Run-time Anomaly Detection with Process Mining: Methodology and Railway System Compliance Case-Study

Detecting anomalies in computer-based systems, including Cyber-Physical Systems (CPS), has attracted a large interest recently. Behavioral anomalies represent deviations from what is regarded as the nominal expected behavior of the system. Both Process science and Data science can yield satisfactory results in detecting behavioral anomalies. Within Process Mining, Conformance Checking addresses data retrieval and the connection of data to behavioral models with the aim to detect behavioral anomalies. Nowadays, computer-based systems are increasingly complex and require appropriate validation, monitoring, and maintenance techniques. Within complex computer-based systems, the European Rail Traffic Management System/European Train Control System (ERTMS/ETCS) represents the specification of a standard Railway System integrating heterogeneous hardware and software components, with the aim of providing international interoperability with trains seemingly interacting within standardized infrastructures. Compliance with the standard as well as expected behavior is essential, considering the criticality of the system in terms of performance, availability, and safety. To that aim, a Process Mining Conformance Checking process can be employed to validate the requirements through run-time model-checking techniques against design-time process models. A Process Mining Conformance Checking methodology has been developed and applied with the goal of validating the behavior exposed by an ERTMS/ETCS system during the execution of specific scenarios. The methodology has been tested and demonstrated correct classification of valid behaviors exposed by the ERTMS/ETCS system prototype. Results also showed that the Fitness metric developed in the methodology allows the detection of latent errors in the system before they can generate any failures