systems (IDS) have emerged as promising solutions, enabling multiple clients (i.e., data owners) to collaboratively train intrusion detection models without sharing private data. However, current FL studies typically assume that each client’s training and test label distribution is identical. This assumption is overly idealistic and rarely holds in real-world scenarios, leading to suboptimal performance when label distribution shifts occur between the training and testing data. To address this challenge, we propose FedPRO, a plug-and-play framework designed to improve the test-time performance of existing FL methods, without modifying their original training pipelines or fine-tuning the trained FL models. Specifically, we develop a unique prototype generation and optimization mechanism to produce semantically meaningful class prototypes. These prototypes constitute a prototype memory bank, serving as an external knowledge repository. At test time, a prototype retrieval-augmented inference strategy is employed to query relevant prototypes and refine predictions on each client, effectively alleviating the label distribution shift issues and boosting prediction accuracy. We evaluate FedPRO by integrating it with various off-the-shelf FL methods on benchmark datasets. Extensive results consistently demonstrate its effectiveness in diverse settings. Notably, applying FedPRO to the state-of-the art method FedDBE improves its test accuracy from 79.25% to 86.66% on the CICIDS-2018 dataset, while introducing only approximately 32KB of additional communication overhead.

Vehicle-to-Infrastructure (V2I) collaboration constitutes an emerging paradigm for advancing autonomous driving. However, the integrated collaboration of perception, communication, and computation within V2I system remains a critical challenge. To address it, we propose a Software-Defined Network (SDN)-based collaborative approach for Autonomous Vehicle and Road Infrastructure Network (AVRIN). The architecture designates road infrastructures as road nodes and autonomous vehicles as dynamic vehicle nodes, establishing AVRIN through SDN. The control plane dynamically maintains global network topology and distributed flow tables by continuously evaluating node accessibility, while the forwarding plane is responsible for packet transmission via the OpenFlow protocol. In the perception module, road nodes divide the perception range into spatial units, whereas vehicle nodes dynamically align these units with their drivable areas across temporal sequences. Through coordinated communication and computation modules, road nodes strategically allocate dedicated bandwidth and computational resources. Building on this approach, we develop a particle swarm-based multi-objective optimization algorithm to achieve balanced co-optimization across perception, communication, and computation. Experimental validation demonstrates its superior collaborative Bird's Eye View (BEV) detection performance on the V2X-Sim 2.0 dataset, outperforming existing approaches by 10.37% in mean Average Precision. Furthermore, evaluations on the newly collected Jiading dataset, from a real-world urban roadway, confirm the approach's robustness with 1.823-second computation time under dynamic network conditions.

Process execution time is a key performance indicator for evaluating bottlenecks in business processes. Cases and activities that exceed the specified time constraints can be seen as anomalies, affecting process performance and leading to risks such as delays and customer complaints. Identifying the root causes of these anomalies can help formulate effective intervention measures. However, this task is inherently complex, and conducting incomplete or inaccurate analysis can result in misguided interventions that inadvertently exacerbate process inefficiencies. To address these challenges, this paper proposes a traceability-based root cause analysis approach for process performance anomalies using causal inference. Specifically, the approach begins by extracting hidden contextual information from the event log to enrich the pool of potential causal factors. Then formulates causal hypotheses linking these factors to observed performance anomalies (at both the case and activity level) and establishes potential causal relations through a traceability mechanism. A meta-learning based causal inference approach is used to estimate the strength of causal effects. The proposed approach is evaluated against a state-of-the-art approach using four synthetic event logs with known root causes and nine public real-life event logs. Experimental results demonstrate that the proposed approach delivers accurate insights into the root causes of process performance anomalies in synthetic event logs, while maintaining high efficiency in the comprehensive analysis of potential causal factors.

Large volumes of event logs have been accumulated by business information systems. Accompanied by that, various process discovery techniques are invented to uncover underlying business processes based on event logs. Event log sampling, recognized as one of the most effective techniques for accelerating discovery efficiency, has gained significant attention in recent days. However, achieving high performance in sampling while maintaining superior sample log quality remains a challenge for current techniques. To tackle the problem, a novel event log sampling technique, denoted assigRank, is introduced to improve both the sampling efficiency and the quality of the sample log by quantifying the significance of each trace. The proposed sampling technique has been implemented as a publicly available tool in the open-source process mining platform ProM. Compared with state-of-the-art techniques using 12 public event logs, we experimentally illustrate that the proposed approach can significantly accelerate sampling efficiency while guaranteeing superior sample log quality for process discovery.

Process discovery aims to derive a process model that accurately represents the observed behavior in an event log. As a state-of-the-art process discovery technique, Inductive Miner (IM) generates sound process models (i.e., free of deadlocks) while ensuring optimal replay fitness. However, IM may sometimes produce over-generalized process models with locally imprecise structures, often resulting in the creation of so-called flower structures. To address this limitation, this paper presents a novel technique that refines the process model generated by IM by optimizing its imprecise sub-processes. Specifically, the technique begins by identifying and extracting sub-logs corresponding to imprecise sub-processes in the initial IM-generated process model. Then, these imprecise sub-processes are iteratively optimized using a frequency-based filtering mechanism applied to the sub-logs. Once optimized, the imprecise sub-processes in the initial process model are replaced by the optimized ones, generating a set of candidates process models. Finally, the candidate with the best quality, in terms of fitness and precision, is selected as the final optimized process models. The proposed technique has been implemented as a plugin for the open-source process mining platform ProM. Through comparisons with state-of-the-art process discovery techniques using 10 publicly available real-life event logs, the experimental results demonstrate that the proposed method achieves an average absolute improvement of 0.173 in F-measure over its IMi variant, while also exhibiting competitive performance relative to other state-of-the-art approaches.

