Assisting and automating workflows using structured log events

Abstract

An exemplary system includes a processor for monitoring a user interface and generating an activity log including a step flow, extracting features and common variables from unstructured data in the activity log and generating structured log events based on the extracted features and common variables, generating a workflow model based on the structured log events, and automating or assisting a workflow based on the generated workflow model.

Description

[Technical field]

[0001] The present technology relates to workflows, and more particularly, to automating workflows. Summary of the Invention

[0002] According to embodiments described herein, the system may include a processor for monitoring a user interface and generating an activity log including a step flow. The processor may also extract features and common variables from the unstructured data in the activity log and generate structured log events based on the extracted features and common variables. The processor may also generate a workflow model based on the structured log events. The processor may also automate or assist a workflow based on the generated workflow model.

[0003] According to another embodiment described herein, the method includes, via a processor, monitoring a user interface to generate an activity log including a step flow. The method further includes, via the processor, extracting features and common variables from the unstructured data in the activity log and generating structured log events based on the extracted features and common variables. The method also includes, via the processor, generating a workflow model based on the structured log events. The method also includes, via the processor, automating or assisting a workflow based on the generated workflow model.

[0004] According to another embodiment described herein, a computer program product for automating or assisting a workflow includes a computer readable storage medium having program code embodied thereon. The computer readable storage medium is not a transitory signal itself. The program code is executable by a processor and causes the processor to monitor a user interface and generate an activity log including a step flow. The program code also causes the processor to extract features and common variables from unstructured data in the activity log and generate structured log events based on the extracted features and common variables. The program code also causes the processor to generate a workflow model based on the structured log events. The program code also causes the processor to automate or assist a workflow based on the generated workflow model. [Brief description of the drawings]

[0005] [Figure 1] 1 is a block diagram of an example system for automating and assisting workflow using structured log events. [Diagram 2] 1 is a block diagram of an example method in which structured log events can be used to automate and assist workflow. [Diagram 3] FIG. 1 is a block diagram of an exemplary method in which a workflow model can be generated to automate or assist a workflow. [Figure 4] FIG. 1 is a block diagram of an exemplary computing device that can automate and assist workflows using structured log events. [Diagram 5] FIG. 1 illustrates an example of a cloud computing environment according to embodiments described herein. [Figure 6] FIG. 1 illustrates an example abstraction model layer diagram according to embodiments described herein. [Figure 7]1 illustrates an exemplary tangible, non-transitory computer-readable medium in which structured log events can be used to automate and assist workflows. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0006] Security operations are very costly and limited. It is difficult to review and investigate all suspicious events in a security investigation, while each of these events may indicate a security incident with serious implications for the targeted organization. In addition, brainstorming and process planning for every suspicious event can be cost-prohibitive. Furthermore, there may be thousands of such processes running at a given time.

[0007] Some automated event investigation solutions are pre-built. For example, security experts can design “out-of-the-box” recipes for automated event investigation. However, these approaches are very limited and may not meet today’s challenging cybersecurity landscape. For example, the rapid and dynamic ingenuity of attackers may thwart detection. In addition, frequent updates to technology may quickly render such designs ineffective. Furthermore, a lack of domain expertise from the vendor may make such designs ineffective from the start. Finally, enterprise-specific cases may not work well in other situations. For example, attackers may exploit vulnerabilities that are specific to a customer. A particular customer may have a particular architecture, configuration, or code, and the process that the vendor releases may not cover these cases. In addition, for attacks that do not have signatures, there may be no easy way to automatically build efficient rootcaching mechanisms to remediate such attacks.

[0008] According to embodiments of the present disclosure, a system can use structured log events to automatically support or automate a workflow. An exemplary system includes a processor that monitors a user interface to generate an activity log including a step flow. The processor is for extracting features and common variables from unstructured data in the activity log and generating structured log events based on the extracted features and common variables. The processor is for generating a workflow model based on the structured log events. The processor is for automating or supporting a workflow based on the generated workflow model. Thus, embodiments of the present disclosure enable automating or supporting workflow support based on a model workflow generated from monitored user activity.

[0009] Referring now to Figure 1, a block diagram illustrates an exemplary system for automating and assisting workflow using structured log events. The exemplary system is generally referred to by reference numeral 100 and may be implemented using the methods 200 and 300 of Figures 2 and 3, and using a computing device 400 or computer readable medium 500 of Figures 4 and 5.

[0010] In the example of FIG. 1 , the system 100 includes a plurality of user application programming interfaces (APIs) 102. The system 100 also includes a mitigation platform 104, an incident investigation platform 106, and a security alert system 108 that are communicatively coupled to the user APIs 102. The system 100 further includes an activity monitor 110 that is communicatively coupled to the user APIs 102. The system 100 also includes an event log storage 112 that is communicatively coupled to the activity monitor 110. The system 100 also includes a natural language understanding (NLU) engine 114 that is communicatively coupled to the event log storage 112. The system 100 further includes a process mining engine 116 that is communicatively coupled to the NLU engine 114. The system 100 also includes a server 118 that is communicatively coupled to the process mining engine 116, the user APIs 102, and the incident investigation platform 106.

[0011] Further, with reference to FIG. 1, the system 100 can be used to automate security best practice builders, forensic processes, system tuning and risk mitigation processes by leveraging the knowledge and proficiency of domain experts. In particular, the system 100 uses a combination of NLU and process mining to build workflows to be used by the domain experts in executing these processes. The system 100 can then utilize the built workflows to assist the user in applying these processes. For example, the system 100 can suggest mitigation measures for an incoming suspicious event, including information to support such mitigation measures. The system 100 can also utilize the built workflows to automate event investigation, system tuning and risk mitigation processes.

