Search

BACKGROUND: Cladribine is a nucleoside analogue interfering with synthesis and repair of DNA. Treatment with cladribine leads to a preferential reduction in lymphocytes, resulting in profound depletion of B-cells with a rapid recovery of naïve B-cells, while T-cell show a lesser but long-lasting depletion It is approved for treatment of relapsing multiple sclerosis (MS). Cladribine tablets 3.5 mg/kg bodyweight are administered in two yearly treatment courses, each including two treatment series lasting 4 or 5 days, one at the start of the first month and the other at the start of the second month.OBJECTIVE: To describe treatment patterns of cladribine in a real-world setting.METHODS: Registry based observational cohort study with prospectively enrolled cases from December 2017 through June 2021. The data source is The Danish Multiple Sclerosis Registry, which is a near complete nationwide population-based registry. Outcomes were length of the treatment, preceding and following treatments, treatment response, and safety data.RESULTS: In total 268 patients had started therapy with cladribine tablets, 89 men and 179 women, with a median age of 40 years (interquartile range (IQR) 32-48. The disease course was relapsing-remitting MS in 97.8% of the patients, and at treatment start the median time from disease onset was 8.1 years (IQR 4.2-14.5) and EDSS 2.5 (IQR 1.5-3.5). Thirty-four patients (12.7%) were treatment naïve while 56 (20.9%) had received one previous disease-modifying therapy (DMT), 67 (25.0%) two, and 111 (41.4%) three or more previous DMTs. In total, 214 (80.0%) patients had completed the full treatment of two courses of cladribine, while 54 (20.0%) had received only one course of cladribine tablets. The median follow-up time after cladribine initiation was 34.7 months (IQR 23.3-43.7). Compared with an annualized relapse rate (ARR) of 0.67 (95% CI [0.56, 0.79]) in the year prior to start of cladribine, ARR was reduced to 0.11 (95% CI [0.08, 0.15]) in year 0-2 after 3-month re-baseline with cladribine (84.8% reduction). Adverse events, reported in 44 (16.4%) of the patients, were mild or moderate, and herpes zoster was only reported in 2 patients. In total, 30 (11.2%) patients discontinued cladribine treatment, of whom 7 (2.6%) discontinued because of adverse effects and 12 (4.5%) discontinued because of disease activity.CONCLUSION: In this nationwide review of all Danish patients starting therapy with cladribine tablets in a real-world setting, cladribine treatment was safe, and the therapeutic response was as expected from previous clinical trials. A prolonged observation period is necessary to assess the long-term benefit and risk of cladribine.

Classification-oriented Machine Learning methods are a precious tool, in modern Intrusion Detection Systems (IDSs), for discriminating between suspected intrusion attacks and normal behaviors. Many recent proposals in this field leveraged Deep Neural Network (DNN) methods, capable of learning effective hierarchical data representations automatically. However, many of these solutions were validated on data featuring stationary distributions and/or large amounts of training examples. By contrast, in real IDS applications different kinds of attack tend to occur over time, and only a small fraction of the data instances is labeled (usually with far fewer examples of attacks than of normal behavior). A novel ensemble-based Deep Learning framework is proposed here that tries to face the challenging issues above. Basically, the non-stationary nature of IDS log data is faced by maintaining an ensemble consisting of a number of specialized base DNN classifiers, trained on disjoint chunks of the data instances’ stream, plus a combiner model (reasoning on both the base classifiers predictions and original instance features). In order to learn deep base classifiers effectively from small training samples, an ad-hoc shared DNN architecture is adopted, featuring a combination of dropout capabilities, skip-connections, along with a cost-sensitive loss (for dealing with unbalanced data). Tests results, conducted on two benchmark IDS datasets and involving several competitors, confirmed the effectiveness of our proposal (in terms of both classification accuracy and robustness to data scarcity), and allowed us to evaluate different ensemble combination schemes.

Background:The course of multiple sclerosis (MS) appears to be milder in recent decades.Objective:To investigate how time from onset to disability milestones and how demographic and clinical characteristics have changed through subsequent onset cohorts of patients with MS.Methods:In the nationwide Danish Multiple Sclerosis Registry, we have registered all 13,562 Danish patients with onset of MS or clinically isolated syndrome from 1996 through 2020. For the analyses of prognosis, we used all cases with relapsing onset ( N = 11,669). After stratification into 5-year onset cohorts, we computed the hazard ratios for disability endpoints for all cohorts having at least 10 years of follow-up and the oldest 1996–2000 onset cohort as reference.Results:Patients in more recent MS onset cohorts have a shorter diagnostic delay and more of them start disease-modifying treatment within 1 year since diagnosis. The prognosis was better for later onset cohorts. For the 2001–2005 cohort, the hazard ratio for confirmed Expanded Disability Status Scale (EDSS) 4 was 0.85 (95% confidence interval (CI), 0.76–0.95) and for confirmed EDSS 6: 0.76 (95% CI, 0.65–0.88). For the more recent 2006–2010 cohort, the corresponding hazard ratios were 0.70 (95% CI, 0.62–0.79) and 0.60 (95% CI, 0.50–0.71).Conclusion:We observed a considerable improvement of the prognosis in recent onset cohorts of relapsing-onset MS.