Existing Predictive Process Monitoring (PPM) methods typically rely on static offline methods, limiting their ability to adapt to dynamic process evolution driven by emerging activities and shifting behavioral patterns. This constraint is particularly critical for multi-task prediction, such as the simultaneous forecasting of the next activity and the remaining process time. To address this challenge, we propose an online multi-task prediction framework based on dynamic graph representations. The framework enables a Graph Neural Network (GNN) to incrementally learn newly emerging activities by leveraging dynamic graph snapshots and an architecture expansion strategy. For efficient online adaptation, the framework incorporates two update strategies, a standard periodic update and a drift-aware adaptive update triggered by the Maximum Mean Discrepancy (MMD2) between subgraph embeddings. Both strategies are integrated with a Prioritized Experience Replay (PER) mechanism, augmented with a rarity-aware bonus, to ensure rapid and robust model adjustments in non-stationary environments. Comprehensive experiments on multiple real-world event logs demonstrate that our framework, when combined with different GNN backbones such as GCN, GAT, and GIN, significantly outperforms state-of-the-art baselines in both next-activity and remaining time prediction. Notably, under concept drift, the proposed drift-aware strategy exhibits strong adaptability, highlighting the framework’s effectiveness and potential for addressing complex online process prediction challenges.

Predictive Process Monitoring (PPM) aims to predict the future states of ongoing process instances. A primary objective is to accurately predict process outcomes while ensuring decision transparency, which is critical for enhancing process efficiency and reducing operational risk. Existing interpretable approaches to process monitoring often struggle with balancing transparency and reliability. Specifically, approaches that prioritize transparency often fall short in predictive accuracy and generalization, while those that achieve higher prediction performance often provide less reliable explanations. To address these limitations, we propose a novel Transparent Process Outcome Prediction framework (TPOP) using a graph neural network with stochastic attention. We begin by applying a SHAP-based feature selection technique to identify and extract the most relevant attributes from the log, thereby improving the quality of graph-based process representations. Next, we introduce a graph stochastic attention mechanism, which helps the model in concentrate on key paths and activities during training, leading to transparent and trustworthy predictions. Experimental evaluations on ten real-life event logs demonstrate that our approach outperforms state-of-the-art approaches in both predictive performance and interpretability. Furthermore, by visualizing how specific activities influence process outcomes across various cases, we confirm the reliability of the explanations generated by our approach.

The rapid expansion of Internet of Things (IoT) devices has led to an explosion of event data, posing significant challenges for traditional process model discovery techniques in terms of scalability and discovery accuracy. These techniques rely on centralized storage and processing, which are hindered by data transfer limitations, storage capacity, and computational overhead in distributed IoT environments. Edge-based model discovery techniques offer a promising solution for analyzing large-scale IoT data. However, existing techniques suffer from low efficiency and an inability to handle complex process structures. To address these challenges, we propose EdgeIM, an efficient edge-based process model discovery technique that enhances efficiency and model accuracy. EdgeIM operates in three key stages: preprocessing and feature-preserving sampling to eliminate redundant data, local processing at edge nodes to extract key structural features, and global feature aggregation at a central node for model discovery. EdgeIM has been implemented on the open-source process mining platform PM4Py, and experimental results on nine public event logs demonstrate that, compared to existing edge-based model discovery techniques, EdgeIM significantly improves discovery efficiency while maintaining high model quality.

Manufacturing process discovery extracts insights from event logs recorded by Manufacturing Information Systems (MISs) to optimize operational processes. However existing process discovery techniques struggle with complex concurrency relations, resulting in imprecise sub-processes that compromise model accuracy. This paper proposes a novel enhancement to Inductive Miner (IM)-generated models by optimizing local imprecise structures in manufacturing process models. The method first identifies imprecise sub-processes and extracts their corresponding sub-logs. Then imprecise sub-processes are incrementally optimized using a frequency-based filter mechanism, generating multiple candidate models. Finally, the best-quality candidate model based on evaluation metrics is selected as the final output. The proposed technique has been implemented as an open source process mining toolkit ProM plugin and evaluated on six real-life manufacturing event logs. Experimental results demonstrate that it outperforms state-of-the-art techniques, producing higher quality process models, making it particularly suited for manufacturing process discovery.

The dynamic topologies and sensitive information exchanged among autonomous vehicle groups make them prime targets for attackers. In particular, in a collusive attack scenario, malicious nodes can collaborate to manipulate the trust evaluation system, thereby compromising the security of the entire vehicle group. To handle this limitation, this work proposes a privacy-preserving method for forming autonomous vehicle groups in a collusive attack scenario. First, we introduce a distributed trust evaluation algorithm based on a federated learning topology, which preserves local data privacy while facilitating reliable inter-vehicle trust computation. Then, we propose a PageRank-based detection mechanism that analyzes the trust propagation network to identify potential collusive attackers. Finally, we present a privacy-preserving method for autonomous vehicle group formation. Experimental results show that our proposed approach significantly improves the security and stability of autonomous vehicle groups compared to existing methods.

The prediction of remaining execution time is a critical area of research in business process monitoring. However, limited data availability and deficiencies in existing models have hindered progress in this area. To address these challenges, we introduce two production log datasets, coarse-grained log for television (CGL-TV) and fine-grained log for television (FGL-TV), collected from a semiautomated assembly line for television manufacturing. These datasets aim to address the issue of data scarcity in monitoring, analyzing, and optimizing the manufacturing process. Then, we investigate the significance of role information in semiautomated production processes and propose a novel feature selection strategy. That strategy replaces the traditional activity attributes with role attributes as the basis for prediction, resulting in a significant improvement in prediction accuracy. Furthermore, existing recurrent neural network (RNN)-based prediction methods have two major drawbacks: limited ability to capture long-term dependencies and the inability to parallelize computations. To address these issues, we propose a novel transformer-based remaining time prediction (TRTP) model. This model utilizes the self-attention mechanism instead of hidden state passing, which effectively incorporates global contextual information and enables potential parallel computing. The experimental results across four datasets demonstrate that our proposed method achieves state-of-the-art performance, e.g., a 5.2% performance gain on FGL-TV.