[0012] In the example of FIG. 1, the system 100 includes a user API 102 that is used by a domain expert to apply an investigative procedure. As an example, the domain expert may be a system-on-chip (SoC) analyst. In various examples, these user APIs 102 may range from a simple user interface for applying simple SQL queries to an NLU-based UI that allows a user to ask questions in free language to the system and get answers. For example, the user API 102 may implement a chatbot with advanced NLU techniques to simplify the work required to investigate any suspicious event. In some examples, a chat with a user may be converted into a Rest API to query data, which may be used to set basic transition rules. As used herein, a transition rule includes one or more conditions for a step in a process to move to another step. For example, a user may ask the system whether a suspicious user has failed to log in more than N times in the past three days. The user may specify, "If yes, take step A" and "If no, take step B." Thus, the transition rule in this example is based on the number of failed logins in the past three days and is used by the system 100 to determine the next step. In various examples, data from chats with a user may be used to perform various actions. For example, the action may include blocking access for the suspicious user for the next N hours. In some examples, the action may include sending a notification to the suspicious user's manager. In various examples, the action may include increasing the resolution of audits for the suspicious user. In some examples, the action may include logging the suspicious user's actions to a violation system. In some examples, the action may include opening a ticket. For example, the ticket may be used to flag the suspicious user's actions for manual review.In various examples, the action may include closing the case in response to detecting that the detection of the suspicious user was a false positive.

[0013] The security alarm system 108 may generate a security alarm in response to detecting a security event. For example, the security event may be detected via a data firewall, an intrusion detection system (IDS), a security information and event management (SIEM), or other suitable techniques for security event detection. In some examples, the security alarm system 108 may include multiple security alarm systems.

[0014] The incident investigation platform 106 may be used to investigate security incidents. For example, security incidents may be received from a SIEM, a malware analysis engine, a database activity analysis engine, etc. In various examples, the incident investigation platform 106 includes a search engine that allows a user to query internal and external databases.

[0015] The mitigation platform 104 may be used to apply configuration tuning and mitigation commands to an organization's security systems. For example, the mitigation platform 104 may be used to add Internet Protocol (IP) addresses to a firewall blacklist. As another example, the mitigation platform 104 may invalidate a user's credentials for a service.

[0016] The activity monitor 110 may monitor the domain expert's interactions with one or more systems and generate an activity log that includes the step flow performed by the domain expert. In various examples, the monitoring of the activity monitor 110 may be client-side or may be server-side. In some examples, to get the most comprehensive record of the monitored procedure, the activity monitor 110 may monitor the activities of all the domain experts in the process. Thus, in some examples, the activity monitor 110 may monitor queries applied to an external platform. For example, the activity monitor 110 may monitor queries on a web platform. Additionally, in some examples, the activity monitor 110 may perform passive or active monitoring. For example, passive monitoring may be transparent to a user, such as a domain expert. In active monitoring, the activity monitor 110 may interact with a user to gain insight into a particular workflow. For example, the activity monitor 110 may ask the user to highlight some part of some response that will lead to the next step in the investigation procedure. In various examples, the activity monitor 110 may apply proactive monitoring to determine transition rules and ask the user for help in filling in tokens to improve process mining. As used herein, a token refers to a list of parameters and parameter values ​​that are used in subsequent steps and are stored accordingly. For example, the parameter values ​​may be used as run-time parameter values ​​in subsequent steps of the process. Thus, the tokens may serve as context for subsequent steps. In various examples, the activity monitor 110 may enable the user to highlight artifacts in the system response that lead to subsequent queries or to incident conclusions.

[0017] In various examples, the event log storage 112 is a database used to store the activity logs generated by the activity monitor 110. For example, the event log storage 112 may be an internal database or an external database.

[0018] The NLU engine 114 may be a model used to extract features and common variables from the unstructured data in the activity log. For example, the features may be users, files, or other characteristics of the system being monitored. The NLU engine 114 may convert the unstructured data into structured log events that can be processed by the process mining engine 116. The variables may be a particular error type, time, etc. The NLU engine 114 may store the structured log events in a database, such as the event log storage 112.

[0019] The process mining engine 116 may receive the domain expert logs from the event log storage 112 and build a workflow model based on the domain expert logs. To build the workflow model, the process mining engine 116 may perform a process mining procedure. The process mining procedure may be implemented, for example, using the method 300 of FIG. 3. For example, in the process mining procedure, the process mining engine 116 may transform a process into a start->step flow->end. The process mining engine 116 may identify a common "start step." For example, the common start step may be a common start suspicious event that initiates multiple investigations. In various examples, the start step may be used to run the process mining engine 116 to consolidate and optimize those processes associated with the start step. The process mining engine 116 may then identify common sub-processes among all the processes. The process mining engine 116 may further identify transition rules for all the processes. For example, the process mining engine 116 may set up a predefined syntax for identifying transition rules for all processes. In various examples, the process mining engine 116 may perform classification to identify the context of a step. The context of a step may be referred to as a token. For purposes of classification, the process mining engine 116 may learn which parts are variables and from where to extract the variables. Because learning which parts are variables and from where to extract the variables can be very complex, in some examples, the process mining engine 116 may present options to the user to allow manual selection and tuning of the variables. As an example, if the suspicious event is related to a particular database table, a second step may alert symptoms related to this database table. A next step may perform a first investigation step on this database.The purpose of classification is to automate<table:”table name”> So that you know to set it as a run parameter rather than a constant. <entity:value>The process mining engine 116 may then generate an optimized flow. For example, the process mining engine 116 may take into account the start event, the transition rules, and the common sub-processes in generating the optimized flow. In various examples, the flow optimization may be performed within a user of the same legal entity or even across multiple legal entities. In some examples, the process mining engine 116 may tune the workflow model by allowing a user to customize and enhance the production workflow model. In various examples, the result of the process mining procedure is an automated optimal integrated process flow that is automatically generated based on NLU. In some examples, the resulting optimal integrated process flow may be shared among many customers.