ObjectiveWe investigated whether clinical rebound occurred after fingolimod discontinuation in a complete population of patients with relapsing-remitting multiple sclerosis (RRMS) in Denmark. We further identified clinical and demographical factors associated with disease reactivation after fingolimod discontinuation.MethodsThe population comprised 992 RRMS patients treated with fingolimod for 6 months or more. We estimated annualised relapse rates (ARR) before, during and after treatment. We estimated overall ARRs and ARRs stratified by disease activity before discontinuation. We calculated the proportion of patients with a higher clinical disease activity after discontinuation than before treatment start. Finally, we analysed the association between variables at discontinuation and time to first relapse after discontinuation.ResultsThe ARR 3 months after discontinuation (ARR=0.56; 95% CI=0.47 to 0.66) was statistically significantly lower (pConclusionsBased on average ARR levels, there was no evidence of clinical rebound after fingolimod discontinuation. In total, 12.5% of patients had clinical rebound. Only 3.6%, however, had clinical rebound without disease activity before discontinuation. Disease activity before discontinuation, female sex and younger age were statistically significantly associated with a higher relapse risk after discontinuation.

Intrusion detection tools have largely benefitted from the usage of supervised classification methods developed in the field of data mining. However, the data produced by modern system/network logs pose many problems, such as the streaming and non-stationary nature of such data, their volume and velocity, and the presence of imbalanced classes. Classifier ensembles look a valid solution for this scenario, owing to their flexibility and scalability. In particular, data-driven schemes for combining the predictions of multiple classifiers have been shown superior to traditional fixed aggregation criteria (e.g., predictions’ averaging and weighted voting). In intrusion detection settings, however, such schemes must be devised in an efficient way, since (part of) the ensemble may need to be re-trained frequently. A novel ensemble-based framework is proposed here for the online intrusion detection, where the ensemble is updated through an incremental stream-oriented learning scheme, correspondingly to the detection of concept drifts. Differently from mainstream ensemble-based approaches in the field, our proposal relies on deriving, though an efficient genetic programming (GP) method, an expressive kind of combiner function defined in terms of (non-trainable) aggregation functions. This approach is supported by a system architecture, which integrates different kinds of functionalities, ranging from the drift detection, to the induction and replacement of base classifiers, up to the distributed computation of GP-based combiners. Experiments on both artificial and real-life datasets confirmed the validity of the approach.

Ant colonies are higher-level organisms consisting of specialized reproductive and non-reproductive individuals that differentiate early in development, similar to germ–soma segregation in bilateral Metazoa. Analogous to diverging cell lines, developmental differentiation of individual ants has often been considered in epigenetic terms but the sets of genes that determine caste phenotypes throughout larval and pupal development remain unknown. Here, we reconstruct the individual developmental trajectories of two ant species, Monomorium pharaonis and Acromyrmex echinatior, after obtaining >1,400 whole-genome transcriptomes. Using a new backward prediction algorithm, we show that caste phenotypes can be accurately predicted by genome-wide transcriptome profiling. We find that caste differentiation is increasingly canalized from early development onwards, particularly in germline individuals (gynes/queens) and that the juvenile hormone signalling pathway plays a key role in this process by regulating body mass divergence between castes. We quantified gene-specific canalization levels and found that canalized genes with gyne/queen-biased expression were enriched for ovary and wing functions while canalized genes with worker-biased expression were enriched in brain and behavioural functions. Suppression in gyne larvae of Freja, a highly canalized gyne-biased ovary gene, disturbed pupal development by inducing non-adaptive intermediate phenotypes between gynes and workers. Our results are consistent with natural selection actively maintaining canalized caste phenotypes while securing robustness in the life cycle ontogeny of ant colonies.

Background and purpose: Real-world evidence regarding the effectiveness and safety of ocrelizumab for the treatment of multiple sclerosis (MS) is limited. The aim was to evaluate the effectiveness and safety of ocrelizumab treatment for MS in a real-world setting. Methods: A nationwide population-based cohort study was conducted where clinical and magnetic resonance imaging data of MS patients enrolled prospectively in the Danish Multiple Sclerosis Registry who initiated ocrelizumab treatment between January 2018 and November 2020 were analyzed. Results: A total of 1104 patients (85.7% relapsing–remitting MS [RRMS], 8.8% secondary progressive MS [SPMS], 5.5% primary progressive MS [PPMS]) were included, with a median follow-up period of 1.3 years. At baseline, the mean age was 41.4 years in the RRMS group, 44.5 years in the PPMS group and 50.3 years in the SPMS group. Median Expanded Disability Status Scale score was 2.5, 3.5 and 5.5, respectively. Most RRMS and SPMS patients had received previous disease-modifying therapies (87.5% and 91.8%, respectively), whereas PPMS patients were mostly treatment naïve (78.7%). After ocrelizumab initiation, 9.3% of the patients experienced a relapse and 8.7% a 24 weeks confirmed disability worsening. Conversely, 16.7% showed a 24 weeks confirmed disability improvement. After ~1 year of treatment, most patients (94.5%) were free of magnetic resonance imaging activity. Ocrelizumab was generally well tolerated, as side effects were only reported for 10% of patients, mostly consisting of infusion-related reactions and infections. Conclusions: It is shown that most MS patients treated with ocrelizumab are clinically stabilized and with an adverse event profile consistent with the experience from the pivotal clinical trials.

Predicting the final outcome of an ongoing process instance is a key problem in many real-life contexts. This problem has been addressed mainly by discovering a prediction model by using traditional machine learning methods and, more recently, deep learning methods, exploiting the supervision coming from outcome-class labels associated with historical log traces. However, a supervised learning strategy is unsuitable for important application scenarios where the outcome labels are known only for a small fraction of log traces. In order to address these challenging scenarios, a semi-supervised learning approach is proposed here, which leverages a multi-target DNN model supporting both outcome prediction and the additional auxiliary task of next-activity prediction. The latter task helps the DNN model avoid spurious trace embeddings and overfitting behaviors. In extensive experimentation, this approach is shown to outperform both fully-supervised and semi-supervised discovery methods using similar DNN architectures across different real-life datasets and label-scarce settings.

