Wil Aalst

Majid Rafiei

Leopold Von Waldthausen

Wil M P Van Der Aalst

Supporting Confidentiality in Process Mining Using Abstraction and Encryption

Keywords: Responsible process mining, Confidentiality, Process discovery, Directly follows graph, Social network analysis

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Data science is changing the way we do business, socialize, conduct research, and govern society. Data are collected on anything, at any time, and in any place. Therefore, it is not surprising that many people are concerned about the responsible use of data. The Responsible Data Science (RDS) [START_REF] Van Der Aalst | Responsible data science[END_REF] initiative focuses on four main questions: (1) How to avoid unfair conclusions even if they are true?, (2) How to answer questions with a guaranteed level of accuracy?, (3) How to answer questions without revealing secrets?, and (4) How to clarify answers such that they become indisputable? This paper focuses on the confidentiality problem (third question) when applying process mining to event data.

Process mining uses event data to provide novel insights into actual processes [START_REF] Van Der Aalst | Process Mining -Data Science in Action, Second Edition[END_REF]. There are many activities and techniques in the field of process mining. However, the three basic types of process mining are; process discovery [START_REF] Van Der Aalst | Business process management: a comprehensive survey[END_REF], conformance checking [START_REF] Van Der Aalst | Process Mining -Data Science in Action, Second Edition[END_REF], and process re-engineering (enhancement) [START_REF] Van Der Aalst | Replaying history on process models for conformance checking and performance analysis[END_REF]. Also, four perspectives are considered to analyze the event data including; controlflow, organizational, case, and time perspective [START_REF] Van Der Aalst | Process Mining -Data Science in Action, Second Edition[END_REF]. In this paper, we focus on control-flow and organizational perspective side by side. A simple definition for process discovery is learning process models from event logs. In fact, a discovery technique takes an event log and produces process model without using additional information [START_REF] Van Der Aalst | Process discovery from event data: Relating models and logs through abstractions[END_REF]. A social network is a social structure which shows relations among social actors (individuals or organizations) [START_REF] Wasserman | Social network analysis: Methods and applications[END_REF]. When event data contain information about resources, not only can it be used to thoroughly analyze bottlenecks, but also it turns to a valuable data to derive social networks among resources, involved in the process. Since such event data contain highly sensitive information about the organization and the people involved in the process, confidentiality is a major concern. Note that by confidentiality in process mining, we aim to deal with two important issues; [START_REF] Van Der Aalst | Business process management: a comprehensive survey[END_REF] protecting the sensitive data belonging to the organization, (2) protecting the private information about the individuals.

As we show in this paper, confidentiality in process mining cannot be achieved by merely encrypting all data. Since people need to use and see process mining results, the challenge is to retain as little information as possible while still being able to have the same desired result. Here, the desired results are process models and social networks. The discovered models (networks) based on the anonymized event data should be identical to the results obtained from the original event data (assuming proper authorizations).

In this paper, we propose an approach to deal with confidentiality in process mining which is based on abstractions. Moreover, we present the connector method by which the individual traces of a process stay anonymous, yet, at the same time, process models and social networks are discoverable. The proposed framework allows us to derive the same results from secure event logs when compared to the results from original event logs, while unauthorized persons cannot access confidential information. In addition, this framework can provide a secure solution for process mining when processes are cross-organizational.

The remainder of this paper is organized as follows. Section 2 outlines related work and the problem background. In Section 3, we clarify process mining, social network discovery, and cryptography as preliminaries. In Section 4, the problem is explained in detail. Our approach is introduced in Section 5. In Section 6 the approach is evaluated, and Section 7 concludes the paper.

Related Work

In data science, social networks, and information systems, confidentiality has been a topic of interest in the last decade. In computer science, privacy-preserving algorithms and methods in differential privacy are most applicable to confidentiality in process mining. In sequential pattern mining, the field of data science which arguably close to process mining, there has been work on preserving privacy in settings with distributed databases [START_REF] Kapoor | Privacy preserving sequential pattern mining in distributed databases[END_REF] or in cross-organizational settings [START_REF] Zhan | Privacy-preserving collaborative sequential pattern mining[END_REF]. Also, privacy-preservation in social networks is a well-researched topic, and most of the research in this field aims to protect the privacy of the individuals involved in a given social network [START_REF] Kleinberg | Challenges in mining social network data: processes, privacy, and paradoxes[END_REF]. However, here, we focus on the confidentiality issues arising when initially discovering social networks from event logs that comprise lots of sensitive private data about the individuals.

Although there have been a lot of breakthroughs in the field of process mining ranging from data preprocessing [START_REF] Sani | Repairing outlier behaviour in event logs[END_REF] and process discovery [START_REF] Mannhardt | Guided process discovery-a pattern-based approach[END_REF] to performance analysis [START_REF] Leemans | Hierarchical performance analysis for process mining[END_REF] and prediction [START_REF] Pourbafrani | Scenario-based prediction of business processes using system dynamics[END_REF], the research field confidentiality and privacy has received relatively little attention. This is despite the fact that already the Process Mining Manifesto [START_REF] Van Der Aalst | Process mining manifesto[END_REF] points out that privacy concerns are important to be addressed. In the following, we introduce some research regarding Responsible Process Mining (RPM) and few publications which focused specifically on confidentiality issues, in the control-flow perspective or during process discovery.