[0020] In various examples, the server 118 may receive the constructed workflow as an input and include a model that uses the constructed workflow to assist the user in applying an event investigation procedure or to automate the investigation procedure either in whole or in part. In some examples, the automated process may be triggered by an incident detected by one of the organization's alarm systems or may be triggered periodically. For example, a user may record a threat analysis process as Ex2 and schedule the threat analysis process to run automatically every N hours. In various examples, the server 118 may include a classification algorithm to identify entities from the script and then look for tokens to use in the run-time parameters of the process. In some examples, the process is automatically defined with its transition rules and tokens. For example, the server 118 may identify that the user should be included in the dynamically generated token from the first step and used throughout all subsequent steps. Additional parameter values ​​may be added to the token in a later step to be used in the subsequent step.

[0021] In various examples, assuming the user continues to execute more processes, the process mining engine 116 may operate periodically to identify more processes and common sub-processes for the same start event. The process mining engine 116 may execute a particular process mining algorithm to optimize multiple workflow processes into an optimized process. For example, the process mining engine 116 may execute a phase mining algorithm. The process mining engine 116 may identify and optimize processes with all possible transition rules. As an example, if a user executes an outlier related to COMMAND=GRANT and after some time, the same user or another user executes a process similar to the above threat analysis process Ex2 for COMMAND=SELECT, then the two processes may be merged into one optimized process using the transition rules.

[0022] In this way, the server 118 may apply not only the most suitable optimized process, but also other processes that were not used for a given incident. In various examples, the server 118 includes a user interface that facilitates iteration between the server and the security expert. For example, the user interface may present suggestions to the security analyst, or provide the security analyst's feedback to the automated process, etc. In various examples, the server 118 may cluster the customers across and recommend improvements to their processes to all customers. For example, the customers may be clustered by running a nearest neighbor algorithm. In some examples, the server 118 may interactively perform predictive analytics that suggest next steps for the user's manual processing.

[0023] As one process example Ex1, a new command outlier value "GRANT" may be detected. The security analyst may send a request: find the user with top outlier of Category ”New Command”. The system may respond by displaying this user and can provide details regarding this outlier command. The results are processed by the NLU engine 114 to extract features into tokens. For example, these features are used for analysis in subsequent steps to find common features in the steps. The NLU engine 114 may identify category="New Command" and user=<user found>. These two dynamic parameters may be copied into tokens for later use. The security analyst may then request to check whether the outlier for this user is a New Command of type GRANT and whether the GRANTEE is a DORMANT USER. The system can respond with "True, this user is dormant user." and can provide information especially about the deleted GRANT command. The NLU engine 114 may then perform feature mapping, execute the relevant API, map the tokens to runtime parameters, and can add command=GRANT & grantee=<user who received the Privilege> to the tokens. The security analyst may then request to Get the GRANTEE and search the Activities of the GRANTEE. The system can respond with "GRANTEE is John Smith." and can provide the listed activities of user John Smith.At this time, the NLU engine 114 can accordingly add <user=John Smith>&activities=<list of activities found> to the token. The security analyst can further request to check if there is a sensitive object (Check if there is Sensitive Object) (filter). <grantee>and <sensitiveobject>RestAPI to perform a free text search)). The system can respond with "8 records found…(8レコードがみつかりました。)" and provide the discovered results. The NLU engine 114 can thus add sensitiveObject=<list of objects found(発見されたオブジェクトのリスト)> to the token. The security analyst can then "Check if there are more than 1 occurrences of this activities(1より多いこの活動の発生があるかどうかを確認する)(RestAPI to perform a free text search with filter Count>1)". The system can respond with "False". The security analyst can then request to check if the number of RECORD AFFECTED is greater than 1 (RestAPI to perform a free text search with filters RecordAffected>1 and Count>1). The system can respond with "True, number of RECORD AFFECTED is 6(真、RECORD AFFECTEDの数は6である。)" and provide the search results. At this time, the NLU engine 114 can add the parameter RecordsAffected=6 to the token. The security analyst can then issue the command "Add this USER to the WATCH LIST(このユーザをWATCH LISTに加える)(Add this user to the WATCH LIST in the WatchList) <user>The NLU engine 114 can then send a "Rest API to add a ServiceNow.ticketId to the token" and "Open a TICKET in ServiceNow and assign the user'manager" (a Rest API that opens a TICKET in ServiceNow and adds the output script of that process as text to the ticket). The NLU engine 114 can then add the ServiceNow.ticketId to the token.

[0024] In a second exemplary process Ex2, a new command outlier "SELECT" may be detected. For example, a security analyst may request to find me the user with top outlier of Category "New Command." The system may respond by displaying this user and providing details about this outlier. The security analyst may then request to "retrieve the outliers where the New Command is SELECT." The system may respond with a list of outliers where the NewCommand is SELECT. The security analyst may request to "Run generic Search for this USER and look for word OUT_FILE,UTL_HTTP." The system may respond with "True" and provide the search results. The security analyst can then send the commands "Open a ticket for this user," "set priority HIGH SEVERITY," and "text the user name found and export into a file or http."