Background To assign a course of secondary progressive multiple sclerosis (MS) (SPMS) may be difficult and the proportion of persons with SPMS varies between reports. An objective method for disease course classification may give a better estimation of the relative proportions of relapsing–remitting MS (RRMS) and SPMS and may identify situations where SPMS is under reported. Materials and methods Data were obtained for 61,900 MS patients from MS registries in the Czech Republic, Denmark, Germany, Sweden, and the United Kingdom (UK), including date of birth, sex, SP conversion year, visits with an Expanded Disability Status Scale (EDSS) score, MS onset and diagnosis date, relapses, and disease-modifying treatment (DMT) use. We included RRMS or SPMS patients with at least one visit between January 2017 and December 2019 if ≥ 18 years of age. We applied three objective methods: A set of SPMS clinical trial inclusion criteria (“EXPAND criteria”) modified for a real-world evidence setting, a modified version of the MSBase algorithm, and a decision tree-based algorithm recently published. Results The clinically assigned proportion of SPMS varied from 8.7% (Czechia) to 34.3% (UK). Objective classifiers estimated the proportion of SPMS from 15.1% (Germany by the EXPAND criteria) to 58.0% (UK by the decision tree method). Due to different requirements of number of EDSS scores, classifiers varied in the proportion they were able to classify; from 18% (UK by the MSBase algorithm) to 100% (the decision tree algorithm for all registries). Objectively classified SPMS patients were older, converted to SPMS later, had higher EDSS at index date and higher EDSS at conversion. More objectively classified SPMS were on DMTs compared to the clinically assigned. Conclusion SPMS appears to be systematically underdiagnosed in MS registries. Reclassified patients were more commonly on DMTs.

Animal gut microbiota affect host physiology and behaviour. In social insects, where colony level integrity is preserved via a nestmate discrimination system based on cuticular hydrocarbon mixtures, microorganismal effects may therefore influence social dynamics. Although nestmate recognition has undergone a thorough exploration during the last four decades, few studies have investigated the putative role of gut microbes. Here, we integrated 16S rRNA-based microbial community profiling, chemical and behavioural approaches to test whether gut microbes affect nestmate recognition in Acromyrmex echinatior leaf-cutting ants. Treating workers with a sterile diet or with antibiotics resulted in a substantial alteration of their gut microbial communities. In pairwise social interactions, untreated versus antibiotic-treated nestmates behaved more aggressively than other nestmate and non-nestmate pairs, suggesting that bacterial suppression may alter chemical social cues and trigger aggressive behaviour. Chemical analyses of treated individuals revealed a decrease in the abundance of two metapleural gland antifungal compounds, and confirmed the correspondence between aggression levels and chemical profile differences. Feeding microbiota-remodelled ants with conspecific faecal droplets partially restored the original bacterial communities. Ants fed with faecal droplets from different colonies were unusually aggressive compared to pairs fed with faecal droplets from the same colony. We cannot exclude confounding effects resulting from the potentially harmful action of antibiotics on ant hosts. However, our results suggest a correlation between chemical profiles and the presence of certain microbial species in the gut, which may affect nestmate recognition and division of labour. This opens novel questions about the role of symbiotic microorganisms in the evolution of social insect behaviour. Accepted version

Monitoring the performances of a business process is a key issue in many organizations, especially when the process must comply with predefined performance constraints. In such a case, empowering the monitoring system with prediction capabilities would allow us to know in advance a constraint violation, and possibly trigger corrective measures to eventually prevent the violation. Despite the problem of making run-time predictions for a process, based on pre-mortem log data, is an active research topic in Process Mining, current predictive monitoring approaches in this field only support predictions at the level of a single process instance, whereas process performance constraints are often defined in an aggregated form, according to predefined time windows. Moreover, most of these approaches cannot work well on the traces of a lowly-structured business process when these traces do not refer to well-defined process tasks/activities. For such a challenging setting, we define an approach to the problem of predicting whether the process instances of a given (unfinished) time window will violate an aggregate performance requirement. The approach mainly rely on inducing and integrating two complementary predictive models: (1) a clustering-based predictor for estimating the outcome of each ongoing process instance, (2) a time-series predictor for estimating the performance outcome of “future” process instances that will fall in the window after the moment when the prediction is being made (i.e. instances, not started yet, that will start by the end of the window). Both models are expected to benefit from the availability of aggregate context data regarding the environment that surrounds the process. This discovery approach is conceived as the core of an advanced performance monitoring system, for which an event-based conceptual architecture is here proposed. Tests on real-life event data confirmed the validity of our approach, in terms of accuracy, robustness, scalability, and usability.

The ever-increasing attention of process mining (PM) research to the logs of low structured processes and of non-process-aware systems (e.g., ERP, IoT systems) poses a number of challenges. Indeed, in such cases, the risk of obtaining low-quality results is rather high, and great effort is needed to carry out a PM project, most of which is usually spent in trying different ways to select and prepare the input data for PM tasks. Two general AI-based strategies are discussed in this paper, which can improve and ease the execution of PM tasks in such settings: (a) using explicit domain knowledge and (b) exploiting auxiliary AI tasks. After introducing some specific data quality issues that complicate the application of PM techniques in the above-mentioned settings, the paper illustrates these two strategies and the results of a systematic review of relevant literature on the topic. Finally, the paper presents a taxonomical scheme of the works reviewed and discusses some major trends, open issues and opportunities in this field of research.