The topic of Responsible Process Mining (RPM) [START_REF] Van Der Aalst | Responsible data science: using event data in a "people friendly" manner[END_REF] has been put forward by several authors thereby raising concerns related to fairness, accuracy, confidentiality, and transparency. In [START_REF] Tillem | Privacy-preserving alpha algorithm for software analysis[END_REF], a method for securing event logs to be able to do process discovery by Alpha algorithm has been proposed. In [START_REF] Burattin | Toward an anonymous process mining[END_REF], a possible approach toward a solution, allowing the outsourcing of process mining while ensuring the confidentiality of dataset and processes, has been presented. In [START_REF] Liu | Towards comprehensive support for privacy preservation cross-organization business process mining[END_REF], the authors has used a cross-organizational process discovery setting, where public process model fragments are shared as safe intermediates. In [START_REF] Mannhardt | Privacy challenges for process mining in human-centered industrial environments[END_REF], the aim is to provide an overview of privacy challenges when process mining is used in human-centered industrial environments. In [START_REF] Rafiei | Ensuring confidentiality in process mining[END_REF], the authors introduce a framework for ensuring confidentiality in process mining which is utilized and extended in this paper. In [START_REF] Fahrenkrog-Petersen | PRETSA: event log sanitization for privacy-aware process discovery[END_REF], a privacy model is proposed for privacy-aware process discovery. In [START_REF] Rafiei | Mining roles from event logs while preserving privacy[END_REF], the organizational perspective in process mining is taken into account, and the aim is to provide a privacy-preserving method for role mining, which can be used for generalizing resources as individuals in event data. It is also worth noting that process mining can be used for security analyses, e.g., in [START_REF] Accorsi | On the exploitation of process mining for security audits: the process discovery case[END_REF], process mining is used for security auditing.

Background

In this section, we briefly present the main concepts and refer the readers to relevant literature for more detailed explanations.

Process Mining

In the following, we introduce some basic concepts of process mining to which we will refer in this paper.

Events are the smallest data unit in process mining and occur when an activity in a process is executed. Events comprise of multiple attributes including; Case ID, Timestamp, Activity, Resource, etc. In Table 1, each row indicates an event. In the remainder of this paper, we will refer to the activities and resources of Table 1 with their abbreviations, e.g., "R" stands for "Register".

A trace is a sequence of events and represents how a process is executed in one instance, e.g., in Table 1, case 1 is first registered, then documents are verified, and vacancies are checked. Finally, a decision is made for the case.

An event log is a collection of sequences of events which are used as the input of process mining algorithms. Event data are widely available in current information systems [START_REF] Van Der Aalst | Process mining manifesto[END_REF].

As you can see in Table 1, a "Timestamp" identifies the moment in time at which an event has taken place, and a "Case ID" is what all events in a trace have in common so that they can be identified as part of that process instance. Event logs can also include additional attributes for the events they record. There are two main attribute types that fall under this category. "Event Attributes" which are specific to an event, and "Case Attributes" which are ones that stay the same throughout an entire trace. Fig. 1: The DFG resulting from event log Table 1 A Directly Follows Graph (DFG) is a graph where the nodes represent activities and the arcs represent causalities. Activities "a" and "b" are connected by an arrow when "a" is frequently followed by "b". The weights of the arrows denote the frequency of the relation [START_REF] Leemans | Scalable process discovery and conformance checking[END_REF]. Most commercial process mining tools use DFGs. Unlike more advanced process discovery techniques (e.g., implemented in ProM), DFGs cannot express concurrency. Figure 1 shows the DFG resulting from the event log Table 1.

Discovering Social Networks

There are different methods for discovering social networks from event logs including those based on causality, joint activities, joint cases, etc. [START_REF] Van Der Aalst | Discovering social networks from event logs[END_REF]. Here, we, however, focus purely on the metrics based on causality. These metrics monitor (a) The handover network resulting from Table 1.

(b) The real-handover network resulting from Table 1 for the real causal dependency threshold 0.1.

Fig. 2: The networks based on causality for the event log Table 1 for individual cases how work moves from resource to resource. E.g., there is a handover relation from individual i to individual j, if there are two subsequent activities where the first is performed by i and the second is performed by j. This relation furthermore becomes a real-handover if casual dependency between both activities exists. Note that in this case the directly follows relations between resources are not enough and the real casual dependencies are required. Dependency measure (Equation 1) can be used to realize whether there is a real casual dependency between two activities (a and b) or not, while a threshold is set as the minimum required value [START_REF] Van Der Aalst | Process Mining -Data Science in Action, Second Edition[END_REF]. In Equation 1, |a> L b| shows how frequent a is followed by b:

|a ⇒ L b| = |a> L b|-|b> L a| |a> L b|-|b> L a|+1 if a = b |a> L b| |a> L b|+1 if a = b (1)
When observing handovers, indirect succession may also be considered. E.g., based on the event log of Table 1, there is a non-real handover relation between "Frank" and "Alex" with the depth three. It is non-real due to there is no real casual dependency between all the corresponding activities. Figure 2 shows the networks based on causality having been obtained from event log Table 1.

Cryptography

Cryptography or cryptology is about constructing and analyzing protocols that prevent third parties or the public from reading private messages [START_REF] Bellare | Introduction to modern cryptography[END_REF].

A cryptosystem is a suite of cryptographic algorithms needed to implement a particular security service, most commonly for achieving confidentiality [START_REF] Katz | Handbook of applied cryptography[END_REF]. There are different kinds of cryptosystems. In this paper, we use the following ones.

-Symmetric Cryptosystem: The same secret key is used to encrypt and decrypt a message. Data manipulation in symmetric systems is faster than asymmetric systems as they generally use shorter key lengths. Advanced Encryption Standard (AES) is a symmetric encryption algorithm [START_REF] Daemen | The design of Rijndael: AES-the advanced encryption standard[END_REF]. -Asymmetric Cryptosystem: Asymmetric systems use a public key to encrypt a message and a private key to decrypt it or vice versa. The use of asymmetric systems enhances the security of communication. Rivest-Shamir-Adleman (RSA) is an asymmetric encryption algorithm. -Deterministic Cryptosystem: A deterministic cryptosystem is a cryptosystem which always produces the same ciphertext for a given plaintext and key, even over separate executions of the encryption algorithm. -Probabilistic Cryptosystem: A probabilistic cryptosystem, other than the deterministic cryptosystem, is a cryptosystem which uses randomness when encrypting so that when the same plaintext is encrypted several times, it will produce different ciphertexts. -Homomorphic Cryptosystem: A homomorphic cryptosystem allows computation on ciphertext, e.g., Paillier is a partially homomorphic cryptosystem [START_REF] Paillier | Public-key cryptosystems based on composite degree residuosity classes[END_REF].

