# US 2020/0396231 A1 · Methods and systems for inferring behavior and vulnerabilities from process models > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0396231 A1 - Document ID: US20200396231A1 - Status: Published application - Kind: A1 - Application number: 16/440,639 - Filed: 2019-06-13 - Published: 2020-12-17 - Earliest claimed: 2019-06-13 - Assignees: More Cowbell Unlimited, Inc - Applicants: More Cowbell Unlimited, Inc - Inventors: Werner G. Krebs; John W. Bicknell - Web page: https://patentgrep.com/patent/US20200396231A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} - G06N 5/04: Inference or reasoning models - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Systems and methods for process models to determine systems behavior and vulnerabilities are provided. In one embodiment, a method comprises collecting event logs from monitoring systems communicatively coupled to a computing device, each event log indicating an event occurring at a given time at a given activity within a process, measuring transition times between activities of the process from the event logs, calculating, from the measured transition times, a capacity of an activity of the activities, inferring behavior and vulnerabilities of the process based on one or more of the measured transition times and the capacity, and generating natural language output indicating the inferred behavior and vulnerabilities of the process. Further, simulations of the process are performed with statistical data regarding the event logs as input. In this way, aspects of a process such as an operational process in need of attention or vulnerable to external attacks may be rapidly identified and actions for resolution may be automatically recommended. ## Claims ### Claim 1 A method, comprising: collecting event logs from monitoring systems communicatively coupled to a computing device, each event log indicating an event occurring at a given time at a given activity within a process; measuring transition times between activities of the process from the event logs; calculating, from the measured transition times, a capacity of an activity of the activities; inferring behavior and vulnerabilities of the process based on one or more of the measured transition times and the capacity; and generating natural language output indicating the inferred behavior and vulnerabilities of the process. ### Claim 2 (depends on 1) The method of claim 1, further comprising performing a simulation of the process, and further inferring the behavior and vulnerabilities of the process based on simulation results of the simulation. ### Claim 3 (depends on 2) The method of claim 2, further comprising performing the simulation of the process with adjustments to one or more of a number of workers for the activity and an arrival rate for the activity, comparing a simulated capacity of the activity to the calculated capacity of the activity, and inferring the behavior and vulnerabilities of the process based on the comparison of the simulated capacity to the calculated capacity. ### Claim 4 (depends on 2) The method of claim 2, further comprising calculating statistical distributions of the activities of the process from the event logs, and performing the simulation of the process with one or more of the calculated capacity and the statistical distributions as inputs to the simulation. ### Claim 5 (depends on 1) The method of claim 1, further comprising measuring process activity timestamp trends from the event logs, wherein inferring the behavior and vulnerabilities of the process comprises inferring operational cadence of the process based on the process activity timestamp trends. ### Claim 6 (depends on 5) The method of claim 5, further comprising automatically identifying statistically anomalous deviations for the process activity timestamp trends, and inferring the vulnerabilities based on the statistical deviations. ### Claim 7 (depends on 1) The method of claim 1, further comprising measuring process activity statistical distributions, and further inferring the behavior and vulnerabilities of the process based on the process activity statistical distributions. ### Claim 8 (depends on 7) The method of claim 7, further comprising identifying an activity of the process with a constant or uniformly distributed time duration, wherein inferring the behavior and vulnerabilities of the process comprises inferring the activity is a fully automated activity, and wherein generating the natural language output indicating the inferred behavior and vulnerabilities of the process includes generating natural language statements indicating the activity is a fully automated activity and is vulnerable to information warfare attacks. ### Claim 9 (depends on 1) The method of claim 1, further comprising measuring a total elapsed time for event observations, a total number of sojourns between activities, and a total number of sojourns overall from the event logs, wherein the transition times comprise an average transition time, and wherein the capacity is further calculated based on the total elapsed time, the total number of sojourns between activities, and the total number of sojourns overall. ### Claim 10 (depends on 9) The method of claim 9, wherein calculating the capacity of the activity comprises estimating the capacity from an average arrival rate determined from the total elapsed time, the total number of sojourns between activities, and the total number of sojourns overall, multiplied by an average service time determined from the average arrival rate and the average transition time. ### Claim 11 A system, comprising: a plurality of monitoring systems generating event logs, each event log indicating an event occurring at a given time at a given activity within a process; and a computing device communicatively coupled to the plurality of monitoring systems, the computing device comprising a processor and a non-transitory memory storing instructions that when executed cause the processor to: load the event logs received from the plurality of monitoring systems; measure transition times between activities of the process from the event logs; calculate a capacity of an activity of the process from the measured transition times; infer behavior and vulnerabilities of the process based on one or more of the measured transition times and the capacity; and generate natural language output indicating the inferred behavior and vulnerabilities of the process. ### Claim 12 (depends on 11) The system of claim 11, wherein the instructions when executed further cause the processor to perform a simulation of the process, and further infer the behavior and vulnerabilities of the process based on simulation results of the simulation. ### Claim 13 (depends on 12) The system of claim 12, wherein the instructions when executed further cause the processor to perform the simulation of the process with adjustments to one or more of a number of workers for the activity and an arrival rate for the activity, compare a simulated capacity of the activity to the calculated capacity of the activity, and infer the behavior and vulnerabilities of the process based on the comparison of the simulated capacity to the calculated capacity. ### Claim 14 (depends on 11) The system of claim 11, wherein the instructions when executed further cause the processor to measure process activity timestamp trends from the event logs, and infer operational cadence of the process based on the process activity timestamp trends. ### Claim 15 (depends on 11) The system of claim 11, wherein the instructions when executed further cause the processor to measure process activity statistical distributions, and further infer the behavior and vulnerabilities of the process based on the process activity statistical distributions. ### Claim 16 (depends on 15) The system of claim 15, wherein the instructions when executed further cause the processor to identify an activity of the process with a constant or uniformly distributed time duration, wherein inferring the behavior and vulnerabilities of the process comprises inferring the activity is a fully automated activity, and wherein generating the natural language output indicating the inferred behavior and vulnerabilities of the process includes generating natural language statements indicating the activity is a fully automated activity and is vulnerable to generative adversarial network attacks and tainted training data. ### Claim 17 A computer-readable storage medium including an executable program stored thereon, the program configured to cause a processor to: load event logs received from monitoring systems communicatively coupled to the processor, each event log indicating an event occurring at a given time at a given activity within a process; measure transition times between activities of the process from the event logs; calculate, from the measured transition times, a capacity of an activity of the activities; simulate, based on one or more of the measured transition times and the capacity, the process with adjustments to one or more parameters of the process; infer behavior and vulnerabilities of the process based on one or more of the measured transition times, the capacity and simulation results of the simulation; and generate natural language output indicating the inferred behavior and vulnerabilities of the process. ### Claim 18 (depends on 17) The computer-readable storage medium of claim 17, wherein the adjustments to the one or more parameters of the process comprises adjustments to one or more of a number of workers for the activity and an arrival rate for the activity, wherein the program is further configured to cause the processor to compare a simulated capacity of the activity to the calculated capacity of the activity, and infer the behavior and vulnerabilities of the process based on the comparison of the simulated capacity to the calculated capacity. ### Claim 19 (depends on 18) The computer-readable storage medium of claim 18, wherein the program is further configured to cause the processor to measure process activity statistical distributions, and further infer the behavior and vulnerabilities of the process based on the process activity statistical distributions. ### Claim 20 (depends on 17) The computer-readable storage medium of claim 17, wherein the program is further configured to cause the processor to generate natural language output characterizing a response of the process to the adjustments.