• 沒有找到結果。

Detection inside a TS workflow

Chapter 4 Anomaly Detection in a TS Workflow

4.2 Incremental anomaly detection

4.2.1 Detection inside a TS workflow

Our incremental analysis works based on divide and conquer mechanism; it contains three steps, step by step:

1. analyzing the block containing edited process.

2. analyzing the rest of workflow.

3. Computing the anomalies according to the results of 1 and 2.

To simplify the analysis work and discussion, we define five attributes to be

associated with each process p in a workflow w, besides level, working duration, and EAI which are described in Chapters 2 and 3. The definitions of these attributes are defined below:

1. There are five process types: asp, ajp, xsp, xjp and ap; asp/ajp and xsp/xjp indicate split/joint process of AND and XOR respectively, and ap indicates activity process.

2. AOSetp = {(a, o) | a is an artifact in w, operation o works on a in p, and o {Def, Kill, Use}}.

3. ImmeSucprepresents the set of process(es) of which each has an operation on a, and there is an empty path on a from p to the process. Moreover we define ImmeSucp(Def) = {q | q ImmeSucp , the operation of a in q is Def}, ImmeSucp(Kill) = {q | q ImmeSucp , the operation of a in q is Kill}, ImmeSucp(Use) = {q | q ImmeSucp , the operation of a in q is Use}.

4. ImmePrep represents the set of process(es) of which each has an operation on a, and there is an empty path on a from the process to p. we define the following sets: ImmePrep (Def) = {q | q ImmeSucp, the operation of a in q is Def}, ImmePrep(Kill) = {q | q ImmeSucp , the operation of a in q is Kill}, and ImmePrep(Use) = {q |q ImmeSucp , the operation of a in q is Use}.

An incremental analysis in general is to analyze abnormal operation behavior due to an operation in a workflow editor [12]. Because such an analysis has been shown to be an NP problem when a workflow contains a loop(s), we define a new incremental approach to simplify the work. In our work, when a TS workflow is modified (addition/deletion/modification a process) by user, our approach has a

corresponding modification in its CTS workflow to reduce the analysis work and thus waiting time for designer.

To simplify the discussion, the incremental analysis algorithms presented are based on each of the following four types of edit activities:

1. Insertion/deletion of a workflow template indicates to insert/delete a Loop/AND/XOR structure or an activity process.

2. Insertion/deletion of an operation on some artifact.

3. modification of (min, max) turns of a loop.

4. modification of (mix, max) time interval of a process.

Because each loop in a TS workflow has a corresponding complicated acyclic structure in its CTS workflow, when an insertion/deletion/modification of a loop in a TS workflow occurs, the target CTS workflow has to be modified first in order to follow the reduction principle in Section 2.4 correspondingly. Insertion/deletion of an operation on an artifact a is to add/delete an operation on a in an activity process p. To simplify the analysis, it is assumed that an artifact has at most one operation in an activity process. After an operation on a is inserted/delete in p, there is one operation/no operation for a in p and corresponding process(es) in the CTS workflow.

The modification of (min, max) turns for a loop is to increase/decrease the minimum/maximum turns of a loop. As mentioned before, a loop can be transformed into an acyclic structure when a designer adds the loop into a TS workflow (Section 2.4). It has to modify the corresponding CTS workflow for a modification of (min, max) turns of a loop. The modifications of a loop is done by increasing/deleting for one of both of (min, max), and one increases and the other decreases. The modification of a CTS workflow can be discussed according to the followings:

1. The resulting value of subtracting min from max is larger. This case occurs

due to:

a. max is of no change or incremented, but min is incremented lower, of no change, or decremented.

b. max is decremented, but min is decremented larger.

2. The resulting value become smaller. This occurs due to:

a. max is of no change or incremented, but min is incremented larger.

b. max is decremented, but min is incremented, of no change, or decremented lower.

Modification of (min, max) time for a process is to change minimum/maximum working duration of an activity process. If a designer modifies the working duration of an activity process in a loop, it has to adjust the timing of the corresponding acyclic which contain this data in the CTS workflow.

It might update ImmeSucap and ImmePreap of a process p when an edit activity to artifact a occur somewhere else. In our approach, the analysis is focused on a workflow block, containing the process p being edited, and starts by computing ImmeSucap and ImmePreap according to the level of the block. Algorithm 4.2 computes ImmeSucap and Algorithm 4.3 computes ImmePreap. Because we analyze a workflow at a predefined level, obviously, some information need be modified due to an edit activity. The information modification related to the blank branches between p and p’ is done with Algorithm 4.4. which outputs a set of artifacts containing at least one operation in each branch between two input processes p and p’.

Both Algorithm 4.2 and Algorithm 4.3 work with input (w, a, p, p’), where w is a workflow, a is an artifact, and p and p’ are processes. Algorithm 4.2 starts the computation from p, decides whether to make a recursive based on p’, and terminates with output ImmeSucap. Input p’ in Algorithm 4.3 is a split process and the output is

ImmePreap.

Algorithm 4.2 ComputeImmediateSuccessor

Input: an acyclic TS workflow w, an artifact a, a process p, a joint process p’

Output: ImmeSucap

29. } beginning, a set S initialized as empty at line 1 and its value is used to be returned at line 30. If p is a split process, the related computations are done in Lines 3-21 where Line 3 assigns the corresponding joint of p to p’’, Lines 5-9 works for AND split, Lines 13-17works for XOR split, and Lines 20-21 make a recursive call to get the artifacts from current joint p” to p’ if p’’ is not p’.

For an AND split process, Line 5 makes a recursive call for each P’s successor.

IfContinue is made true in case no branch contains operation on a as in Line 8. Lines 13-17 are in charge of the work for XOR split, where the recursion works for each of p’s branches, IfContinue is true if there is a branch containing no work on a, and S is the union of these returned value. Lines 24-27 works if p is an activity process.

Finally, line 30 returns result. For instance, Algorithm 4.2 (w, a, as2, aj2) being called in Figure 4.1 would output {P2, P3}.

In Algorithm 4.2, each process is touched at most once, thus the time complexity is O(n), n is the number of the processes in the workflow.

Algorithm 4.3 accepts (w, a, p, p’) input in the very beginning, where w is a workflow, a is an artifact, p is an input process for starting the execution and p’ is the split process used to decide the termination of the algorithm, and outputs ImmePreap. The algorithm works inside a workflow block of some level, or whose split process is p’. The joint process is assigned as p and algorithm 4.3 is called recursively based on

workflow w, input artifact a, p and p’.

Algorithm 4.3 ComputeImmediatePredecessor

Input: an acyclic TS workflow w, an artifact a, a process p, a split process p’

Output: ImmePreap

29. }

30. return S;

End

Algorithm 4.3 has a similar but reverse control structure, compared with Algorithm 4.2. Both algorithms analyze the flow structure, however, Algorithm 4.3 replaces predecessor/successor with successor/predecessor in Algorithm 4.2. In other words, Algorithm 4.3 uses backward analysis, and does not analyze split process but returns empty set directly. Furthermore, the complexity of Algorithm 4.3 is O(n) too.

For example, Algorithm 4.3 (w, a, as2, aj2) being called in Figure 4.1 would output {P2, P3}.

相關文件