Problem Definition (Attack Analysis)

To illustrate the challenge of confidentiality in process mining, we start this section with an example. Consider Table 2, describing a totally encrypted event log, belonging to a hospital conducting surgeries. Since we need to preserve difference to find a sequence of activities for each case, discovering process model, and other analyses like social network discovery, "Case ID", "Activity", and "Resource" are encrypted based on a deterministic encryption method. Numerical data (i.e., "Timestamp" and "Cost") are encrypted by a homomorphic encryption method to preserve the ability of basic mathematical computations on the encrypted data. Now suppose that we have background knowledge about surgeons and the approximate cost of different types of surgeries. The question arises whether parts of the log can now be deanonymized. Owning to the fact that "Cost" is encrypted by a homomorphic encryption method, the maximum value for the "Cost" is the real maximum cost and based on background knowledge we know that e.g., the most expensive event in the hospital was the brain surgery by "Dr. Jone", on "01/09/2018 at 12:00", and the patient name is "Judy". Since "Case ID", "Activity", and "Resource" are encrypted by a deterministic encryption method, we can replace all these encrypted values with the corresponding plain values. Consequently, encrypted data could be made visible without requiring decryption. This example demonstrates that even given completely encrypted event logs small fraction of contextual knowledge can leads to data leakage.

Given domain knowledge, several analyses could be done to identify individuals or extract some sensitive information from an encrypted event log. In the following, we explain couple of them.

-Exploring the Length of Traces: One can find the longest/shortest trace, and the related background knowledge can be exploited to realize the actual activities and the related case(s). -Frequency Mining: One can find the most or the less frequent traces and the related background knowledge can be utilized to identify the corresponding case(s) and the actual activities.

These are just some examples demonstrate that encryption alone is not a solution. For example, [START_REF] Ma | Privacy vulnerability of published anonymous mobility traces[END_REF] shows that mobility traces are easily identifiable after encryption. Any approach which is based on solely encrypting the whole event log will furthermore have the following weaknesses:

-Encrypted Results: Since results are encrypted, the data analyst is not able to interpret the results. E.g., as data analyst we want to know which paths are the most frequent after "Registration" activity; how can one perform this analysis when the activities are not plain? The only solution is decrypting the results. -Impossibility of Accuracy Evaluation: How can we make sure that a result of the encrypted event log is the same as the result of the plain event log? Again, decryption would be required.

Generally, and as explored by [START_REF] Burattin | Toward an anonymous process mining[END_REF], using cryptography is a resource consuming activity, and decryption is even much more resource consuming than encryption. The weaknesses demonstrate that encryption methods should be used wisely and one needs to evaluate closely where they are beneficiary and where unavoidable to provide confidentiality.

Here, we assume that background knowledge could be any contextual knowledge about traces which can result in a case disclosure including; frequency of traces, length of traces, exact/approximate time related to the cases, etc. Note that this background knowledge is assumed where unauthorized people can access the anonymized data. For example, given domain knowledge regarding frequency of traces one can guess the actual sequence of activities and possible case(s) (e.g., politicians, celebrities, etc) for the traces which are too rare. Consequently, individuals or minority group of people and their private information would be revealed. Therefore, the case disclosure is a crucial type of data leakage which should be prevented.

Approach

Figure 3 illustrates a framework to provide a solution for confidentiality when the desired result is a model. This framework has been inspired by [START_REF] Van Der Aalst | Process discovery from event data: Relating models and logs through abstractions[END_REF], where abstractions are introduced as intermediate results for relating models and logs.

Here, abstractions are directly follows matrix of activities (A-DFM) and directly follows matrix of resources (R-DFM). Figure 4 shows the A-DFM and R-DFM resulting from event log Table 1. A-DFM is considered as the abstraction for relating logs and process models, and R-DFM together with A-DFM are considered as the abstraction for relating logs and social networks which are based on causality. As can be seen in Fig. 3 three different environments and two confidentiality solutions are presented.

-Forbidden Environment: In this environment, the actual information system runs that needs to use the real data. The real event logs (EL) produced by this environment contain a lot of valuable confidential information and except some authorized persons no one can access this data. -Internal Environment: This environment is just accessible by authorized stakeholders. A data analyst can be considered as an authorized stakeholder who can access the internal event logs. Event logs in this environment are partially secure, selected results produced in this environment (e.g., a process model) are the same as the results produced in the forbidden environment, and data analyst is able to interpret the results without decryption. -External Environment: In this environment, unauthorized external persons can access the data. Such environments may be used to provide the computing infrastructure dealing with large data sets (e.g., a cloud solution). Event logs in this environment are supposed to be entirely secure, and the results are encrypted. Whenever a data analyst wants to interpret results, they need to be decrypted and converted to an internal version. Furthermore, results from the external environment do not need to be exactly the same as the results from the internal environment, but, the same interpretations need to be provided.

Table 3 shows a summary of our assumptions with respect to the internal and external environments. Note that in the forbidden environment, the main assumption is that only few highly trusted persons can access the data. Therefore, there is no need to employ confidentiality solutions. As described in Section 4, contextual knowledge regarding traces is assumed as background knowledge. As can be seen in Fig. 3, the desired results, which are process models (P M ) and social networks (SN ), can be obtained in each environment. The original event log (EL) is converted to the partially secure event log in the internal environment (EL ) and then to the entirely secure event log in the external environment (EL ) by the internal confidentiality solution (ICS) and the external confidentiality solution (ECS) respectively. Abstractions, which are intermediate results, are used for proving accuracy. It should be taken into account that since abstractions are considered as the outputs of the very last phase before the final results Fig. 3: The proposed framework for confidentiality in process mining.