Predictive Process Monitoring (PPM) aims to predict the future state of running process instances to enable timely interventions to mitigate potential risks. As one of the most fundamental tasks in PPM, process remaining time prediction focuses on preventing timeout occurrences. While various deep learning-based approaches have been developed for this purpose, they often rely on pre-established static prediction models and struggle to maintain accurate predictions when the process undergoes dynamic changes, such as an expanding sales channels. To tackle this challenge, this paper proposes an incremental process remaining time prediction framework by continuously updating the prediction model based on an incremental event log. Specifically, a feature selection strategy is first introduced to extract effective features from event logs. Leveraging effective features can significantly improve the prediction quality by capturing the changes in process information. Then, three incremental log-based updating mechanisms, including period-based updating, quantity-based updating, and concept-drift-based updating, along with a reconstruction strategy, are proposed to dynamically adjust the prediction model in response to business changes. Finally, LSTM, Transformer, and Auto-encoder models are adapted and integrated into the proposed framework. The approach has been implemented and publicly released. Experimental evaluation using nine real-life event logs demonstrate that the proposed framework and its three instantiations (i.e., LSTM-based, Transformer-based, and Auto-encoder-based ones) outperform state-of-the-art techniques in terms of prediction accuracy.

More and more business applications are crossing organization boundaries and typically involves a set of interactive organizations, known as cross-organization business process management. By taking as input the distributed event logs of each organization, cross-organization process mining techniques can reconstruct the underlying business process model to help process comprehension and improvements. Unfortunately, existing process mining techniques completely ignore the privacy issue, i.e., the privacy of the event log and business process model is not guaranteed. To cope with this challenge, this paper proposes a privacy-preserving cross-organizational business process mining framework based on blockchain and cryptography. Specifically, it mainly includes three steps: (1) each organization builds its private business process model, interaction messages, and collaborative tasks from its event log; (2) collaborative public process model for each organization is generated based on blockchain using privacy security intersection (PSI) cryptography algorithms to ensure the privacy of each organization; and (3) each organization combines its private business process model with relevant public process models, to obtain an organization-specific collaborative business process model. Using four public cross-organization datasets, the privacy-preserving ability and application of the proposed technique is demonstrated.

Summary Event log sampling has emerged as a key research focus in the field of process mining, aiming to enhance the efficiency of various process mining tasks, including model discovery, conformance checking, and process prediction. However, current log sampling techniques often fail to ensure high‐quality sample logs. This paper introduces a novel framework to support efficient event log sampling without compromising the quality of the sample log compared to the original one. The approach revolves around the consideration of directly‐follows relation (DFR) among business tasks as the fundamental behavior unit of an event log. By ensuring the DFR equivalence between the original and sample logs, the proposed technique addresses the challenge of sample log quality from the model discovery point of view. The framework is instantiated by seven distinct sampling strategies each has its own specialty and is fully implemented in the open‐source process mining tool platform ProM. To validate its effectiveness, we conducted a comprehensive experimental evaluation using 12 publicly available real‐life event logs against state‐of‐the‐art sampling techniques. The results clearly demonstrate that our technique significantly improves model discovery efficiency while upholding high quality of the discovered models.

Predictive Process Monitoringaims to predict the future information of ongoing process executions by leveraging machine and deep learning techniques. One of the tasks is known asremaining time prediction, which focuses on predicting the remaining time of ongoing cases. Accurate remaining time prediction can be valuable and important for improving business operations or taking timely interventions to prevent delays. For predicting the remaining time, existing work has used deep learning techniques to achieve high prediction accuracy. However, most of these techniques tend to learn very complex models that are difficult to explain. Systematic feature selection approaches may help improve both the prediction accuracy and the explainability of the model. In this paper, we introduce a feature-informed cascade prediction framework to predict the remaining time. Specifically, we first propose an approach that builds a tree of features by systematically estimating their effects on the remaining time prediction. Next, we use the tree to either automatically select an optimal combination of features or to guide users in this selection process. Each selected feature is correlated with its prediction results in our Feature-informed Cascade Prediction Model (FCPM) for explainability. The proposed approach has been implemented and is made publicly available. Using eight public real-life event logs, the proposed approach is compared to the state-of-the-art approaches in terms of prediction accuracy. In addition, it is demonstrated that our approach visualizes the impact of each input feature in the prediction of individual cases, producing explanations of the prediction results.

Process discovery aims to extract descriptive process models from event logs. To date, various process discovery algorithms have been proposed for different application settings. However, most of them meet challenges in handling event logs produced from hierarchical multi-instance business processes, in which multiple sub-process instances are invoked by the execution of a parent process. To address the problem, a novel approach is presented to support the discovery of hierarchical multi-instance process models. Specifically, taking event logs with multi-instance information as input, the detailed implementation of our method can be generally divided into four steps: nesting relation detection, hierarchical event log construction, sub-process case identification, and hierarchical multi-instance model discovery. We have implemented our approach properly as plugins in the openly accessible ProM toolkit, and compared its performance against the state-of-the-art process discovery approaches over six publicly available event logs. Based on the experimental result, it is demonstrated that the proposed approach can effectively discover hierarchical multi-instance process models with better quality.

