{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T18:04:23Z","timestamp":1775066663057,"version":"3.50.1"},"reference-count":33,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2023,7,6]],"date-time":"2023-07-06T00:00:00Z","timestamp":1688601600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2023,7,6]],"date-time":"2023-07-06T00:00:00Z","timestamp":1688601600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Cloud Comp"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Cloud computing has gained popularity in recent years, but with its rise comes concerns about data security. Unauthorized access and attacks on cloud-based data, applications, and infrastructure are major challenges that must be addressed. While machine learning algorithms have improved intrusion detection systems in cloud data security, they often fail to consider the entire life cycle of file processing, making it difficult to detect certain issues, especially insider attacks. To address these limitations, this paper proposes a novel approach to analyzing data file processing in multi-cloud environments using process mining. By generating a complete file processing event log from a multi-cloud environment, the proposed approach enables detection from both control flow and performance perspectives, providing a deeper understanding of the underlying file processing in its full life cycle. Through our case study, we demonstrate the power and capabilities of process mining for file security detection and showcase its ability to provide further insights into file security in multi-cloud environments.<\/jats:p>","DOI":"10.1186\/s13677-023-00474-y","type":"journal-article","created":{"date-parts":[[2023,7,6]],"date-time":"2023-07-06T13:02:19Z","timestamp":1688648539000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":19,"title":["File processing security detection in multi-cloud environments: a process mining approach"],"prefix":"10.1186","volume":"12","author":[{"given":"Xiaolu","family":"Zhang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lei","family":"Cui","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wuqiang","family":"Shen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jijun","family":"Zeng","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Li","family":"Du","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haoyang","family":"He","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Long","family":"Cheng","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2023,7,6]]},"reference":[{"issue":"4","key":"474_CR1","doi-asserted-by":"publisher","first-page":"1436","DOI":"10.1109\/TNET.2020.3027814","volume":"29","author":"J Liu","year":"2020","unstructured":"Liu J, Shen H, Chi H, Narman HS, Yang Y, Cheng L, Chung W (2020) A low-cost multi-failure resilient replication scheme for high-data availability in cloud storage. IEEE\/ACM Trans Netw 29(4):1436\u20131451","journal-title":"IEEE\/ACM Trans Netw"},{"issue":"2","key":"474_CR2","first-page":"100134","volume":"2","author":"S Lata","year":"2022","unstructured":"Lata S, Singh D (2022) Intrusion detection system in cloud environment: Literature survey & future research directions. Int J Inf Manag Data Insights 2(2):100134","journal-title":"Int J Inf Manag Data Insights"},{"issue":"3","key":"474_CR3","doi-asserted-by":"publisher","first-page":"1634","DOI":"10.1109\/TCC.2020.3001017","volume":"10","author":"W Wang","year":"2020","unstructured":"Wang W, Du X, Shan D, Qin R, Wang N (2020) Cloud intrusion detection method based on stacked contractive auto-encoder and support vector machine. IEEE Trans Cloud Comput 10(3):1634\u20131646","journal-title":"IEEE Trans Cloud Comput"},{"key":"474_CR4","doi-asserted-by":"publisher","first-page":"76614","DOI":"10.1109\/ACCESS.2021.3082160","volume":"9","author":"D