(only thresholds are required to be applied), when they are equal, the final results would be the same. In addition, transparency is provided by the reverse operation of the internal confidentiality solution (ICS -1 ) and the reverse operation of the external confidentiality solution (ECS -1 ). In the following, we explain our ICS and ECS in detail.

Internal Confidentiality Solution (ICS)

For ICS we combine several methods and introduce the connector method. Figure 5 gives an overview of the anonymization procedure.

Filtering and Modifying the Input. The first step to effective anonymization is preparing the data input. To filter the input, simple limits for frequencies can be set, and during loading an event log all traces that do not reach the minimal frequencies are not transferred to the EL .

(a) The A-DFM resulting from Table 1.

(b) The R-DFM resulting from Table 1.

Fig. 4: The abstractions from Table 1. Choosing the Plain Data. As mentioned, we need to produce interpretable results. Hence, some parts of event log remain as plain text in the internal version of the secure event log (EL ). We should decide what information and/or structure is strictly necessary for the desired analysis. Based on our considered abstractions (A-DFM and R-DFM), the only information necessary are directly follows relations between activities/resources.

Encryption. Here there are two important choices. The first choice is which columns of the event log should be encrypted. Second, we need to decide which algorithms should be used. For the internal environment, since we want to keep the capability of applying basic mathematical computations on the encrypted values, we use Paillier for numeric attributes (i.e., "Cost"), and AES-128 with only ASCII characters as the key is used for other attributes. Note that the encrypted values shown in the paper are not necessarily the real outputs of the encryption methods (they are just unintelligible text). Making Times Relative. Times need to be modified because keeping the exact epoch time of an event can allow one to identify it. The naive approach, of setting the starting time of every trace to 0, would make it impossible to replay events and reconstruct the original log. Thus, we select another time that all events are made relative to. This time can be kept secure along with the keys for decryption. Table . 4 shows the first 10 rows of our sample log after encrypting cost and making times relative to the "01-01-2018:00.00".

The Connector Method. Using the connector method we embed the structure, which can be used for extracting directly follows relations, into EL . Also, the connector method helps us to reconstruct the full original event logs when keys and relative values are given. In the first step, the previous activity ("Prev.

Activity") and the previous resource ("Prev. Resource") columns are added in order to identify which arcs can be directly connected.

In the second step, we find a way to securely save the information contained in the "Case ID", without allowing it to link the events. This can be done by giving each row a random ID ("ID") and a previous ID ("Prev. ID"). These uniquely identify the following event in a trace because the IDs are not generic like activity names. The ID for start activities is always a number of zeros. Table . 5 shows the log after adding "Prev. Activity", "Prev. Resource", "ID", and "Prev. ID". In the third step, regarding the fact that these columns contain the same information previously found in the "Case ID", they must be hidden and secured. This can be done by concatenating the "ID" and "Prev. ID" of each row and encrypting those using AES. Due to the nature of AES, neither orders nor sizes of the IDs remain inferable. The concatenation can be done in any style, in this example, we however simply concatenate "ID" and "Prev. ID",e.g., connector of the first row would be "3100". To retain the "ID" and "Prev. ID" one simply needs to decrypt the "Connector" column and cut the resulting number in two equal parts. This method requires that every time the two IDs differ by a factor 10 a zero must be added to guarantee equal length. Table 6 shows the log after concatenating the ID columns and encrypting them as a connector.

In the final step, we use the "Case ID" to anonymize the "Time tamp". The "Time tamp" attribute of events which have the same "Case ID" is made relative to the preceded one. The exception is the first event of each trace which remains unchanged. This allows the complete calculation of all durations of the arcs in a directly follows graph but makes it complicated to identify events based on the epoch times they occurred at. After creating the relative times, we are free to delete the "Case ID" and disarray the order of all rows, ending up with an unconnected log in Table 7.

Table 7 is internally secure event log (EL ), which can be used by a data analyst to create a A-DFM and a R-DFM. It is trivial to see that if process/social network discovery could have been done on the plain event log (EL), AEL would be identical to AEL (i.e., both are the same A-DFM/R-DFM) and the final desired results would be the same. Note that when the desired result is a process model, resource related information ("Resource" and "Prev. Resource" columns) can be removed from Table 7. Moreover, when the desired result is a handover network, activity related information ("Activity" and "Prev. Activity") can be removed, since the real causal dependencies do not need to be taken into account.

Comparing Table 7 and the original log, one can see that there is no answer for the following questions in EL anymore: (1) Who was responsible for doing an activity for case c? (2) What is the sequence of activities which has been done for case c? (3) How long did it take to process case c? (4) What is the cost of activity a which has been done by resource r for case c? (5) What is the the length of case c? (6) What is the the frequency of case c?, and many other questions related to the cases.

It is also worth noting that since we assume that the data in the internal environment can be accessed by the internal trustworthy people who already know the organizational structure, the plain resources are not considered as a privacy issue. In fact, EL is a partially secure version of event log in such a way that it contains the minimum level of information, which a data analyst might need to reach the result. Although ICS does not preserve the standard format of the event log which is used by the current process discovery techniques, the intermediate input it provides can be used by the current tools. In the External Confidentiality Solution (ECS), we need to avoid any form of data leakage and privacy risks based on the assumed background knowledge.

External Confidentiality Solution (ECS)

In the external environment, the plain part of the event log may cause data leakage. Therefore, the whole event log gets encrypted. Moreover, some additional attributes, which can lead to data leakage even in the encrypted form, are projected. In the following, our two-steps ECS is explained.

Encrypting the Plain Part. In this step, activities and resources are encrypted by a deterministic encryption method like AES. A deterministic encryption method must be used, because for discovering DFMs, differences should be preserved. Table 8 shows the result after encrypting activities and resources.