[0025] For these two example processes, the process mining engine 116 may receive two corresponding workflows (WFs) from the NLU engine 114 and detect that the two workflows have a common starting point. The process mining engine 116 may then run an algorithm to find an optimal workflow for combining the two workflows. In some examples, the process mining engine 116 algorithm may start from step 1, generate a new workflow that is common to both workflows, and then generate a nested workflow to cover the two use cases.

[0026] The block diagram of Figure 1 is not intended to indicate that system 100 includes all of the components illustrated in Figure 1. Rather, it should be understood that system 100 may include fewer or additional components (e.g., additional client devices, or additional resource servers, etc.) not illustrated in Figure 1.

[0027] Figure 2 is a process flow diagram of an exemplary method that can use structured log events to automate and assist workflow. Method 200 can be implemented using any suitable computing device, such as computing device 300 of Figure 3, and will be described with reference to system 100 of Figure 1. For example, the method described below can be implemented by computing device 400 of Figure 4.

[0028] In block 202, the processor monitors the user interface and generates an activity log that includes the step flow. For example, the processor may monitor a two-way conversation between a user and a service on the server. For example, the service may be a virtual assistant, a chatbot accessed through a website or an application. The chatbot may conduct a conversation with the user via voice or text technology. In various examples, the user may send a request to the service as part of a security workflow, a forensic process, a system tuning or a risk mitigation process. In some examples, the monitoring may be passive monitoring or active monitoring.

[0029] In block 204, the processor stores the activity log in a database. For example, the database may be an internal database directly accessible to the processor or an external database accessible over a network.

[0030] In block 206, the processor extracts features and common variables from the unstructured data in the activity log and generates structured log events based on the extracted features and common variables. For example, the processor may extract the features and common variables using a trained natural language understanding model. In various examples, the extracted features may be stored on a token. In various examples, the extracted features may include, among other types, user, server, service, time, command, table, field, response time, affected record, client Internet Protocol address, error type, error code, violation type, and violation severity.

[0031] In block 208, the processor generates a workflow model based on the structured log events. For example, the processor may generate workflow models optimized for different types of workflows. In some examples, the processor may generate multiple workflow models for a type of workflow. For example, the workflow model may integrate different processes, including processes or sub-processes that may not have actually been used for a particular task. In some examples, the processor may cluster across customers and generate improved workflows to be recommended for each customer in the cluster. For example, the processor may process multiple workflows of a mine for a particular customer or across multiple customers, sharing data and learnings across multiple customers.

[0032] In block 210, the processor automates or assists a workflow based on the generated workflow model. In some examples, the processor may automatically execute a particular generated workflow model. For example, the processor may execute a workflow model optimized for a particular task. In some examples, the processor may execute multiple workflow models for a particular task and present the results to a user. For example, the processor may generate additional workflow models based on the structured log events and automatically execute the additional workflow models to generate multiple results to be presented. In various examples, the processor may assist a user in performing a particular task based on the optimized workflow. For example, the processor may detect that a user is at a particular step of a task and suggest the next step to execute. In various examples, the processor may interactively perform predictive analytics to suggest the next step for the user's manual processing. In some examples, the automation of the workflow may be triggered by a detected incident from an alarm system. In various examples, the automation of the workflow may be executed periodically. For example, the automated workflow may be scheduled to be executed automatically at a predetermined time interval.

[0033] 2 is not intended to imply that the operations of method 200 should be performed in any particular order or that all operations of method 200 are included in all instances. Additionally, method 200 may include any suitable number of additional operations.

[0034] Figure 3 is a process flow diagram of an exemplary method that can generate a workflow model for automating or assisting a workflow. Method 300 can be implemented in any suitable computing device, such as computing device 300 of Figure 3, and will be described with reference to system 100 of Figure 1. For example, method 300 may be implemented by process mining engine 116 of Figure 1, process miner module 430 of computing device 400 of Figure 4, or process miner module 712 of Figure 7.

[0035] In block 302, the processor converts the structured log events into start events, step flows, and end events. A start event is an event that starts a particular monitored process. For example, a start event may be a suspicious event that initiates an investigation. A step flow may include a series of steps that connect from a start event to an end event. An end event may include an event that ends a particular monitored process.

[0036] At block 304, the processor detects a common start event among the monitored processes. For example, the processor may detect a common start event based on one or more characteristics shared by the start events of two or more processes. As an example, two workflow processes may start with a step that includes the command "Get me top anomaly in last N days."

[0037] In block 306, the processor consolidates and optimizes the processes based on the common start event. For example, the processor may consolidate the processes by merging two processes into one optimized process. As an example, the processor may consolidate two start steps. The processor may optimize the processes by any suitable process mining technique.

[0038] In block 308, the processor detects common sub-processes among the different processes. For example, common sub-processes may be detected based on shared starting steps, characteristics, variables, etc.

[0039] In block 310, the processor detects transition rules for each process in the integrated process. In some examples, the processor may set a predefined syntax to detect the transition rules. The predefined syntax may be a dictionary or set of examples used by the processor to associate various words or phrases with particular features or variables.

[0040] In block 312, the processor performs classification to detect context for each step of each process. For example, the processor may use a classifier trained to identify the parts of each step in each process that are variables and the location of such variables. The processor may extract the variable parameters into tokens. The tokens may be used to track the extracted parameters across the steps of each process.

