Analyzing a TCP/IP-Protocol with Process Mining Techniques

Größe: px

Ab Seite anzeigen:

Download "Analyzing a TCP/IP-Protocol with Process Mining Techniques"

Alfred Otto
vor 6 Jahren
Abrufe

1 Fakultät für Mathematik und Informatik Analyzing a TCP/IP-Protocol with Process Mining Techniques Christian Wakup rubecon information technologies GmbH Düsseldorf, Germany Jörg Desel FernUniversität in Hagen Germany

2 Eindhoven Düsseldorf Hagen Slide 2

3 the problem legacy software (client / server) proprietary protocols (ethernet) How can the protocol definition be reconstructed from observations of the communication between client and server? for correct substitution of a communication partner Slide 3

4 the problem legacy software (client / server) proprietary protocols (ethernet) How can the protocol definition be reconstructed from observations of the communication between client and server? process definition mined event logs Slide 4

5 original protocol logs mining conformance new protocol logs Slide 5

6 original protocol logs original protocol mining substituted protocol conformance logs original protocol Slide 6

7 actual situation (case study) original protocol logs original protocol substituted protocol logs original protocol Slide 7

8 outline first motivation outline requirements of event logs for mining from communication logs to event logs application of mining techniques derived processes a case study Slide 8

9 requirements of data in event logs for mining [Wil van der Aalst, Boudewijn van Dongen: Discovering Petri nets from event logs, TOPNOC VII, 2013] each entry refers to a single process case each process case refers to a specific process definition each entry refers to an event of the case at one point of time each entry refers to a single, uniquely identifiable event each entry includes a description of that event Slide 9

10 how do we get communication logs? observe network traffic! [Dustdar, Gombotz: Discovering web service workflows using web service interaction mining, Int. J. Business Process Integration and Management 2006] proposes: an HTTP-listener that filters out all relevant data traffic of the web server But: we do not have HTTP here! Slide 10

11 how do we get communication logs? We developed the tool TCPLog2EventLog: Input: TCP log from Wireshark Output: event log Slide 11

12 What can we get from wireshark? complete data exchange in a time interval filter: only data using a single port duplicate data (TCP sends lost packets again!) filter: rules out duplicates data concerning establishment and deletion of sessions filter: deletes such messages, according to specific flags Slide 12

13 To be done by TCPLog2EventLog? (unreadable) hexadecimal data translation: readable ASCII time stamps missing add: recording time of messages cases missing calculate: from sequence numbers, ack numbers and data length: corresponding messages of a conversation resources missing add: source address of IP header Slide 13

14 Internet packet Slide 14

15 IPv4 header Slide 15

16 TCP header Slide 16

17 To be done by TCPLog2EventLog? still missing: activities (given a message, what activity does it represent?) generate example message from single activities, yielding (unreadable) text in the TCP data field, which now is assigned a name the same activity always generates similar text, therefore construct classes of similar activities (Levenshtein algorithm) If an assignment is not possible, create a new activity <<number>> Always add the prefix server or client (sender of the message) Slide 17

18 Wireshark TCPLog2Event Log Nitro ProM The complete tool chain Conversion of event logs to XES standard formal by Nitro (Fluxicon) PROM (6.2) can read XES files to generate process models TCP Log event log standard format process model Slide 18

19 Mining of event logs PROM (6.2): Alpha Miner Heuristic Miner Genetic Miner Slide 19

20 Small use case: Alpha Miner surprisingly: best result Slide 20

21 Small use case: Heuristic Miner also very good result Slide 21

22 Small use case: Genetic Miner not well suitable Slide 22

23 Experiment extend the small use case establish connection / close connection by some intermediate actions. The runs of the small use case should be still possible! Slide 23

24 extended use case Slide 24

25 PROM: replay a log on Petri net for conformance analysis (small use case) Slide 25

26 Case study: simple case study, new protocol Slide 26

27 differences to old protocol Slide 27

28 Results of the case study The new protocol has substantial differences to the old one. These differences are identified. Most of them are harmless (such as window is opened in new protocol vs. window can be opened in old protocol) Some differences are quite unexpected. Slide 28

29 Experiences Workflow mining is useful for protocol identification! Identified problems: sometimes different activities in same class (unnecessary loops) sometimes same activity in different classes (isolated transitions) repaired manually Slide 29

30 Fakultät für Mathematik und Informatik Analyzing a TCP/IP-Protocol with Process Mining Techniques Christian Wakup rubecon information technologies GmbH Düsseldorf, Germany Jörg Desel FernUniversität in Hagen Germany

Ähnliche Dokumente

Magic Figures. We note that in the example magic square the numbers 1 9 are used. All three rows (columns) have equal sum, called the magic number.

Magic Figures. We note that in the example magic square the numbers 1 9 are used. All three rows (columns) have equal sum, called the magic number. Magic Figures Introduction: This lesson builds on ideas from Magic Squares. Students are introduced to a wider collection of Magic Figures and consider constraints on the Magic Number associated with such