Message correlation and Business Protocol discovery in service interaction logs

The problem of discovering protocols and business processes based on the analysis of log files is a real challenge. The behavior of a Web service can be specified using a Business Protocol, hence the importance of this discovery. The construction of the Business Protocol begins by correlating the logged messages into their conversations (i.e. instances of the business protocol). The accomplishment of this task is easy if we assume that the logs contain the right identifiers, which would allow us to associate every message to a conversation. But in real-world situations, this kind of information rarely exists inside the log files. Our work consists in correlating the messages present in Web service logs into the conversations they belong to, and then generating automatically the Business Protocol that reflects the messaging behavior perceived in the log. Contrary to other approaches, we do not assume the existence of a conversation identifier. We first model logged message relations using graphs and then we use graph theory techniques to extract the conversations and finally the Business Protocol. Logs are often incomplete and contain errors. This induces some uncertainty on the results. To address this problem, we apply the Dempster-Shafer theory of evidence. Our approach is implemented and tested using synthetic logs.