[0041] In block 314, the processor generates an optimized flow model based on the starting event, the transition rules, the common sub-processes, and the context. In some examples, the optimized flow model may be generated for each user of a particular organization. In various examples, the optimized flow model may be generated for a particular organization. In some examples, the processor may generate an optimized flow model that can be used by multiple organizations.

[0042] In block 316, the processor adjusts the optimized flow model based on user feedback. For example, the processor may allow a user to customize and enhance the generated optimized flow model.

[0043] 3 is not intended to indicate that the operations of method 300 are performed in any particular order or that all operations of method 300 are included in all cases. In addition, method 300 may include any suitable number of additional operations. For example, assuming a user continues to execute additional processes, the processor may periodically identify additional processes with a common start event and common sub-processes. The processor may then update the optimized flow model to include additional transition rules for these common sub-processes.

[0044] In some scenarios, the techniques described herein may be implemented in a cloud computing environment. As discussed in detail below with reference to at least Figures 4-7, a computing device configured to automate workflows using structured log events may be implemented in a cloud computing environment. Although this disclosure may include descriptions of cloud computing, it should be understood that implementation of the teachings detailed herein is not limited to a cloud computing environment. Rather, embodiments of the present invention may be implemented in conjunction with any other type of computing environment now known or hereafter developed.

[0045] Cloud computing is a model of service delivery that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with a service provider. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0046] The characteristics are as follows:

[0047] On-Demand Self-Service: Cloud consumers can unilaterally provision computing power, such as server time and network storage, as they need it automatically without the need for human interaction with the service provider.

[0048] Broadband Network Access: Capabilities are available over the network and accessed via standard mechanisms that facilitate use by heterogeneous thin-client or thick-client platforms (e.g., mobile phones, laptops, PDAs).

[0049] Resource Pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where various physical and virtual resources are dynamically allocated and reallocated according to demand. Consumers generally have no control or knowledge of the exact location of the resources provided to them, but there is a sense of location independence in the sense that they can specify location at a higher level of abstraction (e.g. country, state, or data center).

[0050] Rapid Elasticity: Capacity can be rapidly and elastically, in some cases automatically, provisioned to quickly scale out and rapidly released to quickly scale in. To the consumer, the provisioned available capacity often appears externally unlimited, and any amount can be purchased at any time.

[0051] Measured Services: Cloud systems automatically control and optimize resource usage by utilizing metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, number of active users). Resource usage is monitored, controlled, and reported, providing transparency to both providers and consumers of the services being used.

[0052] The service model is as follows:

[0053] Software as a Service (SaaS): The capability offered to the consumer is to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying infrastructure, including networks, servers, operating systems, storage, or even individual application capabilities with the potential exception of limited user-specific application configuration settings.

[0054] Platform as a Service (PaaS): The capability offered to a consumer is to deploy consumer-created or acquired applications, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does have control over the deployed applications and possibly the configuration of the application hosting environment.

[0055] Infrastructure as a Service (IaaS): The capability provided to the consumer is to provide processing, storage, networking, and other basic computing resources onto which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating systems, storage, deployed applications, and in some cases, limited control over selected networking components (e.g., host firewalls).

[0056] The deployment model is as follows:

[0057] Private Cloud: The cloud infrastructure is used exclusively for one organization. It may be managed by the organization or a third party and may be on-premise or off-premise.

[0058] Community Cloud: Cloud infrastructure is shared by several organizations to support a specific community with common concerns (e.g., mission, security requirements, policy and compliance considerations). It may be managed by the organization or a third party and may exist on-premise or off-premise.

[0059] Public Cloud: The cloud infrastructure is available to the general public or large industry entities and is owned by organizations that sell cloud services.

[0060] Hybrid Cloud: A cloud infrastructure is a blend of two or more clouds (private, community or public) that remain unique entities but are joined by standardized or proprietary technologies that allow data and application portability (e.g. cloud bursting for load balancing between clouds).

[0061] Cloud computing environments are service-oriented with an emphasis on statelessness, low coupling, modularity and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0062] FIG. 4 is a block diagram of an example computing device that can automate and assist workflows using structured log events. The computing device 400 may be, for example, a server, a desktop computer, a laptop computer, a tablet computer, or a smartphone. In some examples, the computing device 400 may be a cloud computing node. The computing device 400 may be described in the general context of computer system executable instructions, such as program modules, executed by a computer system. Generally, program modules include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. The computing device 400 may be implemented in a distributed cloud computing environment where tasks are performed by remote processing devices linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0063] The computing device 400 may include a processor 402 for executing stored instructions and a memory device 404 for providing temporary memory space for the operation of said instructions during operation. The processor may be a single core processor, a multi-core processor, a computing cluster, or any number of other configurations. The memory 404 may include random access memory (RAM), read-only memory, flash memory, or other suitable memory system.

[0064] The processor 402 may be connected via a system interconnect 406 (e.g., PCI, PCI-Express, etc.) to an input / output (I / O) device interface 408 adapted to connect the computing device 400 to one or more I / O devices 410. The I / O devices 410 may include, for example, a keyboard and a pointing device, which may include a touchpad or touchscreen, among others. The I / O devices 410 may be built-in components of the computing device 400 or may be devices externally connected to the computing device 400.