However, after encrypting, detecting "START" activities seem to be impossible, and without detecting them, finding traces becomes impossible. For identifying the "START" activities, we can go through the "Activity" ("Resource") and "Prev. Activity" ("Prev. Resource") columns, the activities (resources) which are appeared in the "Prev. Activity" ("Prev. Resource") column but not appeared in the "Activity" ("Resource") column are the "START" activities (resources).

Fortifying Encryption and/or Projecting Event Logs. As mentioned in Section 4, since resources are encrypted by a deterministic encryption method, and costs are encrypted by a homomorphic encryption method, which preserves differences, by comparison, one can find the minimum/maximum cost, which can be used as knowledge for extracting confidential or private information (e.g. name of resource). In order to decrease the effect of such analyses, fortifying encryption and/or projecting event logs could be done. Here, we project the costs which are indeed not necessary for the desired results.

Evaluation

We consider three evaluation criteria for the proposed approach, yet, at the same time, performance is also taken into account:

-Ensuring Confidentiality: As explained in Section 5, we can improve confidentiality by defining different environments and indicating a level of information which is accessible in each of these environments. In addition, using multiple encryption methods and our connector method for disassociating events from their cases provide high level of confidentiality with respect to the assumed background knowledge. -Reversibility: When the keys and the value used for making times relative are given, both ICS and ECS are reversible, which means that transparency is addressed by the proposed approach. -Accuracy: To show the accuracy of our approach, by a case study we illustrate that the results obtaining from the secure version of event logs are exactly the same as the results obtaining from the original event logs.

Correctness of the Approach

As can be seen in Fig. 3, from accuracy point of view, we need to show that the abstraction of the original event log is the same as the abstraction of the internal event log (AEL = AEL ) (rule (2)), and also the abstraction of the internal event log is the same as the abstraction of the external event log, which is encrypted (AEL = ECS -1 (AEL )) (rule (3)). To show that these relations are guaranteed to hold, we have implemented an interactive environment in Python and tested the approach on multiple event logs. In the following, we illustrate the results obtaining by applying the approach on "BPI challenge 2012".

AEL = AEL ⇒ P M = P M ∧ SN = SN (2)
AEL = ECS -1 (AEL ) ⇒ P M ≈ ECS -1 (P M )∧SN ≈ ECS -1 (SN ) (3)
In the first step, EL , and EL were created. Then, to verify that AEL and AEL are identical, we created a DFG from the original and the internal version of event log. Figure 6 shows the DFGs resulting from BPI challenge 2012 for the frequency threshold 2000. As one can see both DFGs are the same. Also, Fig. 7 shows the DFG resulting from BPI challenge 2012 for the same frequency threshold (2000) in the external environment. As can be seen, this DFG is also the same as the DFG from the EL and EL (modulo renaming and layout differences), i.e., all the process discovery algorithms which are based on a DFG would lead to the same process models in the different environments.

In order to demonstrate that the causality based social networks in the secure environments are the same as the actual social networks from the original event log, we have made the real-handover from the original and internal version of event log for BPI challenge 2012. Figure 8 shows the networks for the real causal dependency threshold 0.5 and the frequency threshold 50. The networks are exactly the same. It is obvious that the network from the external version of event log must be the same (while resources are encrypted). Nevertheless, in Fig. 9, we have zoomed in the highlighted parts of Fig. 8 for the networks resulting from the internal and external environment (the same thresholds were applied), and relations are the same except the fact that resources in the external environment are encrypted. As can be seen in Fig. 9 all the relations of the resource "11201" are the same3 .

Performance

To demonstrate performance of the approach, we apply it on several benchmarking [START_REF] Van Der Aalst | Benchmarking logs to test scalability of process discovery algorithms[END_REF] and real-life event logs. Table 9 shows specifications of the used event logs. "BPI Challenge 2012" and "BPI Challenge 2017" are used to evaluate the performance when social networks are discovered, and the benchmarking event logs are used to evaluate the performance of the control-flow discovery.

Figure 10 shows how the control-flow discovery scales when using the benchmarking event logs and increasing the number of events exponentially, and Fig. 11 shows the performance of social network discovery when the approach is applied on the two real-life event logs with different scales. All runtimes are in milliseconds and have been tested using an Intel i7 Processor with 1.8GHz and 16 GB RAM.

In Fig. 10, the darker bars show the execution time for discovering the DFG from the original event logs, and the lighter bars show the execution time for discovering the DFG from the secure event logs. One can see a linear increase of the runtime in milliseconds when adding choices or loops. In addition, as can be seen in Fig. 11, when the metric is real-handover, the execution time for discovering social networks is higher, since the real causal dependencies between subsequent resources need to be verified.

Conclusions

This paper presented a novel approach to ensure confidentiality in process mining when the desired results are models. We demonstrated that confidentiality in (a) The real-handover network from the original event log for the real causal dependency threshold 0.5 and the frequency threshold 50.

(b) The real-handover network from the internal event log for the real causal dependency threshold 0.5 and the frequency threshold 50. process mining cannot be achieved by only encrypting an event log. We outlined the little related work, most of which use just encryption, and explained the weaknesses of following this approach. The new approach is introduced since there always exists a trade-off between confidentiality and data utility. Therefore, we reasoned backwards from the desired results and how they can be obtained with as little data as possible.

Here, process models and social networks were considered as the desired results, and the confidentiality solutions presented in the context of a framework that can be extended to include other forms of process mining, i.e., different ICS and ECS could be explored for different process mining activities. Moreover, the proposed framework could be utilized in cross-organizational context such that each environment could cover specific constraints and authorizations of a party. In this paper, we focused on causality based social networks, and in the future other metrics could be explored. Moreover, in the future, a measure for confidentiality could be defined so that the effectiveness of different solutions in this research area could be quantified and compared.

We have utilized a new method named "connector", which can be employed in any situation where we need to store associations securely. For evaluating the proposed approach, we have implemented an interactive environment in Python, and a real-life log was used as the case study.

