Harry Jiannan Wang

A security risk analysis model for information systems: Causal relationships of risk factors and vulnerability propagation analysis

With the increasing organizational dependence on information systems, information systems security has become a very critical issue in enterprise risk management. In information systems, security risks are caused by various interrelated internal and external factors. A security vulnerability could also propagate and escalate through the causal chains of risk factors via multiple paths, leading to different system security risks. In order to identify the causal relationships among risk factors and analyze the complexity and uncertainty of vulnerability propagation, a security risk analysis model (SRAM) is proposed in this paper. In SRAM, a Bayesian network (BN) is developed to simultaneously define the risk factors and their causal relationships based on the knowledge from observed cases and domain experts. Then, the security vulnerability propagation analysis is performed to determine the propagation paths with the highest probability and the largest estimated risk value. SRAM enables organizations to establish proactive security risk management plans for information systems, which is validated via a case study.

Supporting process design for e-business via an integrated process repository

Business process design is an integral part of e-business engineering. Given that e-business models usually involve a wide range of business processes across different business functions with complex activities, events, and documents, process design for e-business is a very challenging task. Although various process reference models (PRMs) have been developed to provide guidelines for process design, research on leveraging multiple PRMs to support process design for e-business has been scant. In this paper, we demonstrate that the diverse process design requirements in e-business are best satisfied by utilizing multiple PRMs via a case study. Then, we propose a collaborative approach grounded in knowledge management theory to integrating multiple process reference models to better support process design in e-business. We equip the integrated process repository with a set of novel features based on Web 2.0 technologies to enhance its utility, efficiency, and quality for process design support. A prototype system is developed and user experiments are conducted to evaluate the system.

Policy-Driven Process Mapping (PDPM): Discovering process models from business policies

Analyzing business policies for discovering and validating business process models is a critical task in modern organizations, which is currently done in an ad hoc manner due to a lack of systematic methodologies. In this paper, we propose a novel methodology called Policy-Driven Process Mapping (PDPM) for extracting process models from business policy documents. Our research objective is to make process discovery from policy documents more systematic with fewer structural and semantic errors. To the best of our knowledge, PDPM is the first formal approach to discovering process models from business policies.

A policy-based process mining framework: mining business policy texts for discovering process models

Many organizations use business policies to govern their business processes, often resulting in huge amounts of policy documents. As new regulations arise such as Sarbanes-Oxley, these business policies must be modified to ensure their correctness and consistency. Given the large amounts of business policies, manually analyzing policy documents to discover process information is very time-consuming and imposes excessive workload. In order to provide a solution to this information overload problem, we propose a novel approach named Policy-based Process Mining (PBPM) to automatically extracting process information from policy documents. Several text mining algorithms are applied to business policy texts in order to discover process-related policies and extract such process components as tasks, data items, and resources. Experiments are conducted to validate the extracted components and the results are found to be very promising. To the best of our knowledge, PBPM is the first approach that applies text mining towards discovering business process components from unstructured policy documents. The initial research results presented in this paper will require more research efforts to make PBPM a practical solution.

Constraint-centric workflow change analytics

In a globalized economic environment with volatile business requirements, continuous process improvement needs to be done regularly in various organizations. However, maintaining the consistency of workflow models under frequent changes is a significant challenge in the management of corporate information services. Unfortunately, few formal approaches are found in the literature for managing workflow changes systematically. In this paper, we propose an analytical framework for workflow change management through formal modeling of workflow constraints, leading to an approach called Constraint-centric Workflow Change Analytics (CWCA). A core component of CWCA is the formal definition and analysis of workflow change anomalies. We operationalize CWCA by developing a change anomaly detection algorithm and validate it in the context of procurement management. A prototype system based on an open-source rule engine is presented to provide a proof-of-concept implementation of CWCA.