Park","year":"2021","unstructured":"Park D, Kim S, Kwon H, Shin D, Shin D (2021) Host-based intrusion detection model using siamese network. IEEE Access 9:76614\u201376623","journal-title":"IEEE Access"},{"key":"474_CR5","doi-asserted-by":"crossref","unstructured":"Li J, Tong X, Liu J, Cheng L (2023) An efficient federated learning system for network intrusion detection. IEEE Syst J. 17(2):2455-64","DOI":"10.1109\/JSYST.2023.3236995"},{"issue":"2","key":"474_CR6","doi-asserted-by":"publisher","first-page":"368","DOI":"10.1109\/TSC.2019.2906203","volume":"13","author":"L Cheng","year":"2020","unstructured":"Cheng L, van Dongen BF, van der Aalst WM (2020) Scalable discovery of hybrid process models in a cloud computing environment. IEEE Trans Serv Comput 13(2):368\u2013380","journal-title":"IEEE Trans Serv Comput"},{"issue":"3","key":"474_CR7","doi-asserted-by":"publisher","first-page":"1037","DOI":"10.1109\/TASE.2020.2993376","volume":"18","author":"C Liu","year":"2020","unstructured":"Liu C, Zeng Q, Cheng L, Duan H, Zhou M, Cheng J (2020) Privacy-preserving behavioral correctness verification of cross-organizational workflow with task synchronization patterns. IEEE Trans Autom Sci Eng 18(3):1037\u20131048","journal-title":"IEEE Trans Autom Sci Eng"},{"key":"474_CR8","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1016\/j.entcs.2004.10.013","volume":"121","author":"WM Van der Aalst","year":"2005","unstructured":"Van der Aalst WM, de Medeiros AKA (2005) Process mining and security: Detecting anomalous process executions and checking process conformance. Electron Notes Theor Comput Sci 121:3\u201321","journal-title":"Electron Notes Theor Comput Sci"},{"issue":"2","key":"474_CR9","doi-asserted-by":"publisher","first-page":"558","DOI":"10.1109\/TCC.2015.2487965","volume":"6","author":"L Cheng","year":"2018","unstructured":"Cheng L, Kotoulas S (2018) Efficient skew handling for outer joins in a cloud computing environment. IEEE Trans Cloud Comput 6(2):558\u2013571","journal-title":"IEEE Trans Cloud Comput"},{"issue":"21","key":"474_CR10","doi-asserted-by":"publisher","first-page":"18579","DOI":"10.1007\/s00521-022-07477-x","volume":"34","author":"L Cheng","year":"2022","unstructured":"Cheng L, Kalapgar A, Jain A, Wang Y, Qin Y, Li Y, Liu C (2022) Cost-aware real-time job scheduling for hybrid cloud using deep reinforcement learning. Neural Comput Appl 34(21):18579\u201318593","journal-title":"Neural Comput Appl"},{"issue":"1","key":"474_CR11","doi-asserted-by":"publisher","first-page":"40","DOI":"10.1109\/TST.2013.6449406","volume":"18","author":"Z Chen","year":"2013","unstructured":"Chen Z, Han F, Cao J, Jiang X, Chen S (2013) Cloud computing-based forensic analysis for collaborative network security management system. Tsinghua Sci Technol 18(1):40\u201350","journal-title":"Tsinghua Sci Technol"},{"issue":"1","key":"474_CR12","doi-asserted-by":"publisher","first-page":"82","DOI":"10.1109\/TST.2014.6733211","volume":"19","author":"Z Chen","year":"2014","unstructured":"Chen Z, Dong W, Li H, Zhang P, Chen X, Cao J (2014) Collaborative network security in multi-tenant data center for cloud computing. Tsinghua Sci Technol 19(1):82\u201394","journal-title":"Tsinghua Sci Technol"},{"issue":"3","key":"474_CR13","doi-asserted-by":"publisher","first-page":"e4364","DOI":"10.1002\/cpe.4364","volume":"31","author":"S Namasudra","year":"2019","unstructured":"Namasudra S (2019) An improved attribute-based encryption technique towards the data security in cloud computing. Concurr Comput Pract Exp 31(3):e4364","journal-title":"Concurr Comput Pract Exp"},{"issue":"4","key":"474_CR14","doi-asserted-by":"publisher","first-page":"2886","DOI":"10.1109\/JIOT.2020.3020979","volume":"8","author":"S Qi","year":"2020","unstructured":"Qi S, Lu Y, Wei W, Chen X (2020) Efficient data access control with fine-grained data protection in cloud-assisted iiot. IEEE Internet Things J 8(4):2886\u20132899","journal-title":"IEEE Internet Things J"},{"key":"474_CR15","doi-asserted-by":"crossref","unstructured":"Nagar U, Nanda P, He X, Tan Z (2017) A framework for data security in cloud using collaborative intrusion detection scheme. In: Proceedings of the 10th International Conference on Security of Information and Networks.