arXiv subjects

Francesco Vitale

Publications and source records attributed to Francesco Vitale.

13 recordsLinked to original sources

arXiv2026

Enhancing Anomaly-Based Intrusion Detection Systems with Process Mining

Anomaly-based Intrusion Detection Systems (IDSs) ensure protection against malicious attacks on networked systems. While deep learning-based IDSs achieve effective performance, their limited trustworthiness due to black-box architectures remains a critical constraint. Despite existing explainable techniques offering insight into the alarms raised by IDSs, they lack process-based explanations grounded in packet-level sequencing analysis. In this paper, we propose a method that employs process mining techniques to enhance anomaly-based IDSs by providing process-based alarm severity ratings and explanations for alerts. Our method prioritizes critical alerts and maintains visibility into network behavior, while minimizing disruption by allowing misclassified benign traffic to pass. We apply the method to the publicly available USB-IDS-TC dataset, which includes anomalous traffic affected by different variants of the Slowloris DoS attack. Results show that our method is able to discriminate between low- to very-high-severity alarms while preserving up to 99.94% recall and 99.99% precision, effectively discarding false positives while providing different degrees of severity for the true positives.

cs.CR↗

arXiv2026

Dynamic Risk Assessment by Bayesian Attack Graphs and Process Mining

While attack graphs are useful for identifying major cybersecurity threats affecting a system, they do not provide operational support for determining the likelihood of having a known vulnerability exploited, or that critical system nodes are likely to be compromised. In this paper, we perform dynamic risk assessment by combining Bayesian Attack Graphs (BAGs) and online monitoring of system behavior through process mining. Specifically, the proposed approach applies process mining techniques to characterize malicious network traffic and derive evidence regarding the probability of having a vulnerability actively exploited. This evidence is then provided to a BAG, which updates its conditional probability tables accordingly, enabling dynamic assessment of vulnerability exploitation. We apply our method to a cybersecurity testbed instantiating several machines deployed on different subnets and affected by several CVE vulnerabilities. The testbed is stimulated with both benign traffic and malicious behavior, which simulates network attack patterns aimed at exploiting the CVE vulnerabilities. The results indicate that our proposal effectively detects whether vulnerabilities are being actively exploited, allowing for an updated assessment of the probability of system compromise.

cs.CR↗

arXiv2025

Network Traffic Analysis with Process Mining: The UPSIDE Case Study

Online gaming is a popular activity involving the adoption of complex systems and network infrastructures. The relevance of gaming, which generates large amounts of market revenue, drove research in modeling network devices' behavior to evaluate bandwidth consumption, predict and sustain high loads, and detect malicious activity. In this context, process mining appears promising due to its ability to combine data-driven analyses with model-based insights. In this paper, we propose a process mining-based method that analyzes gaming network traffic, allowing: unsupervised characterization of different states from gaming network data; encoding such states through process mining into interpretable Petri nets; and classification of gaming network traffic data to identify different video games being played. We apply the method to the UPSIDE case study, involving gaming network data of several devices interacting with two video games: Clash Royale and Rocket League. Results demonstrate that the gaming network behavior can be effectively and interpretably modeled through states represented as Petri nets with sufficient coherence and specificity while maintaining a good classification accuracy of the two different video games.

cs.LG↗

arXiv2025

Adaptive Identification and Modeling of Clinical Pathways with Process Mining

Clinical pathways are specialized healthcare plans that model patient treatment procedures. They are developed to provide criteria-based progression and standardize patient treatment, thereby improving care, reducing resource use, and accelerating patient recovery. However, manual modeling of these pathways based on clinical guidelines and domain expertise is difficult and may not reflect the actual best practices for different variations or combinations of diseases. We propose a two-phase modeling method using process mining, which extends the knowledge base of clinical pathways by leveraging conformance checking diagnostics. In the first phase, historical data of a given disease is collected to capture treatment in the form of a process model. In the second phase, new data is compared against the reference model to verify conformance. Based on the conformance checking results, the knowledge base can be expanded with more specific models tailored to new variants or disease combinations. We demonstrate our approach using Synthea, a benchmark dataset simulating patient treatments for SARS-CoV-2 infections with varying COVID-19 complications. The results show that our method enables expanding the knowledge base of clinical pathways with sufficient precision, peaking to 95.62% AUC while maintaining an arc-degree simplicity of 67.11%.

cs.LG↗

arXiv2025

Architecting software monitors for control-flow anomaly detection through large language models and conformance checking