Ticket Management Systems are widespread in disparate kinds of companies and organizations, as they represent a fundamental tool for handling customer requests and issues in an efficient and effective manner. In particular, accurately categorizing incoming tickets is a key task in real-life application settings (e.g., helpdesk/CRM systems and bug tracking systems), in order to improve ticket processing efficiency and effectiveness (e.g., in terms of customer satisfaction). In this work, we propose a comprehensive ticket-categorization analysis that relies on inducing and exploiting a heterogeneous ensemble of deep learning architectures, in addition to a range of functionalities for acquiring, integrating and pre-processing ticket-related information coming from different channels (e.g. mail, chat, web form, etc.). Experimental results conducted on the specific application scenario concerning the data of a publicly available ticket-mining dataset have proven the effectiveness of the framework in different ticket categorization tasks.

Ants exhibit remarkable phenotypic diversity and, with over approximately 16,000 species across 6 continents, represent one of the most evolutionarily and ecologically successful groups of animals. All ants are eusocial with a reproductive division of labor between morphologically and/or behaviourally distinct castes within a single species. This has made ants an ideal system to study core questions ofeco-evo-devo(ecological evolutionary developmental biology) by highlighting the role of developmental plasticity, epigenetics, ancestral developmental potentials, modularity, and major evolutionary transitions in the evolutionary process. Yet, despite their importance foreco-evo-devo, no complete ontological series for an ant has been published to date. We therefore present the first developmental table in ants, from egg to adult, for the Myrmicine antMonomorium pharaonis. We identified and characterized 17 embryonic stages, 3 larval instars, and prepupal/pupal development. We found that the majority of landmarks identified during embryogenesis in the fruitflyDrosophila melanogasterare conserved inM. pharaonis. Furthermore, we can morphologically discriminate reproductive larvae (queen and male-destined larvae) from one another after the 1stlarval instar. Finally, this ontological series ofM. pharaoniswill serve as a blueprint for the generation of future ant developmental tables, which is key to understanding how the remarkable diversity in ants evolved.

Mining deviances from expected behaviors in process logs is a relevant problem in modern organizations, owing to their negative impact in terms of monetary/reputation losses. Most proposals to deviance mining combine the ex- traction of behavioral features from log traces with the induction of standard classifiers. Difficulties in capturing the multi-faceted nature of deviances with a single pattern family led to explore the possibility to mix up heterogeneous data views, obtained each with a different pattern family. Unfortunately, combining many pattern families tends to produce sparse and redundant representations that likely lead to the discovery of poor deviance-oriented classifiers. Using a multi-view ensemble learning approach to combine alternative trace representations was recently proven effective for this induction task. On the other hand, Deep Learn- ing methods have been gaining momentum in prediction/classification tasks on process log data, owing to their flexibility and expressiveness. We here propose a novel multi-view ensemble-based framework for the discovery of deviance- oriented classifiers that profitably combines different single-view deep classifiers, sharing an ad hoc residual-like architecture (simulating fine-grain ensemble-like capabilities over each single data view). The approach, tested over real-life pro- cess log data, significantly improves previous solutions.

Traditionally, Expert Systems have found a natural application in the behavioral analysis of processes. In fact, they have proved effective in the tasks of interpreting the data collected during the process executions and of analyzing these data with the aim of diagnosing/detecting anomalies. In this context, we focus on log data generated by executions of business processes, and consider the issue of detecting “insecure” process instances, involving some kind of security breach (e.g. attacks, frauds). We propose a hybrid framework for accomplishing a security-oriented classification of activity-unawaretraces, i.e., traces consisting of “low-level” events with no explicit reference to the “high-level” activities the analysts are typically familiar with. The framework integrates two classification approaches traditionally used as alternative ways to decide on the “secureness” of process traces: (i) a model-driven approach, using knowledge of behavioral models expressed at the abstraction level of the activities, and (ii) an example driven approach, exploiting the availability of event sequences labeled by experts as symptomatic of “secure” or “insecure” behavior. The core of our solution is a meta-classifier combining (i) and (ii) thanks to a probabilistic Montecarlo mechanism that allows the traces to be simultaneously viewed as sequences of low-level events and of high-level activities. The framework has been empirically proved effective in jointly exploiting the two aforementioned forms of knowledge/expertise, typically coming from different experts, and in acting as a sort of “super-expert” classification tool. Its accuracy and efficiency make it a solid basis for implementing a novel kind of expert system for the security-oriented monitoring/analysis of business processes.

Process Mining (PM) is meant to extract knowledge on the behavior of business processes from historical log data. Lately, an increasing attention has been gained by the Predictive Process Monitor- ing, a field of PM that tries to extend process monitoring systems with prediction capabilities and, in particular. Several current proposals in literature to this problem rely on Deep Neural Networks, mostly on recurrent architectures (in particular LSTM) owing to their capability to capture the inherent sequential nature of process data. Very recently, however, an alternative solution based on a convolutional architecture (CNN) has been proposed in the literature, which was shown to achieve compelling results. Inspired by this line of research, we here propose a novel convolution-based deep learning approach to the prediction of the next activity which relies on: (i) extracting high-level features (at different levels of abstraction) through the computation of time-oriented dilated convolutions over traces, and (ii) exploiting residual-like connections to make the training of the predictive model more robust and faster. Preliminary results on real-life datasets confirm the validity of our proposal, compared with an LSTM-based and a CNN-based approach in the literature.