Generally, a collaborative business process is a distributed process, in which a set of parallel business processes are involved. These business processes have complementary competencies and knowledge, and cooperate with each other to achieve their common business goals. To ensure the correctness of collaborative business processes, we propose a novel plan-based correctness enforcement approach in this article, which is privacy-preserving, available and efficient. This approach first requires participating organizations to define their business processes. Then, each participating organization employs a set of reduction rules to build the public process of its business process, in which all internal private activities and the flows formed by them are removed. Next, a set of correct plans is generated from these public processes. A plan is essentially a process fragment without alternative routings. From the external perspective (i.e., ignoring all internal private activities and the flows formed by them), a parallel execution of the business processes corresponding to these public processes follows only one such plan. Lastly, each participating organization independently refactors its business process using these resulting correct plans. Using the message places (corresponding to the actual communication interfaces), these refactored processes are composed in parallel. Thus, a correct and loosely coupled enforced process is constructed. This approach is evaluated on actual collaborative business processes, and the experimental results show that compared with state-of-the-art enforcement proposals, it can achieve correctness enforcement while protecting the business privacy of organizations and is available. Meanwhile, it is also more efficient and scalable, even a collaborative business process with tens of millions of states can be enforced within a few seconds.

When an emergency occurs, disposal needs to be built to reduce the risk imposed on life, property, and environment. Generally, the disposal is organized as a cross-organization emergency response process (CERP). To achieve better-emergency response services, its correctness analysis is an important task that needs to be dealt with at design time. In this article, we propose a novel correctness analysis approach for CERPs. Given a CERP, this approach first decomposes it into a set of instance nets. Then, it excludes the invalid instance nets (each corresponds to an incomplete process instance) and adopts the stubborn set to check the structural correctness of each valid instance net without considering resource factors, as well as introduces a structure-based resource analysis (SRA) method to determine whether the resources in it are sufficient. Finally, it determines the correctness of the CERP by comparing the numbers of the correct instance nets and all valid instance nets. If the CERP is incorrect, it returns the correct instance nets, which capture the parts of the CERP that can be executed correctly. This approach is evaluated on an actual data set, and the comparison results show that it outperforms the state-of-the-art technique in terms of effectiveness and efficiency.

Since the data-aware business process usually covers the control flow and data flow, and both of them have a direct impact on its execution, it is challenging to ensure its correctness. In this article, we propose a novel correctness enforcement approach for the data-aware business the processes. Given a data-aware business process, this approach first relies on the notion of the execution paths to capture all the parts of it that can be executed correctly. More specifically, it first splits the data-aware business process into a set of the execution paths, and then presents the notion of well-formedness to determine whether each execution path is correct. Based on these captured correct execution paths, an execution path-oriented strategy is generated, which is nonintrusive, and can enforce it to follow one of its correct execution paths during each execution, thereby realizing its correct execution. This approach is evaluated using the extensive experiments, which shows that it is effective and efficient, as well as scalable in practice.

Healthcare plays an increasingly essential role in our daily life. Modern Hospital Information Systems (HISs) record and store detailed medical treatment process information for all patients as event logs. By taking event logs as input, process mining techniques have been widely applied to extract valuable insights to improve medical treatment processes and deliver better healthcare services. However, considering the complexity of collaborations among different medical departments, existing model discovery techniques cannot be applied directly. To handle this limitation, this paper proposes a novel approach to support the discovery of Cross-department Collaborative Healthcare Process (CCHP) models from medical event logs. Specifically, an extension of classical Petri Nets with message and resource attributes is first introduced to formalize CCHPs. Then, a novel discovery algorithm is proposed to discover Intra-department Healthcare Process (IHP) models. Next, collaboration patterns among medical departments are formalized and corresponding discovery algorithms are given on that basis. Finally, a global CCHP model is obtained by integrating all discovered collaboration patterns and IHP models. By using four public medical event logs, we quantitatively compare our approach with the state-of-the-art process mining techniques in terms of model quality, and our experimental results demonstrate that the proposed approach can discover more accurate healthcare process models.Note to Practitioners—The recorded medical event logs by HISs can be used to extract valuable insights for the analysis of healthcare processes. However, existing process model discovery techniques cannot be applied for the analysis directly due to the complex collaborations among different medical departments of a hospital. This paper introduces a novel approach for cross-department collaborative healthcare process model discovery from medical event logs. All proposed techniques are fully implemented and publicly available. Using four public medical event logs, we show the applicability and advantages of our approach against existing ones. The proposed techniques are applicable to the model discovery and behavior understanding of real-life operational healthcare processes.

Business processes are critical for information systems to control workflows and deliver services. Although existing process discovery techniques can generate flat process models from business event logs, few of them have investigated the notion of hierarchy (i.e., subprocesses) yet. To fill the gap, this article first defines the concept of hierarchical Petri nets (HPNs), which can support the formal modeling and correctness verification of processes with subprocesses. Followed by that, we propose an approach which can effectively discover HPNs from event logs with lifecycle information. Moreover, to quantify the quality of discovered HPNs, details on how to transform an HPN to a classical Petri net are given such that existing metrics can be applied. All proposed approaches have been fully implemented in ProM, and experiments over both synthetic and real-life event logs demonstrate that our approach can effectively discover hierarchical process models. Specifically, compared to exiting approaches on processes discovery, our approach can generally perform better in terms of model quality.