Context: Ensuring high levels of dependability in modern computer-based systems has become increasingly challenging due to their complexity. Although systems are validated at design time, their behavior can be different at runtime, possibly showing control-flow anomalies due to ``unknown unknowns''. Objective: We aim to detect control-flow anomalies through software monitoring, which verifies runtime behavior by logging software execution and detecting deviations from expected control flow. Methods: We propose a methodology to develop software monitors for control-flow anomaly detection through Large Language Models (LLMs) and conformance checking. The methodology builds on existing software development practices to maintain traditional V\&V while providing an additional level of robustness and trustworthiness. It leverages LLMs to link design-time models and implementation code, automating source-code instrumentation. The resulting event logs are analyzed via conformance checking, an explainable and effective technique for control-flow anomaly detection. Results: We test the methodology on a case-study scenario from the European Railway Traffic Management System / European Train Control System (ERTMS/ETCS), which is a railway standard for modern interoperable railways. The results obtained from the ERTMS/ETCS case study demonstrate that LLM-based source-code instrumentation can achieve up to 82.849% control-flow coverage of the reference design-time process model, while the subsequent conformance checking-based anomaly detection reaches a peak performance of 95.957% F1-score and 93.669% AUC. Conclusion: Incorporating domain-specific knowledge to guide LLMs in source-code instrumentation significantly allowed obtaining reliable and quality software logs and enabled effective control-flow anomaly detection through conformance checking.

cs.SE↗

arXiv2025

Run-Time Monitoring of ERTMS/ETCS Control Flow by Process Mining

Ensuring the resilience of computer-based railways is increasingly crucial to account for uncertainties and changes due to the growing complexity and criticality of those systems. Although their software relies on strict verification and validation processes following well-established best-practices and certification standards, anomalies can still occur at run-time due to residual faults, system and environmental modifications that were unknown at design-time, or other emergent cyber-threat scenarios. This paper explores run-time control-flow anomaly detection using process mining to enhance the resilience of ERTMS/ETCS L2 (European Rail Traffic Management System / European Train Control System Level 2). Process mining allows learning the actual control flow of the system from its execution traces, thus enabling run-time monitoring through online conformance checking. In addition, anomaly localization is performed through unsupervised machine learning to link relevant deviations to critical system components. We test our approach on a reference ERTMS/ETCS L2 scenario, namely the RBC/RBC Handover, to show its capability to detect and localize anomalies with high accuracy, efficiency, and explainability.

cs.LG↗

arXiv2025

Process mining-driven modeling and simulation to enhance fault diagnosis in cyber-physical systems

Cyber-Physical Systems (CPSs) tightly interconnect digital and physical operations within production environments, enabling real-time monitoring, control, optimization, and autonomous decision-making that directly enhance manufacturing processes and productivity. The inherent complexity of these systems can lead to faults that require robust and interpretable diagnoses to maintain system dependability and operational efficiency. However, manual modeling of faulty behaviors requires extensive domain expertise and cannot leverage the low-level sensor data of the CPS. Furthermore, although powerful, deep learning-based techniques produce black-box diagnostics that lack interpretability, limiting their practical adoption. To address these challenges, we set forth a method that performs unsupervised characterization of system states and state transitions from low-level sensor data, uses several process mining techniques to model faults through interpretable stochastic Petri nets, simulates such Petri nets for a comprehensive understanding of system behavior under faulty conditions, and performs Petri net-based fault diagnosis. The method is applied to the Robotic Arm Dataset (RoAD), a benchmark collected from a robotic arm deployed in a scale-replica smart manufacturing assembly line. The application to RoAD demonstrates the method's effectiveness in modeling, simulating, and classifying faulty behaviors in CPSs. The modeling results demonstrate that our method achieves a satisfactory interpretability-simulation accuracy trade-off with up to 0.676 arc-degree simplicity, 0.395 R^2, and 0.088 RMSE. In addition, the fault identification results show that the method achieves an F1 score of up to 98.925%, while maintaining a low conformance checking time of 0.020 seconds, which competes with other deep learning-based methods.

cs.LG↗

arXiv2025

Control-flow anomaly detection by process mining-based feature extraction and dimensionality reduction

The business processes of organizations may deviate from normal control flow due to disruptive anomalies, including unknown, skipped, and wrongly-ordered activities. To identify these control-flow anomalies, process mining can check control-flow correctness against a reference process model through conformance checking, an explainable set of algorithms that allows linking any deviations with model elements. However, the effectiveness of conformance checking-based techniques is negatively affected by noisy event data and low-quality process models. To address these shortcomings and support the development of competitive and explainable conformance checking-based techniques for control-flow anomaly detection, we propose a novel process mining-based feature extraction approach with alignment-based conformance checking. This variant aligns the deviating control flow with a reference process model; the resulting alignment can be inspected to extract additional statistics such as the number of times a given activity caused mismatches. We integrate this approach into a flexible and explainable framework for developing techniques for control-flow anomaly detection. The framework combines process mining-based feature extraction and dimensionality reduction to handle high-dimensional feature sets, achieve detection effectiveness, and support explainability. The results show that the framework techniques implementing our approach outperform the baseline conformance checking-based techniques while maintaining the explainable nature of conformance checking. We also provide an explanation of why existing conformance checking-based techniques may be ineffective.