Computer Science is a relatively young discipline, but in the last two decades the advances in hardware technology and software engineering has induced notable changes in the way users interact with computers. In particular, several processes involving data have changed in a radical manner. As a matter of fact, the amount of data stored in repositories has grown at impressive rates due to the rise of data sources, such as sensor networks, social networks or operational processes. Moreover, the heterogeneity of data has dramatically increased. In a word, data and their management have became more and more complex. Besides the data issues, new challenges have emerged from an application viewpoint, enabled by the informatization and digitalization of even the most trivial processes in the society. New applications span from real-time monitoring of dependable systems by means of cyber-physical sensors, to information diffusion at all levels by means of persistently connected devices, to the capability of tracking and delivering adhoc services to individuals.We're living in a connected world and the new technologies allow us with unforeseen possibilities. Along the recent years, new strategies (specifically, data loading, transformation and extraction, data management, and data mining approaches) have been proposed in order to deal with these unprecedented source of information. The advent of Big Data technologies has empowered the whole discipline of data analytics, by eventually creating even new professional figures which summarize skills in computer science and databases, statistics, machine learning and economics. However, the explosion of this new discipline is not new, and finds its path in the several contributions throughout the last 20 years. The Italian community has been particularly active in this scenario, by providing cutting-edge scientific results and prototypes in the field. As a proof of concept of this, this chapter tries to summarize some important contributions to the analysis of complex data both from the technological and the application point of view. In the following, we briefly recall the basic data types and methods that we have explored in the last years. In order to give the reader a more appealing view of the mentioned approaches, we also describe some applications that we have carried out with respect to some key important topics in the framework of the H2020 societal challenges.

The problem of classifying business log traces is addressed in the context of security risk analysis. We consider the challenging setting where the actions performed in a process instance are described in the log as executions of low-level operations (such as "Pose a query over a DB", "Upload a file into an ftp server"), while analysts and business users describe/understand the process steps as instances of high-level activities (such as "Update the customer's personal data", and "Share a project draft with the coworkers"). Given this, we aim at classifying each trace as the result of a process execution within which a security breach has occurred or not, by taking into account some (possibly incomplete) knowledge of the process structures and of the patterns representing insecure behaviors. What makes the problem challenging is that, when no workflow regulating the process executions is defined, this knowledge is typically owned by experts who reason in terms of process activities, thus it is encoded by behavioral rules at the higher abstract level. Thus, classifying requires the traces to be interpreted and brought to this higher abstraction level, and often this cannot be done deterministically, since the mapping between operations and activities is many-to-many. In our framework, the operation/activity mapping is encoded probabilistically, and the behavioral rules are expressed in terms of precedence/causality constraints over the activities, grouped into mandatory, highly recommended, and recommended requirements. The classification task is addressed in both the cases that process execution are ongoing and have terminated (i.e. in both online and offline scenarios, respectively), and its core is a Monte Carlo generation, that produces a sample of interpretations whose conformance to the security breach models is used to estimate the risks for the security.

In social insects, cuticular hydrocarbons function in nest-mate recognition and also provide a waxy barrier against desiccation, but basic evolutionary features, including the heritability of hydrocarbon profiles and how they are shaped by natural selection are largely unknown. We used a new pharaoh ant ( Monomorium pharaonis ) laboratory mapping population to estimate the heritability of individual cuticular hydrocarbons, genetic correlations between hydrocarbons, and fitness consequences of phenotypic variation in the hydrocarbons. Individual hydrocarbons had low to moderate estimated heritability, indicating that some compounds provide more information about genetic relatedness and can also better respond to natural selection. Strong genetic correlations between compounds are likely to constrain independent evolutionary trajectories, which is expected, given that many hydrocarbons share biosynthetic pathways. Variation in cuticular hydrocarbons was associated with variation in colony productivity, with some hydrocarbons experiencing strong directional selection. Altogether, this study builds on our knowledge of the genetic architecture of the social insect hydrocarbon profile and indicates that hydrocarbon variation is shaped by natural selection.

Definition Business process deviance mining refers to the problem of (automatically) detecting and explaining deviant executions of a business process based on the historical data stored in a given Business Process Event Log (called hereinafter event log for the sake of conciseness). In this context, a deviant execution (or "deviance") is one that deviates from the normal/desirable behavior of the process in terms of performed activities, performance measures, outcomes, or security/compliance aspects. Usually, the given event log is regarded as a collection of process traces, encoding each the history of a single process instance, and the task amounts to spotting and analyzing the traces that likely represent deviant process (execution) instances. In principle, this specific process mining task can help recognize, understand, and possibly prevent/ reduce the occurrence of undesired behaviors. Overview Historically, in a business process mining/intelligence context, the term "deviance mining" was first used in Nguyen et al. (2014). Since then increasing attention has been given to this research topic, owing to two main reasons: (i) deviances may yield severe damages to the organization, e.g., in terms of monetary costs, missed opportunities, or reputation loss; (ii) process logs may be very large and difficult to analyze with traditional auditing approaches, so that automated techniques are needed to discover deviances and/or actionable deviance patterns. Abstracting from the common idea of exploiting event log data, approaches developed in this field look quite variegate. Indeed, in addition to possibly resorting to different data mining techniques, they may also differ in two fundamental aspects: the analysis task and the kinds of available information. Two main deviance mining tasks (often carried out together) have been pursued in the literature: deviance explanation and deviance detection. The former is devoted to "explain the reasons why a business process deviates from its normal or expected execution" (Nguyen et al. 2014, 2016). In the latter, it must be decided whether a given process instance (a.k.a. case) is deviant or not. This task can be accomplished in two fashions: (i) run-time detection, each process instance must be analyzed as it unfolds, based on its "premortem" trace; and (ii) ex post detection, only "postmortem" traces (i.e., just one fully grown trace for each finished process instance) must be analyzed to possibly discover deviances. As to the second aspect (namely, available information), two deviance mining settings can be considered, which differ for the presence of auxiliary information, in addition to the given log traces: o Supervised: All the traces are annotated with some deviance label/score, which allows to regard them as examples for learning a deviance detector/classifier or to extract deviance patterns. o Unsupervised: No a priori deviance-oriented information is given for the traces, so that an unsupervised deviance mining method needs to be devised, based on the assumption that all/ most deviances look anomalous with respect to the mainstream process behavior. The rest of this chapter focuses on ex post deviance mining approaches. In fact, the exploitation of supervised learning methods to detect deviances at run-time has been considered in the related field of predictive business process monitoring.