Fig. 5 :

 5 Fig. 5: The internal confidentiality solution.

  (a) The DFG from the original event log for the frequency threshold 2000. (b) The DFG from the internal event log for the frequency threshold 2000.

Fig. 6 :

 6 Fig. 6: Comparing the DF G from the EL with the DF G from the EL for BPI challenge 2012: both graphs are identical, only layouts are different.

Fig. 7 :

 7 Fig. 7: The DFG from the external event log (BPI challenge 2012) for the frequency threshold 2000.

Fig. 8 :

 8 Fig. 8: Comparing the real-handover networks resulting from BPI challenge 2012: both networks are identical.

  (a) The relations in the real-handover network from the internal event log for the real causal dependency threshold 0.5 and the frequency threshold 50.(b) The relations in the real-handover network from the external event log for the real causal dependency threshold 0.5 and the frequency threshold 50.

Fig. 9 :

 9 Fig. 9: Comparing the relations of resource "11201" in the real-handover networks resulting from EL and EL for BPI challenge 2012

  (a) Execution time for the choice loop events. (b) Execution time for the sequence loop events.

Fig. 10 :

 10 Fig.10:The execution time of the control-flow discovery when using the benchmaking event logs.

  (a) Execution time for the handover networks. (b) Execution time for the real-handover networks.

Fig. 11 :

 11 Fig.11:The execution time of the social network discovery when using the reallife event logs.

Table 1 :

 1 Sample event log (each row represents an event).

	Case ID Timestamp	Activity	Resource	Cost
	1	01-01-2018:08.00 Register (R)	Frank (F) 1000
	2	01-01-2018:10.00 Register (R)	Frank (F) 1000
	3	01-01-2018:12.10 Register (R)	Joey (J)	1000
	3	01-01-2018:13.00 Verify-Documents (V) Monica (M) 50
	1	01-01-2018:13.55 Verify-Documents (V) Paolo (P)	50
	1	01-01-2018:14.57 Check-Vacancies (C) Frank (F) 100
	2	01-01-2018:15.20 Check-Vacancies (C) Paolo (P)	100
	4	01-01-2018:15.22 Register (R)	Joey (J)	1000
	2	01-01-2018:16.00 Verify-Documents (V) Frank (F) 50
	2	01-01-2018:16.10 Decision (D)	Alex (A)	500
	5	01-01-2018:16.30 Register (R)	Joey (J)	1000
	4	01-01-2018:16.55 Check-Vacancies (C) Monica (M) 100
	1	01-01-2018:17.57 Decision (D)	Alex (A)	500
	3	01-01-2018:18.20 Check-Vacancies (C) Joey (J)	50
	3	01-01-2018:19.00 Decision (D)	Alex (A)	500
	4	01-01-2018:19.20 Verify-Documents (V) Joey (J)	50
	5	01-01-2018:20.00 Special-Case (S)	Katy (K)	800
	5	01-01-2018:20.10 Decision (D)	Katy (K)	500
	4	01-01-2018:20.55 Decision (D)	Alex (A)	500

Table 2 :

 2 A totally encrypted event log.

	Case ID Activity Resource Timestamp
	rt!@45 kl56ˆ* lo09(kl 3125
	rt!@45 bn,.ˆq lo09(kl 3256
	)@!1yt kl56ˆ* lo09(kl 4879
	)@!1yt bvS(op /.,ldf	5214
	)@!1yt jhg!676 nb][,b]	6231
	erˆ7*	kl56ˆ* lo09(kl 6534
	erˆ7*	2ws34S v,[]df	7230

Table 3 :

 3 The general assumptions based on the environments

		Internal	External
	Who has access to the data?	Employees Internal Data Analysts	External Data Analysts Anyone else
	Trust to the ones who have data access High	Low
	Background knowledge	Broad	Limited
		Direct individual/organization	Direct/indirect
	What data should be kept secure?	sensitive data which is not	individual/organization
		necessary for the desired result	sensitive data
		-Social network based on	-Social network based on
	Desired results	causality from EL -Process model based on	causality from EL -Process model based on
		DFG from EL	DFG from EL

Table 4 :

 4 The first 10 rows of Table1after encryption and making times relative

	Case ID Timestamp	Activity	Resource	Cost
	1	00-00-0000:08.00 Register (R)	Frank (F) 0820315
	2	00-00-0000:10.00 Register (R)	Frank (F) 0820315
	3	00-00-0000:12.10 Register (R)	Joey (J)	0820315
	3	00-00-0000:13.00 Verify-Documents (V) Monica (M) 0650210
	1	00-00-0000:13.55 Verify-Documents (V) Paolo (P)	0650210
	1	00-00-0000:14.57 Check-Vacancies (C) Frank (F) 0650900
	2	00-00-0000:15.20 Check-Vacancies (C) Paolo (P)	0650900
	4	00-00-0000:15.22 Register (R)	Joey (J)	0820315
	2	00-00-0000:16.00 Verify-Documents (V) Frank (F) 0650210
	2	00-00-0000:16.10 Decision (D)	Alex (A)	0710155

Table 5 :

 5 Adding previous activities/resources and previous IDs.

	Case ID	Timestamp	Activity Prev. Activity Resource Prev. Resource Cost ID Prev. ID
	1	00-00-0000:08.00 R	START	Frank (F) START	0820315 31 00
	2	00-00-0000:10.00 R	START	Frank (F) START	0820315 32 00
	3	00-00-0000:12.10 R	START	Joey (J)	START	0820315 38 00
	3	00-00-0000:13.00 V	R	Monica (M) Joey (J)	0650210 41 38
	1	00-00-0000:13.55 V	R	Paolo (P)	Frank (F)	0650210 55 31
	1	00-00-0000:14.57 C	V	Frank (F) Paolo (P)	0650900 09 55
	2	00-00-0000:15.20 C	R	Paolo (P)	Frank (F)	0650900 86 32
	4	00-00-0000:15.22 R	START	Joey (J)	START	0820315 47 00
	2	00-00-0000:16.00 V	C	Frank (F) Paolo (P)	0650210 75 86
	2	00-00-0000:16.10 D	V	Alex (A)	Frank (F)	0710155 56 75