On Risk Management with Information Flows in Business Processes

This article investigates the economic consequences of data errors in the information flows associated with business processes. We develop a process modeling-based methodology for managing the risks associated with such data errors. Our method focuses on the topological structure of a process and takes into account its effect on error propagation and risk mitigation using both expected loss and conditional value-at-risk risk measures. Using this method, optimal strategies can be designed for control resource allocation to manage risk in a business process. Our work contributes to the literature on both ex ante risk management-based business process design and ex post risk assessments of existing business processes and control models. This research applies not only to the literature on and practice of process design and risk management but also to business decision support systems in general. An order-fulfillment process of an online pharmacy is used to illustrate the methodology.

An intelligent approach to data extraction and task identification for process mining

Business process mining has received increasing attention in recent years due to its ability to provide process insights by analyzing event logs generated by various enterprise information systems. A key challenge in business process mining projects is extracting process related data from massive event log databases, which requires rich domain knowledge and advanced database skills and could be very labor-intensive and overwhelming. In this paper, we propose an intelligent approach to data extraction and task identification by leveraging relevant process documents. In particular, we analyze those process documents using text mining techniques and use the results to identify the most relevant database tables for process mining. The novelty of our approach is to formalize data extraction and task identification as a problem of extracting attributes as process components, and relations among process components, using sequence kernel techniques. Our approach can reduce the effort and increase the accuracy of data extraction and task identification for process mining. A business expense imbursement case is used to illustrate our approach.

An Analytical Framework for Understanding Knowledge-Sharing Processes in Online Q&A Communities

Online communities have become popular knowledge sources for both individuals and organizations. Computer-mediated communication research shows that communication patterns play an important role in the collaborative efforts of online knowledge-sharing activities. Existing research is mainly focused on either user egocentric positions in communication networks or communication patterns at the community level. Very few studies examine thread-level communication and process patterns and their impacts on the effectiveness of knowledge sharing. In this study, we fill this research gap by proposing an innovative analytical framework for understanding thread-level knowledge sharing in online Q&A communities based on dialogue act theory, network analysis, and process mining. More specifically, we assign a dialogue act tag for each post in a discussion thread to capture its conversation purpose and then apply graph and process mining algorithms to examine knowledge-sharing processes. Our results, which are based on a real support forum dataset, show that the proposed analytical framework is effective in identifying important communication, conversation, and process patterns that lead to helpful knowledge sharing in online Q&A communities.

Editorial: “Business Process Intelligence: Connecting Data and Processes”

This introduction to the special issue on Business Process Intelligence (BPI) discusses the relation between data and processes. The recent attention for Big Data illustrates that organizations are aware of the potential of the torrents of data generated by todays information systems. However, at the same time, organizations are struggling to extract value from this overload of data. Clearly, there is a need for data scientists able to transform event data into actionable information. To do this, it is crucial to take a process perspective. The ultimate goal of BPI is not to improve information systems or the recording of data; instead the focus should be in improving the process. For example, we may want to aim at reducing costs, minimizing response times, and ensuring compliance. This requires a “confrontation” between process models and event data. Recent advances in process mining allow us to automatically learn process models showing the bottlenecks from “raw” event data. Moreover, given a normative model, we can use conformance checking to quantify and understand deviations. Automatically learned models may also be used for prediction and recommendation. BPI is rapidly developing as a field linking data science to business process management. This article aims to provide an overview thereby paving the way for the other contributions in this special issue.

Mining Knowledge Sharing Processes in Online Discussion Forums

Online discussion forums have become a popular knowledge source for sharing information or solving problems. This study is an attempt to apply business process modeling and mining techniques to analyzing online knowledge sharing activities. Traditional process mining techniques have little consideration on social interactions, which are rich in online forums. We propose to complement traditional process mining with analyses on social interactions among discussion participants. Our experiments show that business process modeling and mining techniques can be used to model online knowledge sharing processes and identify patterns related to effective knowledge sharing. In addition, analyses on social interactions provide insights that verify and supplement the process mining results.