[0065] The processor 402 may also be linked via the system interconnect 406 to a display interface 412 adapted to connect the computing device 400 to a display device 414. The display device 414 comprises a display screen that is an internal component of the computing device 400. The display device 414 may include a computer monitor, a television, or a projector externally connected to the computing device 400. In addition, a network interface controller (NIC) 416 may be adapted to connect the computing device 400 to a network 418 via the system interconnect 406. In some embodiments, the NIC 416 may transmit data using any suitable interface or protocol, such as an Internet Small Computer System Interface, among others. The network 418 may be a cellular network, a wireless network, a wide area network (WAN), a local area network (LAN), or the Internet. An external computing device 420 may connect to the computing device 400 via the network 418. In some examples, the external computing device 420 may be an external web server 420. In some examples, the external computing device 420 may be a cloud computing node.

[0066] The processor 402 may also be linked via the system interconnect 406 to a storage device 422, which may include a hard drive, an optical drive, a USB flash drive, an array of drives, or any combination thereof. In some examples, the storage device may include an activity monitor module 424, an activity logger module 426, a natural language understanding (NLU) module 428, a process miner module 430, and a workflow assistant and automator 432. The activity monitor module 424 may monitor a user interface to generate an activity log that includes a step flow. For example, the step flow includes steps taken by a user to complete a particular task. The activity logger module 426 may store the activity log in a database. For example, the database may be an internal database or an external database. The NLU module 428 may extract features and common variables from the unstructured data in the activity log and generate structured log events based on the extracted features and common variables. The process miner module 430 may generate a workflow model based on the structured log events. For example, the process miner module 430 can convert the structured log events into start events, step flows, and end events. The process miner module 430 can then detect common start events among the processes being monitored. The process miner module 430 can consolidate and optimize the processes based on the common start events. The process miner module 430 can further detect common sub-processes among the processes. The process miner module 430 can also detect transition rules for each process in the process. The process miner module 430 can perform classification to detect context. The process miner module 430 can then generate an optimized flow model based on the start events, transition rules, common sub-processes, and context.In some examples, the process miner module 430 can adjust the optimized flow model based on user feedback. In some examples, the process miner module 430 can also cluster cross-sectional customers and generate improved workflows to be presented to each customer in the cluster. In various examples, the process miner module 430 can interactively perform predictive analytics to suggest next steps for a user manual process. The workflow assistant and automator 432 can automate or assist workflows based on the generated workflow model. For example, the automated or assisted workflows can be security best practice workflows, forensic process workflows, system tuning workflows, or risk mitigation process workflows.

[0067] The block diagram of FIG. 4 is not intended to indicate that the computing device 400 includes all of the components depicted in FIG. 4. Rather, it should be understood that the computing device 400 may include fewer or additional components not depicted in FIG. 4 (e.g., additional memory components, embedded controllers, modules, additional network interfaces, etc.). Additionally, any functionality of the activity monitor module 424, activity logger module 426, NLU module 428, process miner module 430, and workflow assistant and automator 432 may be implemented, partially or fully, in hardware or processor 402, or both. For example, functionality may be implemented by logic implemented in an application specific integrated circuit, an embedded controller, or logic implemented within the processor 402. In some embodiments, the functionality of activity monitor module 424, activity logger module 426, NLU module 428, process miner module 430 and workflow assistant and automator 432 may be implemented in logic, which may include any suitable hardware (e.g., a processor, etc.), software (e.g., an application, etc.), firmware, or any suitable combination of hardware, software, and firmware, as referred to herein.

[0068] Referring now to FIG. 5, an exemplary cloud computing environment 500 is shown. As shown, the cloud computing environment 500 includes one or more cloud computing nodes 502 with which local computing devices used by cloud consumers, such as, for example, a PDA or cell phone 504A, a desktop computer 504B, a laptop computer 504C, or an automobile computer system 504N, or combinations thereof, may communicate. The nodes 502 may communicate with each other. They may be physically or virtually grouped (not shown) in one or more networks, such as private, community, public, or hybrid clouds, as described above, or combinations thereof. This enables the cloud computing environment 500 to provide infrastructure, platform, or software, or combinations thereof, as a service, for which the cloud consumer does not need to maintain resources on a local computing device. The types of computing devices 504A-504N shown in FIG. 5 are for illustrative purposes only, and it will be understood that the computing node 502 and cloud computing environment 500 can communicate with any type of computerized device via any type of network, a network-addressable connection (e.g., using a web browser), or both.

[0069] Referring now to Figure 6, a set of functional abstraction layers provided by cloud computing environment 500 (Figure 5) is shown. It should be understood in advance that the components, layers and functions shown in Figure 6 are for illustrative purposes only, and embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0070] The hardware and software layer 600 includes hardware and software components. Examples of hardware components include mainframes, for example IBM® zSeries® Systems, servers based on RISC (Reduced Instruction Set Computer) architecture, for example IBM® pSeries® Systems, IBM® xSeries® Systems, IBM® BladeCenter® Systems, storage devices, networks and networking components. Examples of software components may include, for example IBM® WebSphere® application server software and database software, for example IBM® DB2® database software. (IBM, zSeries, pSeries, xSeries, BladeCenter, WebSphere and DB2 are trademarks of International Business Machines Corporation, registered in many jurisdictions worldwide.)

[0071] The virtualization layer 602 provides an abstraction layer from which examples of virtualized entities such as virtualized servers, virtualized storage, virtualized networks including virtual private networks, virtualized applications and operating systems, and virtual clients are provided. In one example, the management layer 604 may provide the functions described below. Resource provisioning provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing provides tracking of costs as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. A user portal provides access to the cloud computing environment for consumers and system administrators. Service level management provides allocation and management of cloud computing resources to meet required service levels. Service Level Agreement (SLA) planning and fulfillment provides for the pre-allocation and procurement of cloud computing resources in anticipation of future demand in accordance with the SLA.

