Towards Forensic Data Flow Analysis of Business Process Logs

• Published in: 2011 Sixth International Conference on IT Security Incident Management and IT Forensics pp. 3 - 20
• Main Authors: Accorsi, R., Wonnemann, C., Stocker, T.
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01-05-2011
• Subjects: Access control; Business; Business process forensics; Data flow policies; data flow reconstruction; Data mining; Data models; Forensics; Web services
• ISBN: 9781457701467; 1457701464
• DOI: 10.1109/IMF.2011.13

This paper presents RecIF, a forensic technique for the analysis of business process logs to detect illegal data flows. RecIF uses propagation graphs to formally capture the data flow within a process execution. Abstracting away from the concrete traces, propagation graphs are analyzed with extensional data flow policies that denote what - instead of how - relevant industrial requirements, e.g. Chinese Wall and separation of duty constraints, are to be achieved. An example and the corresponding runtime figures demonstrate the feasibility of the approach.