Table 6 :

 6 The event log after adding the connector column

	Case ID	Timestamp	Activity	Prev. Activity	Resource	Prev. Resource	Cost ID	Prev. ID	Connector
	1	00-00-0000:08.00 R	START Frank (F) START	0820315 31 00	1¡@sadd21?
	2	00-00-0000:10.00 R	START Frank (F) START	0820315 32 00	!s*f*+dsf3
	3	00-00-0000:12.10 R	START Joey (J)	START	0820315 38 00	ça/ds23"w'
	3	00-00-0000:13.00 V	R	Monica (M) Joey (J) 0650210 41 38	.,m;lo,mh
	1	00-00-0000:13.55 V	R	Paolo (P)	Frank (F) 0650210 55 31	;l4;l,'kjh
	1	00-00-0000:14.57 C	V	Frank (F) Paolo (P) 0650900 09 55	*';k!kjm."
	2	00-00-0000:15.20 C	R	Paolo (P)	Frank (F) 0650900 86 32	l:mj/.m @p
	4	00-00-0000:15.22 R	START Joey (J)	START	0820315 47 00	;k;lm.lå@,
	2	00-00-0000:16.00 V	C	Frank (F) Paolo (P) 0650210 75 86	=ó@k;d/f.m
	2	00-00-0000:16.10 D	V	Alex (A)	Frank (F) 0710155 56 75	';,lk.;hj!

Table 7 :

 7 The output event log after applying ICS

	Timestamp Activity	Prev. Activity	Resource	Prev. Resource	Cost	Connector
	08.00	R	START Frank (F) START	0820315 1¡@sadd21?
	01.02	C	V	Frank (F) Paolo (P) 0650900 !s*f*+dsf3
	10.00	R	START Frank (F) START	0820315 ça/ds23"w'
	15.22	R	START Joey (J)	START	0820315 .,m;lo,mh
	00.50	V	R	Monica (M) Joey (J) 0650210 ;l4;l,'kjh
	00.40	V	C	Frank (F) Paolo (P) 0650210 *';k!kjm."
	12.10	R	START Joey (J)	START	0820315 l:mj/.m @p
	05.20	C	R	Paolo (P)	Frank (F) 0650900 ;k;lm.lå@,
	05.55	V	R	Paolo (P)	Frank (F) 0650210 =ó@k;d/f.m
	00.10	D	V	Alex (A)	Frank (F) 0710155 ';,lk.;hj!

Table 8 :

 8 The event log after encrypting activities and resources

	Timestamp Activity	Prev. Activity	Resource	Prev. Resource	Cost Connector
	08.00	AgeIRL 1wBo2I 908G2F 1wBo2I 0820315 1¡@sadd21?
	01.02	5rYd7h v42jbE 908G2F 9iYoqT 0650900 !s*f*+dsf3
	10.00	AgeIRL 1wBo2I 908G2F 1wBo2I 0820315 ça/ds23"w'
	15.22	AgeIRL 1wBo2I RjjZyw 1wBo2I 0820315 .,m;lo,mh
	00.50	v42jbE AgeIRL eBzosT RjjZyw 0650210 ;l4;l,'kjh
	00.40	v42jbE 5rYd7h 908G2F 9iYoqT 0650210 *';k!kjm."
	12.10	AgeIRL 1wBo2I RjjZyw 1wBo2I 0820315 l:mj/.m @p
	05.20	5rYd7h AgeIRL 9iYoqT 908G2F 0650900 ;k;lm.lå@,
	05.55	v42jbE AgeIRL 9iYoqT 908G2F 0650210 =ó@k;d/f.m
	00.10	aUj71B v42jbE WLTZqP 908G2F 0710155 ';,lk.;hj!

Table 9 :

 9 The specifications of the event logs used for evaluation

	Event Log	Cases Events Variants Activities Resources
	Choice Loop 1000	1000	7178	436	81	-
	Choice Loop 10000	10000 70659	3202	81	-
	Choice Loop 100000	100000 706598	21643	81	-
	Sequence Loop 1000	1000	40783	1000	80	-
	Sequence Loop 10000 10000 407791	9985	80	-
	Sequence Loop 100000 100000 4078819 98821	80	-
	BPI Challenge 2012	13087 262200	4366	24	69
	BPI Challenge 2017	31509 561671	4047	26	145

It has 11 relations with the resources "112", "11000", "11189", "10913", "10861", "10909", "11181", "11180", "11119", "11203", and "11201".

Acknowledgment

We thank the Alexander von Humboldt (AvH) Stiftung for supporting our research interactions


Gregory B Lee

Arif Dirlik

published or not. The documents may come   L'archive ouverte pluridisciplinaire

1

[Text in italics was added by hand to these prelimininary prepared remarks just before or during the event.] Our topic today is "How Chinese is it" ? And the idea is to apply this question to the diaspora. It pushes us to think about what Chineseness signifies. This is also a question of representation. How China and Chineseness have been represented both in China and in the West, popularly and scientifically.

As to the importance of the notion of diasporamy understanding of Chinese diaspora is more specific and personal than Arif's -, historical memory and marginalization, I think we can address in depth during the discussion. I should just say that for me, the Chinese diaspora also signifies a reality of lived experience of ordinary people, of men and women, who have settled around the world who have lived through the real problems of immigration, racism, and economic hardship, and whose history has gone largely untold. As for the category "transnational" applied to culture, we need perhaps to interrogate whether national cultures really exist, or whether they are merely ideological constructs.

But let me first make a few brief remarks about the sense, the meaning of

ii)

The second postmodernist tendency operates under the spectre of a traditional imaginary of China.

