Methods and systems for inferring behavior and vulnerabilities from process models

A system, comprising:

• a plurality of monitoring systems generating event logs, each event log indicating an event occurring at a given time at a given activity within a process;
• and
• a computing device communicatively coupled to the plurality of monitoring systems, the computing device comprising a processor and a non-transitory memory storing instructions that when executed cause the processor to:
• load the event logs received from the plurality of monitoring systems;
• measure transition times between activities of the process from the event logs;
• calculate a capacity of an activity of the process from the measured transition times;
• infer behavior and vulnerabilities of the process based on one or more of the measured transition times and the capacity;
• and
• generate natural language output indicating the inferred behavior and vulnerabilities of the process.

A computer-readable storage medium including an executable program stored thereon, the program configured to cause a processor to:

• load event logs received from monitoring systems communicatively coupled to the processor, each event log indicating an event occurring at a given time at a given activity within a process;
• measure transition times between activities of the process from the event logs;
• calculate, from the measured transition times, a capacity of an activity of the activities;
• simulate, based on one or more of the measured transition times and the capacity, the process with adjustments to one or more parameters of the process;
• infer behavior and vulnerabilities of the process based on one or more of the measured transition times, the capacity and simulation results of the simulation;
• and
• generate natural language output indicating the inferred behavior and vulnerabilities of the process.