The ever increasing attention of Process Mining (PM) research to the logs of lowly-structured processes and of non process-aware systems (e.g., ERP, IoT systems) poses several challenges stemming from the lower quality that these logs have, concerning the precision, completeness and abstraction with which they describe the activities performed. In such scenarios, most of the resources spent in a PM project (in terms of time and expertise) are usually devoted to try different ways of selecting and preparing the input data for PM tasks, in order to eventually obtain significant, interpretable and actionable results. Two general AI- based strategies are discussed here that have been partly pursued in the literature to improve the achievements of PM efforts on low-quality logs, and to limit the amount of human intervention needed: (i) using explicit domain knowledge, and (ii) exploiting auxiliary AI tasks. The also provides an overview of trends, open issues and opportunities in the field.

Increasing amounts of data are becoming available in the form of "asynchronous" sequences of event records, associated each with a content and a temporal mark, e.g. sequences of activities on social media, clickstream data, user interaction logs, point- of-interest trajectories, business process logs, application logs and IoT logs, to name a few. Such a kind of data are more general than classic time series, as the lapse of time between consecutive events in a sequence may be an arbitrary continuous value. Usually, events in the same sequence exhibit hidden correlations (e.g., an event can cause or prevent the occurrence of certain kinds of events in the future). Generative models constitute a powerful and versatile means for analysing such data (e.g., by supporting variegate key tasks, such as data completion, data denoising, simulation analyses), as well as for enabling the very generation of new data instances (e.g., for preventing information leakage). In particular, if devised in a conditional fashion, these models can be exploited to predict which events will happen in the remainder of a given (unfinished) sequence and when, based on the sequence's history. Different kinds of neural generative models have been used in the last years for analysing sequence data, which range from Recurrent Neural Networks (RNNs), to Self-attention models, to more sophisticated frameworks like Variational Auto- encoders (VAEs) and Generative Adversarial Networks (GANs). In particular, roughly speaking, basic GAN frameworks implement a sort min-max game, where a "discrim- inator" sub-net is trained to distinguish real data instances from those produced by a "generator" sub-net, which is trained instead to fool the former sub-net. In principle, compared to previous solutions, GANs could yield models that are more general (owing to the GANs' capability to learn implicit data distributions) and more robust to "exposure bias" issues (i.e., to the risk of accumulating errors at inference time). However, they are notoriously difficult to train and tune optimally --in particular, they may converge slowly, and eventually reach an equilibrium that does not ensure a good enough generator (e.g., the latter may suffer from severe mode collapse issues). Moreover, the discrete nature of temporally-marked event sequences calls for extending traditional GAN schemes, as to prevent the problem of breaking the differentiability of the discriminators output w.r.t. the generators parameters (that would arise when sampling one event sequence from the generator's distribution).

L'industria 4.0 mira all'automatizzazione e all'ottimizzazione di tutti i processi produttivi. Tra questi la manutenzione occupa una posizione rilevante poiche? e? in grado di abbracciare tutti i settori di produzione. In questo ambito il team di ricer- ca si e? concentrato nello sviluppo di una metodo- logia e tecniche di manutenzione predittiva basata sull'analisi dei dati provenienti da sensori.

The problem of inducing a model for forecasting the outcome of an ongoing process instance from historical log traces has attracted notable attention in the field of Process Mining. Approaches based on deep neural networks have become popular in this context, as a more effective alternative to previous feature- based outcome-prediction methods. However, these approaches rely on a pure supervised learning scheme, and unfit many real- life scenarios where the outcome of (fully unfolded) training traces must be provided by experts. Indeed, since in such a scenario only a small amount of labeled traces are usually given, there is a risk that an inaccurate or overfitting model is discovered. To overcome these issues, a novel outcome-discovery approach is proposed here, which leverages a fine-tuning strategy that learns general-enough trace representations from unlabelled log traces, which are then reused (and adapted) in the discovery of the outcome predictor. Results on real-life data confirmed that our proposal makes a more effective and robust solution for label- scarcity scenarios than current outcome-prediction methods

Intrusion detection systems have to cope with many challenging problems, such as unbalanced datasets, fast data streams and frequent changes in the nature of the attacks (concept drift). To this aim, here, a distributed genetic programming (GP) tool is used to generate the combiner function of an ensemble; this tool does not need a heavy additional training phase, once the classifiers composing the ensemble have been trained, and it can hence answer quickly to concept drifts, also in the case of fast-changing data streams. The above-described approach is integrated into a novel cybersecurity framework for classifying non stationary and unbalanced data streams. The framework provides mechanisms for detecting drifts and for replacing classifiers, which permits to build the ensemble in an incremental way. Tests conducted on real data have shown that the framework is effective in both detecting attacks and reacting quickly to concept drifts.