One could mention the respected (or at least respectable) French postmodern sociologist Maffesoli. For Maffesoli history has stopped and there is no future. We live in an eternal present. 'We' (and we for generalists of whatever discipline is always a eurocentric white we) need to learn form the Orient. For Maffesoli, the Orient is China, China is antiquity, and antiquity is oriental philosophy which in turn is reduced to a simplisticly apprehended Daoist-Buddhist amagalm. We must accept all that comes our way. "Il faut être Zen" (you must be Zen, passive, calm)

as almost everyone in France says nowadays. This representation of China and Chineseness is reactionary on a number of counts. It ignores the whole modern history of China , it ignores the role of colonialism in its construction, and it ignores the present of China. Furthermore it is inspired by a populist and naïve understanding of the history of Chinese thought.

So how should we try to re-think, to re-imagine Chineseness?

Well, for me, 1) history is paramount. Both China (its authorities, its historians, its people) and those who imagine China from afar need to rethink their vision of Chinese history.

2) In spatial and societal terms we must recognize the multiplicities and plurality of Chinese identities.

3) As for authenticity, it is always a myth. Of all the possible causes for the epidemic the one the newspapers preferred was that of contamination by Chinese food sold in Chinese supermarkets and restaurants. The spectre of Fu Manchu and the dubious contents of chop suey contaminating the West just like the Asian economic "contagion" of several years ago.

So much threatening disease invading us from the East.

My conclusion, then, is that those of us responsible for spreading knowledge and information about China and Chineseness still have a great deal of work to do.

The claim was retracted days later but the damage was done.

3

  Gregory B. Lee -Initial Remarks. Discussion with Arif Dirlik. 'How Chinese is it ?' Chinese Diaspora and Transcultural Biographies.' Zwischen Welten Denken, Einstein Forum/The House of World Cultures, Berlin, 5 June 2001 For mainland Chinese authorities the test of Chineseness is loyalty to the regime.For the scientific academic world the test of Chineseness lies somewhere else:A. For the traditional sinologist, authentic Chineseness is to be found in the past, in antiquity, before the adulteration "contamination" by non-Chinese cultures.Chineseness is embedded in elite cultural practiceswriting, philosophy, printing, and sometimes the valorisation and nationalization of folk culture (which by definition is always local). For the traditional sinologist, modern Chinese practices are not properly Chinese whether they be elite or popular. They are tainted by hybridity, by métissage, they are unauthentic. This is a typical Orientalist discourse B. Lee -Initial Remarks. Discussion with Arif Dirlik. 'How Chinese is it ?' Chinese Diaspora and Transcultural Biographies.' Zwischen Welten Denken, Einstein Forum/The House of World Cultures, Berlin, 5 June 2001

	Gregory B. Lee -Initial Remarks. Discussion with Arif Dirlik. 'How Chinese is it ?' Chinese Diaspora and Transcultural Biographies.' Zwischen Welten Denken, Einstein Forum/The House of World Cultures, Berlin, 5	2
	June 2001
			Mainland China, Taiwan, Hong Kong, Singapore, the
			Diaspora, the new Diaspora (Hong Kong, Canada)
	WHAT LANGUAGE ?	Chinese, what dialect ?
			Chinese American, British Chinese
			English-speaking Chineseness ?
			German speaking Chineseness ?
	HOW MUCH? Chineseness AUTHENTICITY, TRADITION
	LIKE WHAT ?	Formerly Taiwan claimed to represent and protect China's
	divisions.
	"Chineseness".
	According to the official discourse Chineseness arises from
	i)	There are the transnational scholars informed about China, or of Chinese
	WHEN ?		HISTORY 19thC -pre-modern, ancient
	1) living within the confines of the borders of China from Tibet to Hong Kong origin, who live often in the USA for whom hybridity at the level of culture
			20thC
	regardless of is to be celebrated as liberatory. The post-colonial moment for the post-
			The sense Chineseness necessarilyis embedded in
	ethnic origins. modernist is emancipatory because we can forget history. Whatever we
			specific moments. There is no timeless, immobile China.
	WHERE ?		(Spatial question)

cultural tradition. Now that "People's" China has abandoned Utopian politics and the Universalism inspired by Marxism that associated Chineseness with "New China", the mainland Chinese authorities claim they are the spiritual and real inheritors of mythical emperors and the unifying vision of the Qin emperor (220 BC).

2) having Chinese bloodbeing of Han Chinese ancestry wherever you live in the world.

Is there an "authentic", "genuine" culture? Is there only one? Is the tradition"natural" or invented?

(Said). B. For the social scientist Chineseness is self-evident, a function of contemporary geopolitics. C. At the other extreme is the postmodern academic for whom we are in a stage of post-history and even post-culture. But even this ideological position knows say about colonialism in China it's only a story, among others.

Gregory

5

  Traditions are always invented and reinvented. There is no pure culture. Gregory B. Lee -Initial Remarks. Discussion with Arif Dirlik. 'How Chinese is it ?' Chinese Diaspora and Transcultural Biographies.' Zwischen Welten Denken, Einstein Forum/The House of World Cultures, Berlin, 5 June 2001Without being an advocate for postmodern hybridity, the reality of lived, experienced cultural metissage must be admitted and respected in China, in Hong Kong, in Taiwan, in Canada, and elsewhere in the diaspora. In the diaspora, this is not as it is in China a question of whether we find it offensive that Peking boasts a hundred McDonalds and that the American Starbucks café chain has set up within the walls of the formerly Forbidden City. No, in the diaspora, it becomes a question of everyday survival. For the third generation Chinese fish and chip shop worker, the German Chinese restaurant waiter, the crucial questions are of petty racism and economic survival.

In conclusion, what needs to be seriously addressed is: our lack of historical knowledge and worse, the constant repetition of historically ingrained racist representations of China and Chineseness. This is not mere academic discourse.The recent 'foot and mouth' epidemic in Britain illustrated once more how stereotypes of Chineseness at best only ever lay dormant.