Detection of performance anomalies through Process Mining

Abstract: Anomaly detection in computer systems operating within complex environments,such as cyber-physical systems (CPS), has become increasingly popularduring these last years due to useful insights this process can provide aboutcomputer systems’ health conditions against known reference nominal states.As performance anomalies lead degraded service delivery, and, eventually,system-wide failures, promptly detecting such anomalies may trigger timelyrecovery responses. In this thesis, Process Mining, a discipline aiming at connectingdata science with process science, is broadly explored and employedfor detecting performance anomalies in complex computer systems, proposinga methodology for connecting event data to high-level process models forvalidating functional and non-functional requirements, evaluating system performances,and detecting anomalies. The proposed methodology is appliedto the industry-relevant European Rail Traffic Management System/EuropeanTrain Control System (ERTMS/ETCS) case-study. Experimental results sampledfrom an ERTMS/ETCS system Demonstrator implementing one of thescenarios the standard prescribe have shown Process Mining allows characterizingnominal system performances and detect deviations from such nominalconditions, opening the opportunity to apply recovery routines for steeringsystem performances to acceptable levels.