\u00a0ACM, pp 188\u2013193","DOI":"10.1145\/3136825.3136905"},{"key":"474_CR16","doi-asserted-by":"crossref","unstructured":"Snehi J, Snehi M, Bhandari A, Baggan V, Ahuja R (2021) Introspecting intrusion detection systems in dealing with security concerns in cloud environment. In: 2021 10th International Conference on System Modeling & Advancement in Research Trends (SMART). IEEE, pp 345\u2013349","DOI":"10.1109\/SMART52563.2021.9676258"},{"key":"474_CR17","doi-asserted-by":"publisher","first-page":"291","DOI":"10.1016\/j.cose.2019.06.013","volume":"86","author":"Z Chiba","year":"2019","unstructured":"Chiba Z, Abghour N, Moussaid K, Rida M et al (2019) Intelligent approach to build a deep neural network based ids for cloud environment using combination of machine learning algorithms. Comput Secur 86:291\u2013317","journal-title":"Comput Secur"},{"issue":"6","key":"474_CR18","doi-asserted-by":"publisher","first-page":"1229","DOI":"10.1109\/JSAC.2020.2986619","volume":"38","author":"M Shen","year":"2020","unstructured":"Shen M, Duan J, Zhu L, Zhang J, Du X, Guizani M (2020) Blockchain-based incentives for secure and collaborative data sharing in multiple clouds. IEEE J Sel Areas Commun 38(6):1229\u20131241","journal-title":"IEEE J Sel Areas Commun"},{"key":"474_CR19","doi-asserted-by":"crossref","unstructured":"Liu C, Cheng L, Zeng Q, Wen L (2022) Formal modeling and discovery of hierarchical business processes: A petri net-based approach. IEEE Trans Syst Man Cybern Syst 53(2):1003\u201314","DOI":"10.1109\/TSMC.2022.3195869"},{"key":"474_CR20","doi-asserted-by":"crossref","unstructured":"Liu C, Li H, Zhang S, Cheng L, Zeng Q (2022) Cross-department collaborative healthcare process model discovery from event logs. IEEE Trans Autom Sci Eng","DOI":"10.1109\/TASE.2022.3194312"},{"key":"474_CR21","doi-asserted-by":"crossref","unstructured":"Du L, Cheng L, Liu C (2021) Process mining for wind turbine maintenance process analysis: A case study. In: IEEE 5th Conference on Energy Internet and Energy System Integration.\u00a0IEEE, pp 3274\u20133278","DOI":"10.1109\/EI252483.2021.9713329"},{"key":"474_CR22","doi-asserted-by":"publisher","unstructured":"Silalahi S, Yuhana UL, Ahmad T, Studiawan H (2022) A survey on process mining for security. In: 2022 International Seminar on Application for Technology of Information and Communication (iSemantic). pp 1\u20136. https:\/\/doi.org\/10.1109\/iSemantic55962.2022.9920473","DOI":"10.1109\/iSemantic55962.2022.9920473"},{"key":"474_CR23","doi-asserted-by":"publisher","first-page":"106584","DOI":"10.1016\/j.cie.2020.106584","volume":"146","author":"S Saraeian","year":"2020","unstructured":"Saraeian S, Shirazi B (2020) Process mining-based anomaly detection of additive manufacturing process activities using a game theory modeling approach. Comput Ind Eng 146:106584","journal-title":"Comput Ind Eng"},{"key":"474_CR24","doi-asserted-by":"crossref","unstructured":"Coltellese S, Maria\u00a0Maggi F, Marrella A, Massarelli L, Querzoni L (2019) Triage of iot attacks through process mining. In: On the Move to Meaningful Internet Systems: OTM 2019 Conferences: Confederated International Conferences: CoopIS, ODBASE, C &TC 2019, Rhodes, Greece, October 21\u201325, 2019, Proceedings. Springer, pp 326\u2013344","DOI":"10.1007\/978-3-030-33246-4_22"},{"key":"474_CR25","doi-asserted-by":"crossref","unstructured":"Hemmer A, Badonnel R, Chrisment I (2020) A