cs.LG↗

arXiv2024

Data-driven Discovery for Robust Optimization of Semiconductor Nanowire Lasers

Active wavelength-scale optoelectronic components are widely used in photonic integrated circuitry, however coherent sources of light -- namely optical lasers -- remain the most challenging component to integrate. Semiconductor nanowire lasers represent a flexible class of light source where each nanowire is both gain material and cavity; however, strong coupling between these properties and the performance leads to inhomogeneity across the population. While this has been studied and optimized for individual material systems, no architecture-wide insight is available. Here, nine nanowire laser material systems are studied and compared using 55,516 nanowire lasers to provide statistically robust insight into performance. These results demonstrate that, while it may be important to optimise internal quantum efficiency for certain materials, cavity effects are always critical. Our study provides a roadmap to optimize the performance of nanowire lasers made from any material: this can be achieved by ensuring a narrow spread of lengths and end-facet reflectivities.

physics.optics↗

arXiv2024

Optical characterization of size- and substrate-dependent performance of ultraviolet hybrid plasmonic nanowire lasers

Nanowire-based plasmonic lasers are now established as nano-sources of coherent radiation, appearing as suitable candidates for integration into next-generation nanophotonic circuitry. However, compared to their photonic counterparts, their relatively high losses and large lasing thresholds still pose a burdening constraint on their scalability. In this study, the lasing characteristics of ZnO nanowires on Ag and Al substrates, operating as optically-pumped short-wavelength plasmonic nanolasers, are systematically investigated in combination with the size-dependent performance of the hybrid cavity. A hybrid nanomanipulation-assisted single nanowire optical characterization combined with high-throughput PL spectroscopy enables the correlation of the lasing characteristics to the metal substrate and the nanowire diameter. The results evidence that the coupling between excitons and surface plasmons is closely tied to the relationship between substrate dispersive behavior and nanowire diameter. Such coupling dictates the degree to which the lasing character, be it more plasmonic- or photonic-like, can define the stimulated emission features and, as a result, the device performance.

physics.optics↗

arXiv2022

Tailoring Nanowire Lasing Modes via Coupling to Metal Gratings

Tailoring the emission of plasmonic nanowire-based lasers represents one of the major challenges in the field of nanoplasmonics, given the envisaged integration of such devices into on-chip all-optical circuits. In this study, we proposed a mode selection scheme based on distributed feedback, achieved via the external coupling of single zinc oxide nanowires to an aluminum grating, which enabled a quasi-single mode lasing action. The nano-manipulation of a single nanowire allowed for a reliable comparison of the lasing emission characteristics in both planar (i.e. nanowire on the metallic substrate) and on-grating configurations. We found that, by varying the orientation of the nanowire on the grating, only when the nano-cavity was perpendicular to the ridge direction, an additional peak emerged in the emission spectrum on the low-energy side of the gain envelope. As a consequence of the fulfillment of the Bragg condition, such a peak was attributed to a hybrid mode dominating the mode competition. Simulation results showed that the hybrid mode could be efficiently waveguided along the nanowire cavity and supported by localized plasmon polaritons building up at the raised features ("fences") on top of the metal grating ridges. Moreover, the hybrid mode was found to experience an extra reflectance of nearly 50% across the grating periods, in addition to that provided by the nanowire end facets.

physics.optics↗

arXiv2022

Lasing modes in ZnO nanowires coupled to planar metals

Semiconductor nanowire lasers can be subject to modifications of their lasing threshold resulting from a variation of their environment. A promising choice is to use metallic substrates to gain access to low-volume Surface-Plasmon-Polariton (SPP) modes. We introduce a simple, yet quantitatively precise model that can serve to describe mode competition in nanowire lasers on metallic substrates. We show that an aluminum substrate can decrease the lasing threshold for ZnO nanowire lasers while for a silver substrate, the threshold increases compared with a dielectric substrate. Generalizing from these findings, we make predictions describing the interaction between planar metals and semiconductor nanowires, which allow to guide future improvements of highly-integrated laser sources.

physics.optics↗

arXiv2022

Tuning nanowire lasers via hybridization with two-dimensional materials

Mixed dimensional hybrid structures have recently gained increasing attention as promising building blocks for novel electronic and optoelectronic devices. In this context, hybridization of semiconductor nanowires with two-dimensional materials could offer new ways to control and modulate lasing at the nanoscale. In this work, we deterministically fabricate hybrid mixed-dimensional heterostructures composed of ZnO nanowires and MoS2 monolayers with micrometer control over their relative position. First, we show that our deterministic fabrication method does not degrade the optical properties of the ZnO nanowires. Second, we demonstrate that the lasing wavelength of ZnO nanowires can be tuned by several nanometers by hybridization with CVD-grown MoS2 monolayers. We assign this spectral shift of the lasing modes to an efficient carrier transfer at the heterointerface and the subsequent increase of the optical band gap in ZnO (Moss-Burstein effect).

physics.optics↗