[0072] The Workloads layer 606 provides examples of functionality for which cloud computing environments are utilized. Examples of workloads and functions provided from this layer include mapping and navigation, software development and lifecycle management, virtual classroom instructional delivery, data analytics processing, transaction processing, and workflow automation.

[0073] The invention may be a system, method or computer program product or combination thereof at any possible level of technical detail of integration. The computer program product may include a computer readable storage medium having computer readable program instructions thereon for causing a processor to perform aspects of the invention.

[0074] A computer readable storage medium may be a tangible device that holds and stores instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded devices such as punch cards or ridge structures in grooves having instructions recorded thereon, and any suitable combination of the above. Computer-readable storage media, as used herein, is not to be construed as a transitory signal per se, such as an electric wave, a freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted through a wire.

[0075] The computer readable program instructions described herein may be downloaded from a computer readable storage medium to each computing / processing device or to an external computer or storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer readable program instructions from the network and transfers the computer readable program instructions to a computer readable storage medium within the respective computing / processing device for storage.

[0076] The computer readable program instructions for carrying out the operations of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine language instructions, machine dependent instructions, microcode, firmware instructions, state setting data, or object code written in any combination of one or more programming languages, including object oriented languages ​​such as Smalltalk®, C++ or the like, conventional procedural languages ​​such as the C programming language or similar programming languages. The computer readable program instructions may be executed as a stand-alone software package, entirely on the user's computer, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or wide area network (WAN), or the connection may be made to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, the electrical circuitry may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to individualize the electrical circuitry, which may include, for example, programmable logic circuitry, a field programmable gate array (FPGA), or a programmable logic array (PLA), to perform aspects of the invention.

[0077] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the technology. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, may be implemented by computer readable program instructions.

[0078] These computer readable program instructions may be provided to a general purpose computer, special purpose computer processor or other programmable data processing apparatus to generate a machine such that the instructions, executed via the computer processor or other programmable data processing apparatus, create means for implementing the functions / acts specified in the block or blocks of the flowchart diagrams and / or blocks. These computer readable program instructions may also be stored on a computer readable storage medium capable of directing a computer, programmable data processing apparatus or other device or combination thereof to function in a particular manner, such that a computer readable storage medium having instructions stored thereon includes an article of manufacture including instructions that implement aspects of the functions / acts specified in the block or blocks of the flowchart diagrams and / or blocks.

[0079] The computer readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device and cause the computer, other programmable data processing apparatus, or other device to perform a series of operational steps to generate a computer implemented process such that the instructions executing on the computer, other programmable data processing apparatus, or other device implement aspects of the functions / actions identified in a block or blocks of the flowchart and / or blocks.

[0080] 7, a block diagram of an example tangible non-transitory computer readable medium 700 is shown that can automate and assist workflows with structured log events. The tangible non-transitory computer readable medium 700 may be accessed by a processor 702 via a computer interconnect 704. Additionally, the tangible non-transitory computer readable medium 700 may include code that directs the processor 702 to perform the operations of the methods 200 and 300 of FIGS. 2 and 3.

[0081] Various software components described herein may be stored on a tangible, non-transitory computer readable medium 700, as shown, for example, in FIG. 7. For example, the activity monitor 706 includes code for monitoring a user interface and generating an activity log including a step flow. The natural language understanding module 710 includes code for extracting features and common variables from unstructured data in the activity log and generating structured log events based on the extracted features and common variables. The process miner module 712 includes code for generating a workflow model based on the structured log events. In some examples, the process miner module 712 includes code for converting the structured log events into start events, step flows, and end events. In various examples, the process miner module 712 includes code for detecting common start events among the monitored processes. The process miner module 712 may include code for consolidating and optimizing processes based on the common start events. The process miner module 712 may further include code for detecting common sub-processes among the processes. The process miner module 712 may also include code for detecting transition rules for each process in the process. The process miner module 712 may include code for performing classification and detecting context. The process miner module 712 may also include code for generating an optimized flow model based on the starting event, the transition rules, the common sub-processes, and the context. In some examples, the process miner module 712 may include code for adjusting the optimized flow model based on user feedback. In various examples, the process miner module 712 also includes code for clustering customers across and generating improved workflows to recommend to each customer in the cluster. The workflow assister and automator 714 includes code for automating or assisting workflows based on the generated workflow model.In some examples, the workflow assistant and automator 714 includes code for interactively performing predictive analytics that suggest next steps for a user manual process. It should be understood that any number of additional software components not shown in FIG. 7 may be included within the tangible, non-transitory computer readable medium 700 depending on the particular application.

[0082] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block of the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a particular logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order depicted in the drawings. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may be executed in reverse order depending on the functionality involved. It should be noted that each block of the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, may be implemented by a special purpose hardware-based system that performs a particular function or action or implements a combination of special purpose hardware and computer instructions. It should be understood that any number of additional software components not depicted in FIG. 7 may be included within the tangible non-transitory computer-readable medium 700 depending on the particular application.