Vehicle groups that are composed of autonomous vehicles can increase the perception range of vehicles, and their dynamic evolution can provide guidance for the operation of autonomous vehicles. Most existing studies on vehicle group formation neither propose a standard vehicle group model, nor consider vehicle mobility and dynamic topology of vehicle groups. Instead, they focus on detecting dynamic evolution without predicting it. This work proposes a dynamic evolution method for autonomous vehicle groups. It first defines five vehicle states and their transitions. Then, it proposes an autonomous vehicle group formation method based on vehicle states and formulates an autonomous vehicle group model. Next, it uses meta vehicle group sequences to manage vehicle groups at different times. Finally, it gives detection and prediction methods of vehicle group dynamic evolution. Extensive simulation results show that the proposed method can be used to establish interconnection among autonomous vehicle nodes, detect dynamic evolution characteristics inside a vehicle group precisely, and predict dynamic evolution trends of vehicle groups effectively.

Business process similarity measures are of vital importance for process repository management applications, such as process query, process recommendation, and process clustering. Most existing approaches measure process similarity by relying on control-flow structures only. This article investigates the role of data in process similarity measure. To incorporate data-flow information into business process control flow, it proposes a data-aware workflow net (DWF-net) by extending the classical workflow net with data reading and writing semantics. Then, we introduce three types of similarity measures, i.e., data item set-based similarity, data operation set-based similarity, and data-aware behavior-based similarity, to quantify the similarity of data-aware business processes from different perspectives. Next, a methodology is introduced to help process analysts apply these three measures in a systematical way. Finally, we evaluate the effectiveness and applicability of the proposed similarity measures by a group of comparative experiments.

Accurate estimation of network capacity is very important for Vehicular Infrastructure-based NETwork (VINET) in an urban scene that may involve greatly dynamic typology and complex driving conditions. The node mobility, network behavior, and network scale of a VINET are different from those of a wireless network, and, therefore, the existing capacity estimation methods of wireless networks cannot be used to estimate VINET capacity. In addition, most existing studies on VINET capacity only derive asymptotic descriptions when the number of nodes is large enough. In this work, a novel approach is proposed for the modeling and calculating VINET capacity. More specifically, we first analyze communication characteristics in a VINET, and introduce two transmission modes, i.e., a vehicle-based mode and a Road Side Unit (RSU)-based one. Then, we propose a probability-based transmission mode selecting strategy with which vehicle nodes can choose either transmission mode independently and such choice is probabilistic. Next, we analyze the characteristics of an RSU-based mode, divide a VINET into a number of communities according to the position and communication range of RSUs, and derive the capacity contributed by an RSU-based mode. Then, we calculate the capacity contributed by a vehicle-based mode based on fluid mechanics. Finally, the VINET capacity can be calculated. The proposed VINET capacity estimation approach is validated to be consistent with simulation results.

With the proliferation of social media, cyber threats and attacks have significantly increased in complexity and quantity in financial market. Malicious hackers leverage the influence of social media to spread deceptive information with an intent to gain abnormal profits illegally or to cause losses. Measuring information content in financial social media helps identify these threats and attacks. In this paper, we propose CDetector, an ML-based approach to identifying social media features that correlate with abnormal returns of the stocks of companies vulnerable to be targets of cyber attacks (e.g., cognitive hacking). To test our approach, we collected price data and the social media messages on multiple technology companies, and extracted features that contributed to abnormal stock movements. Preliminary results show that the top social media features associated with abnormal price movements are the terms that are simple, motivate actions, incite emotion, and use exaggeration, and the selected features correlate with abnormal messages and abnormal returns of the stocks of companies.

Summary Modern information systems are continuously collecting and storing large volumes of business process event logs. The analysis of event logs can provide valuable insights for business process re‐engineering and enhancement. Process discovery, as one of the most challenging event log analysis techniques, aims to discover a business process model from an event log. Many process discovery approaches have been proposed in the past two decades, however, most of them suffer from efficiency problem when dealing with large‐scale event logs. Motivated by PageRank, we propose LogRank, a graph‐based ranking model, for event log sampling in this paper. The LogRank is capable of sampling a large‐scale event log to a smaller size that can be efficiently handled by existing discovery approaches. To support real‐life applications, we instantiate the LogRank model for two typical types of event logs, that is, simple event logs and lifecycle event logs. To quantify the quality of a sample log with respect to the original one, we introduce a general evaluation framework that can be instantiated for different quality metrics. The proposed sampling approach has been implemented in the open‐source process mining toolkit ProM. By experiments with both synthetic and real‐life event logs, we demonstrate that the proposed LogRank‐based sampling approach provides an effective means to improve process discovery efficiency as well as guaranteeing high quality of discovered models.

Design pattern detection can provide useful insights to support software comprehension. Accurate and complete detection of pattern instances are extremely important to enable software usability improvements. However, existing design pattern detection approaches and tools suffer from the following problems: incomplete description of design pattern instances, inaccurate behavioral constraint checking, and inability to support novel design patterns. This paper presents a general framework to detect design patterns while solving these issues by combining static and dynamic analysis techniques. The framework has been instantiated for typical behavioral and creational patterns, such as the observer pattern, state pattern, strategy pattern, and singleton pattern to demonstrate the applicability. Based on the open-source process mining toolkit ProM, we have developed an integrated tool that supports the whole detection process for these patterns. We applied and evaluated the framework using software execution data containing around 1,000,000 method calls generated from eight synthetic software systems and three open-source software systems. The evaluation results show that our approach can guarantee a higher precision and recall than existing approaches and can distinguish state and strategy patterns that are indistinguishable by the state-of-the-art.

