Process mining is a set of techniques to analyze business processes based on event logs extracted from information systems. Existing process mining techniques are designed for intra-organizational settings, as they assume that the entire event log of a process is available for analysis at once. In an intra-organizational process, each party only has access to its own private event log, which gives only a partial picture of the whole process. Moreover, the involved parties may be unwilling or unable to share their private logs due to con dentiality or privacy imperatives. In this context, this paper presents a tool, namely Shareprom, that enables independent parties to execute process mining operations without revealing any data other than the output of the analysis. Speci cally, Shareprom uses secure multi-party computation techniques to compute the frequency or time-annotated Directly-Follows Graph (DFG) of event logs held by multiple parties, without these parties having to share any information other than the resulting DFG. The tool applies a di erentially private release mechanism before revealing the output DFG in order to provide an additional layer of privacy protection.
Process mining techniques enable organizations to analyze business processes from event logs extracted from information systems. These techniques allow us, for example, to identify performance bottlenecks and to recommend changes to a process in order to increase its e ciency. Existing process mining techniques assume that the event log to be analyzed can be accessed in its entirety. This assumption is reasonable in an intra-organizational setting, where all the data about a given process is located within the same trust domain. However, in an inter-organizational process, the event log is distributed across multiple independent organizations. For example, in a supply chain process, a manufacturer interacts with multiple suppliers. Each of them holds its own private event log, which only provides a partial view of the whole process.
Due to con dentiality concerns and privacy regulations, such as GDPR4 and HIPAA5, the involved organizations are unwilling to, or sometimes legally prevented from, sharing their event logs. They are prevented from sharing the logs either with each other or with a third-party, such as an independent analysis rm, to jointly perform the analysis.
In this paper, we present Shareprom, a secure multi-party computation system for inter-organizational process mining. Shareprom allows independent cooperating organizations to control what is disclosed from their event logs. We assume that the parties have agreed to reveal the time-annotated process map. In other words, the analysis rm will not learn anything about the independent organizations other than this output. Shareprom applies di erential privacy to the resulting DFG so as to provide an extra layer of privacy, as presented in Section 2. The analysis rm will neither have access to speci c traces, nor to any information associated to these traces. And naturally, the data providers will not be able to learn anything about each other's private data. 2
Shareprom uses secure multi-party computation (MPC) to process event logs and
to build the DFG matrix. Before revealing the DFG matrix, Shareprom applies
Laplacian di erential privacy by the injection of noise into the matrix. Shareprom
relies on a platform for secret-sharing based MPC (speci cally Sharemind [
Shareprom uses the three-party MPC protocol set of Sharemind, which is
secure against honest-but-curious adversaries. This means that as long as the
parties are following the protocols honestly and do not collude, none of them will
learn more than the size of the data. Parties in a typical secure MPC deployment
can be: input parties, computation parties, or output parties [
We assume that input parties share with each other the number of activities
and the maximum trace length in their event logs. Also, we assume that the
case identi ers are the same across the input parties. This is needed to conduct
preprocessing that reduces the amount of information that might be learned from
the size of data. Even with encrypted data, contextual knowledge might lead to
leakage of some information [
Figure 1 gives an overview of the system components. Below we summarize
the functionality of each component of Shareprom. More information about the
system components can be found in [
Preprocessing. Each party of the cooperating organization uses Shareprom clients to import the XES le of their event log. Shareprom then performs preprocessing of the event log at its organization site. The parties exchange the maximum trace length and the number of unique activities of their entire log. All the traces need to be padded to have the same length as the longest trace. The activities are mapped to a one-hot encoding format, independently on each input party. Also, a sort step of the logs by traces is performed. The two latter steps are needed as a preparation for the subsequent secure MPC protocol, which requires the data to be available in a speci c format.
Mapping Event Log to Secret-shares. Each party uses their Shareprom client to
map their event logs into secret-shares. Each client pushes its secret-shares to the
Sharemind servers. Secret-shares do not reveal any information about the event
log. Until this point, the analysis rm, as one of the computation parties, has
only received a single share of each input, which alone looks like a random value.
DFG Matrix Calculation. Shareprom runs the Sharemind MPC protocol to
construct the DFG matrix from uploaded secret-shared data. An algorithm based
on a one-hot encoding technique allows us to ensure that the computation does
not reveal any information to the parties, including the access pattern (e.g. which
log entries follow each other). The details of this algorithm can be found in [
Shareprom is developed in Python 3.7 and SecreC { a dialect of the C language
supported by the Sharemind plartform [
Party
A Party B
Import XES Import XES
Preprocessing
Preprocessing Cooperating Parties
Mapping Event Log to Secret
Shares Mapping Event Log to Secret
Shares
Combine Secure Processing Using Secret Shares
Parallel Sort DFG Matrix Calculation Differential Privacy
Analyzing the model a desktop client application. The desktop client allows a user to import an event log (in XES format) as shown in Figure 2a. The desktop client connects with its respective Shareprom server. In a typical con guration, three Sharemind servers are inter-connected, e.g. two input providers and a computation node { the latter representing for example an analysis rm, as shown in Figure 2b. The analysis rm can view the output (with di erential privacy noise) as shown in Figure 2c. An analyst at this rm can then analyze the output and share the ndings (or the whole output) with the input providers depending on the intended use case.
Shareprom has been tested with event logs of di erent characteristics, as
reported in [
A screencast is available at https://youtu.be/uz2mrYz-y-w . This screencast illustrates a scenario where two parties (a manufacturer and a supplier) delegate an analysis task to a data analysis rm. The manufacturer produces goods based on purchase orders. Parts of the production pipeline need intermediate parts from the supplier. The manufacturer orders the intermediate parts from the supplier. The supplier produces the intermediate parts and transports them to the manufacturer. Each party has its own separate event log. The analysis rm analyzes the joint DFG constructed from the event logs.
The source code, installation steps, dependencies, and example event logs can be found at https://github.com/Elkoumy/shareprom/releases/tag/v0.2. 5
Shareprom leverages the secure multi-party computation capabilities of Sharemind in order to enable multiple parties to perform inter-organizational process mining without revealing any data other than the analysis output. A di erential privacy (c) The Joint DFG After
Di erential Privacy mechanism allows this output to be further protected against possible privacy leakages. At present, Shareprom focuses on the computation of DFGs, which is a basic graphical process representation used in process mining tools. Future work aims at expanding the capabilities of Shareprom to other process mining operations, while at the same time tackling associated scalability challenges. Acknowledgments. This research is partly funded by ERDF via the Estonian Centre of Excellence in ICT (EXCITE).