[0083] The description of various embodiments of the present technology has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terms used in this specification are selected to best explain the principles of the embodiments, practical applications, or technical improvements to the technology found in the market, or to allow other skilled in the art to understand the embodiments disclosed herein.< / user> < / sensitiveobject> < / grantee> < / entity:value>

Claims

1. 1. A computer system including a processor, the processor comprising: monitoring interactions between a system for investigating security incidents and a user via a user interface to generate an activity log including a step flow performed by the user with the system; extracting features and common variables from unstructured data in the activity log and generating structured log events based on the extracted features and common variables; detecting a common initiation event by which multiple security incident investigations are initiated based on the structured log events, and generating a workflow model by integrating multiple processes related to the common initiation event; Automating or assisting a workflow based on the generated workflow model. A computer system for performing the above.

2. A computer system including a processor, the processor comprising: monitoring a user interface to generate an activity log including a step flow; extracting features and common variables from unstructured data in the activity log and generating structured log events based on the extracted features and common variables; generating a workflow model based on the structured log events, the processor comprising: Detecting a common start event among the monitored processes; integrating and optimizing said processes based on said common initiating event; detecting a common sub-process among said processes; Detecting a transition rule for each process in the integrated processes; performing classification to detect a context; generating an optimized flow model based on the start event, the transition rule, the common sub-process, and the context; generating the workflow model, Automating or assisting a workflow based on the generated workflow model. A computer system for performing the above.

3. 3. The computer system of claim 2, wherein the processor is for adjusting the optimized flow model based on user feedback.

4. The computer system according to any one of claims 1 to 3, wherein the structured log events are generated via a natural language understanding unit, and the processor is for converting the structured log events into a start event, a step flow and an end event.

5. The computer system of any one of claims 1 to 4, wherein the processor is for clustering traversed customers and generating an improved workflow to be presented to each customer in the cluster.

6. The computer system of any one of claims 1 to 5, wherein the processor is for interactively performing predictive analytics to suggest next steps for a user's manual process.

7. 7. The computer system of claim 1, wherein the automated or assisted workflow comprises a security best practice workflow, a forensic process workflow, a system tuning workflow, or a risk mitigation process workflow.

8. 11. A computer-implemented method, comprising: monitoring, via a processor, interactions between a system for investigating security incidents and a user via a user interface to generate an activity log including a step flow performed by the user using the system; extracting, via the processor, features and common variables from the unstructured data in the activity log and generating structured log events based on the extracted features and common variables; detecting, via the processor, a common initiation event by which multiple security incident investigations are initiated based on the structured log events, and generating a workflow model by integrating multiple processes related to the common initiation event; automating or assisting a workflow based on the generated workflow model via the processor; The computer-implemented method of claim 1, 9. A computer-implemented method, comprising: a computer system comprising: monitoring, via a processor, the user interface to generate an activity log including the step flow; extracting, via the processor, features and common variables from the unstructured data in the activity log and generating structured log events based on the extracted features and common variables; generating, via the processor, a workflow model based on the structured log events; automating or assisting a workflow based on the generated workflow model via the processor; and generating the workflow model comprises: detecting a common start event among the processes being monitored; integrating and optimizing the processes based on the common initiating event; detecting a common sub-process among said processes; detecting a transition rule for each process in the integrated processes; performing classification to detect a context; generating an optimized flow model based on the start event, the transition rule, the common sub-process, and the context; 4. A computer-implemented method comprising:

10. The step of generating a workflow model includes: The computer-implemented method of claim 9 , further comprising adjusting the optimized flow model based on user feedback.

11. The computer-implemented method of claim 8, further comprising the step of the computer system converting the structured log events into a start event, a step flow and an end event.

12. A computer-implemented method as described in any one of claims 8 to 11, wherein the computer system includes a step of clustering traversing customers and generating an improved workflow to be recommended to each customer in the cluster.

13. A computer-implemented method as described in any one of claims 8 to 12, further comprising a step in which the computer system interactively performs predictive analysis to suggest next steps for a user's manual process.

14. A computer-implemented method as described in any one of claims 8 to 13, further comprising the steps of: the computer system generating an additional workflow model based on the structured log events; and automatically executing the additional workflow model to generate a plurality of results to be presented.

15. 1. A computer program for automating or assisting a workflow, the computer program comprising: monitoring interactions between a system for investigating security incidents and a user via a user interface to generate an activity log including a step flow performed by the user with the system; extracting features and common variables from unstructured data in the activity log and generating structured log events based on the extracted features and common variables; detecting a common initiation event by which multiple security incident investigations are initiated based on the structured log events, and generating a workflow model by integrating multiple processes related to the common initiation event; Automating or assisting a workflow based on the generated workflow model. A computer program for executing the following:

16. A computer program for automating or assisting a workflow, the computer program comprising: monitoring a user interface to generate an activity log including a step flow; extracting features and common variables from unstructured data in the activity log and generating structured log events based on the extracted features and common variables; generating a workflow model based on the structured log events, Detecting a common start event among the monitored processes; integrating and optimizing said processes based on said common initiating event; detecting a common sub-process among said processes; Detecting a transition rule for each process in the integrated processes; performing classification to detect a context; generating an optimized flow model based on the start event, the transition rule, the common sub-process, and the context; generating said workflow model, Automating or assisting a workflow based on the generated workflow model. A computer program for executing the following:

17. 20. The computer program product of claim 16, further comprising: adjusting the optimized flow model based on user feedback.

18. The computer program product of any one of claims 15 to 17, further comprising: converting the structured log events into a start event, a step flow and an end event.

19. The computer program of any one of claims 15 to 18, wherein the computer program causes the processor to cluster traversed customers and generate an improved workflow to be recommended to each customer in the cluster.

20. 20. The computer program product of claim 15, further comprising: causing the processor to interactively perform predictive analytics that suggest next steps for a user manual process.

Images