Existing work on the Internet-of-Vehicles (IoV) community mainly focuses on the detection of IoV community using static network detection and evolution methods of complex networks. These methods are prone to over-centralization, high computational complexity, and poor stability during the evolution of a community. In this work, we present an IoV community model and its evolution mechanism in an urban scene. More specifically, we first propose an IoV community detection model based on node similarity merging. Then, we use a network increment-based strategy to analyze node increment, edge increment, and weight increment. Finally, we give a dynamic evolution mechanism of an IoV community. Simulation-based experimental evaluation results show that the proposed mechanism achieves better real-time performance and accuracy than existing methods.

Tremendous amounts of execution data are collected during software execution. These data provide rich information for software runtime behavior comprehension. The unstructured execution data may be too complex, involving multiple interleaved components and so on. Applying existing process discovery techniques results in spaghetti-like models with no clear structure and no valuable information that can be easily understood by end users. In this article, we start with the observation that a software system is composed of a group of components, and we use this information to decompose the problem into smaller independent ones by discovering a behavioral model per component. To this end, we first distill a software event log for each component from the raw software execution data. Then, we construct the hierarchical software event log by recursively applying caller-and-callee relation detection. Next, component behavioral models, represented as hierarchical Petri nets, are discovered by recursively applying existing process discovery techniques. To measure the quality of discovered models against the execution data, we transform hierarchical Petri nets to flat ones, and the quality metrics, e.g., fitness, precision, and complexity, are applied. All proposed approaches have been implemented in the open-source process mining toolkit ProM. Through the experimental evaluation using both synthetic software systems and open-source software systems, we illustrate that the proposed approach facilitates the discovery of more understandable and high-quality software behavioral models.Note to Practitioners—Software execution data record rich information on the runtime behavior of software systems. Discovering an overall behavioral model for the whole software system typically results in an extremely complicated model that hinders further comprehension and usage. With the observation that a software system is composed of a set of interacting components, this article considers the problem of discovering a behavioral model per component. The proposed techniques are implemented in the open-source process mining tool ProM, and experimental evaluations using both synthetic and real-life software systems have indicated their applicability. The proposed approaches are readily applicable to industrial-size software behavior comprehension.

Workflow management technology has become a key means to improve enterprise productivity. More and more workflow systems are crossing organizational boundaries and may involve multiple interacting organizations. This article focuses on a type of loosely coupled workflow architecture with collaborative tasks, i.e., each business partner owns its private business process and is able to operate independently, and all involved organizations need to be synchronized at a certain point to complete certain public tasks. Because of each organization’s privacy consideration, they are unwilling to share the business details with others. In this way, traditional correctness verification approaches via reachability analysis are not practical as a global business process model is unavailable for privacy preservation. To ensure its globally correct execution, this work establishes a correctness verification approach for the cross-organizational workflow with task synchronization patterns. Its core idea is to use local correctness of each suborganizational workflow process to guarantee its global correctness. We prove that the proposed approach can be used to investigate the behavioral property preservation when synthesizing suborganizational workflows via collaborative tasks. A medical diagnosis running case is used to illustrate the applicability of the proposed approaches.Note to Practitioners—Cross-organizational workflow verification techniques play an increasingly important role in ensuring the correct execution of collaborative enterprise businesses. This work addresses the issue of correctness verification for loosely coupled interactive workflows with collaborative tasks. To ensure the globally correct execution, a behavioral correctness verification approach is established. All proposed concepts and techniques are supported by open-source tools, and evaluation over a medical diagnosis process case has shown their applicability. The proposed methodology is readily applicable to industrial-size workflow correctness verification problems.

This paper aims to introduce a novel approach to discover hierarchical business process models from event logs with lifecycle information. To handle noise and infrequent behavior, we introduce the notion of nesting ratio to quantify the probability of nesting. All proposed approaches have been implemented in the open-source process mining toolkit ProM. The proposed approach is compared to existing process discovery techniques using both synthetic and real-life lifecycle event logs, and finally we show that our approach outperforms exiting approaches to discover hierarchical processes.

Maintaining network connectivity is an important challenge for vehicular ad hoc network (VANET) in an urban scene, which has more complex road conditions than highways and suburban areas. Most existing studies analyze end-to-end connectivity probability under a certain node distribution model, and reveal the relationship among network connectivity, node density, and a communication range. Because of various influencing factors and changing communication states, most of their results are not applicable to VANET in an urban scene. In this article, we propose a connectivity prediction-based dynamic clustering (DC) model for VANET in an urban scene. First, we introduce a connectivity prediction method (CP) according to the features of a vehicle node and relative features among vehicle nodes. Then, we formulate a DC model based on connectivity among vehicle nodes and vehicle node density. Finally, we present a DC model-based routing method to realize stable communications among vehicle nodes. The experimental results show that the proposed CP can achieve a lower error rate than the geographic routing based on predictive locations and multilayer perceptron. The proposed routing method can achieve lower end-to-end latency and higher delivery rate than the greedy perimeter stateless routing and modified distributed and mobility-adaptive clustering-based methods.

In the October 2017 issue of the IEEE Transactions on Automation Science and Engineering[1], there are several errors, reported and corrected as follows.

Change-point detection is a task that looks for specific moments across which a network changes fundamentally. Change-point detection is one of the most important challenges for overlapping community evolution analysis, and its aim is to identify the moment, type, and degree of change of a specific dynamic event when an overlapping community is evolving. In contrast to overlapping community detection, change-point detection addresses the evolution of an overlapping community rather than a network topology. In this paper, we propose such a method by reformulating an overlapping community in the form of a one-dimensional stream constrained by gentle degree fluctuation and the heterogeneous size distribution of the overlapping communities. According to the number of interacting overlapping communities involved in a specific change event, overlapping community change-points are classified as unary or binary. Based on a signal processing framework and a decision function-based strategy, our proposed method finds the change-points for both unary and binary cases. The experimental results from a synthetic dataset show that our proposed approach can ensure higher accuracy and a lower false positive rate than the traditional two-stage approach.