Modern intrusion detection systems must be able to discover new types of attacks in real-time. To this aim, automatic or semi-automatic techniques can be used; outlier detection algorithms are particularly apt to this task, as they can work in an unsupervised way. However, due to the different nature and behavior of the attacks, the performance of different outlier detection algorithms varies largely. In this ongoing work, we describe an approach aimed at understanding whether an ensemble of outlier algorithms can be used to detect effectively new types of attacks in intrusion detection systems. In particular, Genetic Programming (GP) is adopted to build the combining function of an ensemble of local and global outlier detection algorithms, which are used to detect different types of attack. Preliminary experiments, conducted on the well-known NSL-KDD dataset, are encouraging and confirm that, depending on the type of attacks, it would be better to use only local or only global detection algorithms and that the GP-based ensemble improves the performance in comparison with commonly used combining functions.

The problem of discriminating "deviant" traces (i.e. traces diverging from normal/desired outcomes, such as frauds, faults) in the execution log of a business process can be faced by extracting a classification model for the traces, after mapping them onto some suitable feature space. An ensemble-learning approach was recently proposed that trains multiple base learners on different vector-space views of the given log, and a probabilistic meta-model that combines the predictions of the discovered base classifiers. However, the sequential centralised implementation of this learning approach makes it unsuitable for real applications, where large volumes of traces are produced continuously, while both deviant and normal behaviours tend to change over the time. We here propose an online deviance detection framework that leverages a novel incremental learning scheme, which extracts different base models from different chunks of a trace stream, and dynamically combines them in an ensemble model. Notably, the system is based on a p2p architecture that allows it to distribute the entire learning procedure among multiple nodes and to exploit the power of HPC resources (e.g. cloud computing environments). Preliminary tests on a real-life log confirmed the validity of the approach, in terms of both effectiveness and efficiency.

Animal gut microbiota affect host physiology and behaviour. In eusocial Hymenoptera, where colony-level integrity is preserved via a nestmate discrimination system based on cuticular hydrocarbon mixtures, microorganismal effects may influence social dynamics. Although nestmate recognition has undergone a thorough exploration during the last four decades, few studies have investigated the putative role of gut microbes. Here we integrate metagenomic, chemical and behavioural approaches to test whether gut microbes affect nestmate recognition inAcromyrmex echinatiorleaf-cutting ants. Treating workers with a sterile diet or with antibiotics resulted in a substantial alteration of their gut microbial communities. In pairwise social interactions, untreated vs. antibiotic-treated nestmates behaved more aggressively than other nestmate and non-nestmate pairs, suggesting that the suppression of microbes indirectly alters chemical social cues and triggers aggressive behaviour. Chemical analyses on treated individuals revealed a decrease in the abundance of two metapleural gland antifungal compounds, and we confirmed the correspondence between aggression levels and chemical profile differences. Feeding microbiota-remodelled ants with conspecific faecal droplets partially restored the original bacterial communities. Furthermore, non-nestmates fed with faecal droplets from different colonies were unusually aggressive compared to pairs fed with faecal droplets from the same colony. This suggests that chemicals derived from microbial strains may shape nestmate recognition, opening novel questions about the role of microorganisms in the evolution of social behaviour.

In many application contexts, a business process' executions are subject to performance constraints expressed in an aggregated form, usually over predefined time windows, and detecting a likely violation to such a constraint in advance could help undertake corrective measures for preventing it. This paper illustrates a prediction-aware event processing framework that addresses the problem of estimating whether the process instances of a given (unfinished) window w will violate an aggregate performance constraint, based on the continuous learning and application of an ensemble of models, capable each of making and integrating two kinds of predictions: single-instance predictions concerning the ongoing process instances of w, and time-series predictions concerning the "future" process instances of w (i.e. those that have not started yet, but will start by the end of w). Notably, the framework can continuously update the ensemble, fully exploiting the raw event data produced by the process under monitoring, suitably lifted to an adequate level of abstraction. The framework has been validated against historical event data coming from real-life business processes, showing promising results in terms of both accuracy and efficiency.

Current approaches to the security-oriented classification of process log traces can be split into two categories: (i) example-driven methods, that induce a classifier from annotated example traces; (ii) model-driven methods, based on checking the conformance of each test trace to security-breach models defined by experts. These categories are orthogonal and use separate information sources (i.e. annotated traces and a-priori breach models). However, as these sources often coexist in real applications, both kinds of methods could be exploited synergistically. Unfortunately, when the log traces consist of (low-level) events with no reference to the activities of the breach models, combining (i) and (ii) is not straightforward. In this setting, to complement the partial views of insecure process-execution patterns that an example-driven and a model-driven methods capture separately, we devise an abstract classification framework where the predictions provided by these methods separately are combined, according to a meta-classification scheme, into an overall one that benefits from all the background information available. The reasonability of this solution is backed by experiments performed on a case study, showing that the accuracy of the example-driven (resp., model-driven) classifier decreases appreciably when the given example data (resp., breach models) do not describe exhaustively insecure process behaviors.