process mining approach for supporting iot predictive security. In: NOMS 2020-2020 IEEE\/IFIP Network Operations and Management Symposium. IEEE, pp 1\u20139","DOI":"10.1109\/NOMS47738.2020.9110411"},{"key":"474_CR26","doi-asserted-by":"crossref","unstructured":"Gaidamakin N, Gibilinda R, Sinadskiy N (2020) File operations information collecting software package used in the information security incidents investigation. In: 2020 Ural Symposium on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT). IEEE, pp 559\u2013562","DOI":"10.1109\/USBEREIT48449.2020.9117671"},{"key":"474_CR27","doi-asserted-by":"crossref","unstructured":"Yang H, Park M, Cho M, Song M, Kim S (2014) A system architecture for manufacturing process analysis based on big data and process mining techniques. In: 2014 IEEE International Conference on Big Data (Big Data). IEEE, pp 1024\u20131029","DOI":"10.1109\/BigData.2014.7004336"},{"key":"474_CR28","doi-asserted-by":"crossref","unstructured":"Van Der Aalst W (2016) Process mining: data science in action. Springer","DOI":"10.1007\/978-3-662-49851-4"},{"key":"474_CR29","doi-asserted-by":"publisher","first-page":"406","DOI":"10.1016\/j.ins.2022.11.052","volume":"619","author":"L Cheng","year":"2023","unstructured":"Cheng L, Liu C, Zeng Q (2023) Optimal alignments between large event logs and process models over distributed systems: An approach based on Petri nets. Inf Sci 619:406\u2013420","journal-title":"Inf Sci"},{"key":"474_CR30","doi-asserted-by":"crossref","unstructured":"Bolt A, van\u00a0der Aalst WM (2015) Multidimensional process mining using process cubes. In: Enterprise, Business-Process and Information Systems Modeling: 16th International Conference.\u00a0Springer, pp 102\u2013116","DOI":"10.1007\/978-3-319-19237-6_7"},{"key":"474_CR31","doi-asserted-by":"crossref","unstructured":"Fahland D (2022) Multi-dimensional process analysis. In: Proceedings of the 20th International Conference on Business Process Management, vol 13420.\u00a0Springer, pp 27\u201333","DOI":"10.1007\/978-3-031-16103-2_3"},{"key":"474_CR32","unstructured":"Denisov V, Belkina E, Fahland D, van\u00a0der Aalst WM (2018) The performance spectrum miner: Visual analytics for fine-grained performance analysis of processes. In: BPM (Dissertation\/Demos\/Industry). Springer, pp 96\u2013100"},{"key":"474_CR33","doi-asserted-by":"crossref","unstructured":"Leemans S, Poppe E, Wynn M (2019) Directly follows-based process mining: A tool. In: Proceedings of the ICPM demo track 2019.\u00a0IEEE, pp 9\u201312","DOI":"10.1109\/ICPM.2019.00015"}],"container-title":["Journal of Cloud Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13677-023-00474-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s13677-023-00474-y\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13677-023-00474-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,7,6]],"date-time":"2023-07-06T13:09:13Z","timestamp":1688648953000},"score":1,"resource":{"primary":{"URL":"https:\/\/journalofcloudcomputing.springeropen.com\/articles\/10.1186\/s13677-023-00474-y"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,7,6]]},"references-count":33,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,12]]}},"alternative-id":["474"],"URL":"https:\/\/doi.org\/10.1186\/s13677-023-00474-y","relation":{},"ISSN":["2192-113X"],"issn-type":[{"value":"2192-113X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,7,6]]},"assertion":[{"value":"13 April 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"14 June 2023","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"6 July 2023","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}},{"value":"Not applicable.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}},{"value":"The authors declare no competing interests.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"100"}}