Accurately estimated data transmission ability is important in operating a vehicular ad-hoc network (VANET), which has limited bandwidth and highly dynamic typology. The mobility behavior of traditional wireless networks is different from VANET's, and existing results on the former are not applicable to VANET directly. Most existing studies on VANET capacity estimation focus on asymptotic descriptions. In them, messages sent and received by vehicle nodes are composed of data packets, and vehicle nodes can move along roads only. In this paper, a modeling and calculation approach for accurate VANET capacity is proposed. We transfer vehicle nodes to data packets and then abstract data packets that can move along roads into data flow in virtual pipelines. Then, we derive a fluid mechanics-based data flow model and propose capacity calculation equations. According to network scale, network capacity is divided into following three stages: linear growth, maintenance, and decline. This paper demonstrates that the data flow model-based capacity is consistent with that of simulation results.

When an emergency occurs, one of the important challenges is how to form an effective and timely response. An emergency disposal plan is usually organized as a series of emergency response processes manipulated by one emergency command center and several subordinate emergency organizations. Moreover, these subordinate organizations are usually geographically dispersed and need to collaborate with each other. In this case, designing and verifying such cross-organizational collaborative emergency response processes are complicated and time-consuming. To address this problem, we propose a hierarchical modeling and correctness verification approach. A general framework for hierarchical modeling and correctness verification of such processes is first introduced. Then, a top-level model and two kinds of bottom-level models (complex and simple bottom-level ones) are proposed to model such processes and collaboration patterns from different abstraction levels. Next, Petri net refinement operation is adopted to refine the top-level model by using its corresponding bottom-level models to obtain the refined model. Finally, the correctness of the refined model is verified based on reachability graph. A typical running case of cross-organization collaborative fire emergency response processes is given to validate our proposed method.

A group of geographically dispersed and logically collaborated emergency organizations are involved when emergency occurs. Two challenging issues are a reasonable emergency resource allocation mechanism and an efficient resource conflict checking and resolution control mechanism to ensure the conflict-free execution of global cross-organization emergency response processes. To address them, this paper proposes an approach to support emergency resource management including both intraorganization private resource management and cross-organization public resource management. The former has been fully discussed in our previous work using E-net. To cope with the latter, this paper presents a novel type of Petri net that is extended with both time and resource factors to model cross-organization emergency response processes. Then, according to the resource requirement analysis, their worst, delayed, and best cases are obtained. Next, emergency resource conflict checking and four conflict resolution strategies are proposed to resolve the detected resource conflicts for the delayed execution case. This paper shows how to use different resolution strategies to construct the conflict-free model by designing corresponding resolution controllers. Finally, their performance is evaluated by a fire emergency response example.

Restructuring an object-oriented software system into a component-based one allows for a better understanding of the software system and facilitates its future maintenance. A component-based architecture structures a software system in terms of components and interactions where each component refers to a set of classes. In reverse engineering, identifying components is crucial and challenging for recovering the component-based architecture. In this paper, we propose a general framework to facilitate the identification of components from software execution data. This framework is instantiated for various community detection algorithms, e.g., the Newman's spectral algorithm, Louvain algorithm, and smart local moving algorithm. The proposed framework has been implemented in the open source (Pro)cess (M)ining toolkit ProM. Using a set of software execution data containing around 1.000.000 method calls generated from four real-life software systems, we evaluated the quality of components identified by different community detection algorithms. The empirical evaluation results demonstrate that our approach can identify components with high quality, and the identified components can be further used to facilitate future software architecture recovery tasks.

More and more business requirements are crossing organizational boundaries. There comes the cross-organization business process management, and its modeling is a complicated task. Mining a cross-organization business process aims to discover its model from a set of distributed event logs. Unfortunately, traditional process mining approaches totally neglect the privacy-preservation issue, which means the privacy of both event log and business process model. In this paper, a privacy-preservation cross-organization business process mining framework is proposed to handle its privacy issues. It includes three steps: (1) each organization discovers its private and public business process models from its event logs; (2) the trusted third-party midware takes the public process models as input and generates cooperative public process model fragments of each organization; and (3) each organization combines its private business process model with its relevant public fragments to obtain the organization-specific cross-organization cooperative business process model. To illustrate the applicability of the proposed approach, a multi-modal cross-organization transportation case is used for its validation and comparison with other methods.

It is an important challenge to detect an overlapping community and its evolving tendency in a complex network. To our best knowledge, there is no such an overlapping community detection method that exhibits high normalized mutual information (NMI) and F-score, and can also predict an overlapping community's future considering node evolution, activeness, and multiscaling. This paper presents a novel method based on node vitality, an extension of node fitness for modeling network evolution constrained by multiscaling and preferential attachment. First, according to a node's dynamics such as link creation and destruction, we find node vitality by comparing consecutive network snapshots. Then, we combine it with the fitness function to obtain a new objective function. Next, by optimizing the objective function, we expand maximal cliques, reassign overlapping nodes, and find the overlapping community that matches not only the current network but also the future version of the network. Through experiments, we show that its NMI and Fscore exceed those of the state-of-the-art methods under diverse conditions of overlaps and connection densities. We also validate the effectiveness of node vitality for modeling a node's evolution. Finally, we show how to detect an overlapping community in a real-world evolving network.

The detection of design patterns provides useful insights to help understanding not only the code but also the design and architecture of the underlying software system. Most existing design pattern detection approaches and tools rely on source code as input. However, if the source code is not available (e.g., in case of legacy software systems) these approaches are not applicable anymore. During the execution of software, tremendous amounts of data can be recorded. This provides rich information on the runtime behavior analysis of software. This paper presents a general framework to detect behavioral design patterns by analyzing sequences of the method calls and interactions of the objects that are collected in software execution data. To demonstrate the applicability, the framework is instantiated for three well-known behavioral design patterns, i.e., observer, state and strategy patterns. Using the open-source process mining toolkit ProM, we have developed a tool that supports the whole detection process. We applied and validated the framework using software execution data containing around 1000.000 method calls generated from both synthetic and open-source software systems.

Restructuring an object-oriented software system into a component-based one allows for a better understanding of the system and facilitates its future maintenance. A component-based architecture structures a software system in terms of its components and interactions where each component refers to a set of classes. To represent the architectural interaction, each component provides a set of interfaces. Existing interface identification approaches are mostly structure-oriented rather than function-oriented. In this paper, we propose an approach to identify interfaces of a component according to the functional interaction information that is recorded in the software execution data. In addition, we also discover the contract (represented as a behavioral model) for each identified interface by using process mining techniques to help understand how each interface actually works. All proposed approaches have been implemented in the open source process mining toolkit ProM. Using a set of software execution data containing more than 650.000 method calls generated from three software systems, we evaluate our approach against three existing interface identification approaches. The empirical evaluation demonstrates that our approach can discover more functionally consistent interfaces which facilitate the reconstruction of architectural models with higher quality.

During the execution of a software system, tremendous amounts of data are recorded, and such data provide valuable information on software runtime behavior analysis. This paper presents an approach on how to utilize process mining as an enabler to discover software behavioral models. To achieve this, we formally define the software event log and its transformation from original software execution data. Essentially, a software event log consists of a set of cases that each is a manifestation of an independent software run. A case is represented as an ordered sequence of events that each refers to a method call. Given the observation that software usually has a hierarchical structure, we first propose an approach to construct a hierarchical software event log from the original flat one by the recursively applying method calling relation detection. Next, using extended process discovery techniques, we discover a software behavioral model, which is represented as a kind of hierarchical Petri net with components, from the hierarchical software event log. We have implemented the proposed approach in the open source process mining toolkit ProM. By using two synthetic software event logs, we show that our approach can deal with infrequent behavior. Moreover, a validation with one real-life software event log shows that our approach can help visualize actual software runtime behavior in an easy-to-understand manner.

Web service composition is a challenging research issue. This paper presents an automatic Web service composition method that deals with both input/output compatibility and behavioral constraint compatibility of fuzzy semantic services. First, user input and output requirements are modeled as a set of facts and a goal statement in the Horn clauses, respectively. A service composition problem is transformed into a Horn clause logic reasoning problem. Next, a Fuzzy Predicate Petri Net (FPPN) is applied to model the Horn clause set, and T-invariant technique is used to determine the existence of composite services fulfilling the user input/output requirements. Then, two algorithms are presented to obtain the composite service satisfying behavioral constraints, as well as to construct an FPPN model that shows the calling order of the selected services.

This work aims to provide a review of the routing protocols in the Internet of Vehicles (IoV) from routing algorithms to their evaluation approaches. We provide five different taxonomies of routing protocols. First, we classify them based on their transmission strategy into three categories: unicast, geocast, and broadcast ones. Second, we classify them into four categories based on information required to perform routing: topology-, position-, map-, and path-based ones. Third, we identify them in delay-sensitive and delay-tolerant ones. Fourth, we discuss them according to their applicability in different dimensions, i.e., 1-D, 2-D, and 3-D. Finally, we discuss their target networks, i.e., homogeneous and heterogeneous ones. As the evaluation is also a vital part in IoV routing protocol studies, we examine the evaluation approaches, i.e., simulation and real-world experiments. IoV includes not only the traditional vehicular ad hoc networks, which usually involve a small-scale and homogeneous network, but also a much larger scale and heterogeneous one. The composition of classical routing protocols and latest heterogeneous network approaches is a promising topic in the future. This work should motivate IoV researchers, practitioners, and new comers to develop IoV routing protocols and technologies.

Time and resource management and optimization are two important challenges for an emergency response process, by which all individuals and groups manage hazards in an effort to avoid or ameliorate the impact of disasters. Compared with a traditional business process, an emergency response process has its own features. To our best knowledge, there is no formal method to model and analyze emergency response processes by taking uncertain activity execution duration, resource quantity, and resource preparation duration into account. This paper presents such a method based on an E-Net that is a Petri net-based formal model for an emergency response process constrained by resources and uncertain durations. According to the number of available resources, execution of an E-Net is classified into the worst, delayed, and best cases. Based on a priority-activity-first strategy and corresponding algorithms, this paper finds the duration to execute each activity for the delayed case. By experiments, we prove that the proposed strategy can ensure shorter execution duration of the whole process than a conventional one. A running case of a chlorine tank explosion is given to validate the proposed method.

Recently, cross-department business processes are becoming more and more complex. Different kinds of coordination patterns exist among different departments, which make modeling and analysis work more difficult. To our best knowledge, there is no formal method to give systematic modeling and verification for the cross-department processes when considering different kinds of coordination patterns among different departments. This paper proposes such a method based on Petri nets. The WF-net model extended with resource and message factors, RM_WF_Net for short, is first introduced. Then, the formal model of tasks is proposed and its coordination relations are given. Next, RM_WF_Net modeling for intradepartment processes is investigated and cross-department coordination patterns, including message interaction pattern, resource interaction pattern, task collaboration pattern, procedure abstract, service outsourcing pattern, and process activation pattern, are formally defined. The soundness of the RM_WF_Net is verified based on the reachability graph. A running case of the cross-department medical diagnosis business process is given to validate our proposed method.