Business Process Intelligence (BPI) and Process Mining, two very active research areas of research, share a great interest towards the issue of discovering an effective Deviance Detection Model (DDM), computed via accessing log data. The DDM model allows us to understand whether novel instances of the target business process are deviant or not, thus becoming extremely useful in modern application scenarios such as cybersecurity and fraud detection. In this chapter, we further and significantly extend our previous line of work that has originated, across years, an innovative ensemble-learning framework for mining business process deviances, whose main benefit is that of introducing a sort of multi-view learning scheme. One of the most relevant achievements of this extended work consists in proposing an alternative meta-learning method for probabilistically combining the predictions of different base DDMs, and putting all together in a conceptual system architecture oriented to support common Business Process Management (BPM) scenarios. In addition to this, we here envisage the combination of this approach with a deviance explanation methodology that leverages and extends a previous method still proposed by us in previous research. Basically, the latter method allows to discover accurate and readable deviance-aware trace clusters defined in terms of descriptive rules over both properties and behavioral aspects of the traces. We complement our analytical contributions with a comprehensive experimental assessment and analysis, even in comparison with a state-of-the-art DDM discovery approach. The experimental results we derive confirm flexibility, reliability and effectiveness of the proposed business process deviance mining framework.

The discovery of a control-flow model for a process is here faced in a challenging scenario where each trace in the given log \(L_E\) encodes a sequence of low-level events without referring to the process’ activities. To this end, we define a framework for inducing a process model that describes the process’ behavior in terms of both activities and events, in order to effectively support the analysts (who typically would find more convenient to reason at the abstraction level of the activities than at that of low-level events). The proposed framework is based on modeling the generation of \(L_E\) with a suitable Hidden Markov Model (HMM), from which statistics on precedence relationships between the hidden activities that triggered the events reported in \(L_E\) are retrieved. These statistics are passed to the well-known Heuristics Miner algorithm, in order to produce a model of the process at the abstraction level of activities. The process model is eventually augmented with probabilistic information on the mapping between activities and events, encoded in the discovered HMM. The framework is formalized and experimentally validated in the case that activities are “atomic” (i.e., an activity instance triggers a unique event), and several variants and extensions (including the case of “composite” activities) are discussed.

Log analysis and querying recently received a renewed interest from the research community, as the effective understanding of process behavior is crucial for improving business process management. Indeed, currently available log querying tools are not completely satisfactory, especially from the viewpoint of easiness of use. As a matter of fact, there is no framework which meets the requirements of easiness of use, flexibility and efficiency of query evaluation. In this paper, we propose a framework for graphical querying of (process) log data that makes the log analysis task quite easy and efficient, adopting a very general model of process log data which guarantees a high level of flexibility. We implemented our framework by using a flexible storage architecture and a user-friendly data analysis interface, based on an intuitive and yet expressive graph-based query language. Moreover, we exploit our results as a basis for a better and dynamic definition of process cube structures. Experiments performed on real data confirm the validity of the approach.

Intrusion detection systems (IDS) support the recognition of attacks, based on the analysis of data coming from either network data (Network-based IDS) or, in alternative, from logs stored in a host (Host-based IDS). Exploiting heterogeneous data coming from both kinds of sources could be useful to detect coordinated attacks and to reduce the number of false alarms, but poses challenges in terms of both information integration and scalability. In order to foster the development of such a hybrid IDS, we here propose a p2p intrusion detection architecture, which combines different data manipulation/mining techniques and a collaborative ensemble-based learning approach, and al- lows to incrementally classify attacks by integrating information extracted from both network-traffic data and host logs. Preliminary experiments, conducted on real-life dataset, show that the approach is promising.

Increasing attention has been paid to the problem of explaining and analyzing "deviant cases" generated by a business process, i.e. instances of the process that diverged from prescribed/expected behavior (e.g. frauds, faults, SLA violations). In many real settings, such cases are labelled with a numerical deviance measure, and the analyst wants to obtain a fine grain unsupervised classification of them, which will help her recognize and explain different deviance scenarios. Unfortunately, current approaches rely on preliminary labelling all the cases, stored in some an execution log, as either deviant or non-deviant, and then inducing a rule-based classifier for discriminating among the two classes. By contrast, we here propose a method that discovers accurate and readable deviance- aware clusters (of cases) defined in terms of descriptive rules over both properties and behavioral aspects of the cases. Each cluster is also equipped with summary information that allows to derive effective distribution charts and a high-level process map, both emphasizing the distinctive features of the cluster. Tests on a real-life log confirmed the ability of the approach to find easily-interpretable clustering models capturing relevant deviance scenarios.

Despite performance-oriented process mining techniques have been successfully applied in numerous application contexts, when applied to processes featuring complex and heterogeneous behaviors, they hardly produce models with a satisfactory level of accuracy, generality, and readability. In particular, the presence of deviant (i.e. anomalous/exceptional) traces often lead to cumbersome models with misleading performance statistics. Noise/outlier filtering solutions allows to alleviate this problem, and to discover a better model for "normal" executions, but do not provide insight on the nature and impact of deviant ones. The process discovery approach proposed here tries to recognize and describe both a normal execution scenario and a number of deviant ones for the analyzed log, by inducing two different kinds of models: (i) a list of readable clustering rules defining the deviance scenarios; (ii) a performance model for each discovered deviance scenario, and a "distilled" one for the "nor- mal" cases that do not fall in any deviant scenario. Technically, these models are discovered by mainly exploiting a conceptual clustering method, that greedily tries to separate groups of traces that maximally deviate from the current normality model. Tests on real-life logs confirmed the validity of the approach, and its ability to both find good performance models and support the analysis of deviant process instances.

The problem of discovering an effective Deviance Detection Model (DDM) out of log data, has been attracting increasing attention in recent years in the very active research areas of Business Process Intelligence (BPI) and of Process Mining. Such a model can be used to assess whether novel instances of the business process are deviant or not, which is a hot topic in many application scenarios such as cybersecurity and fraud detection. This paper extends a previous proposal where an innovative ensemble-learning framework for mining business process deviances was introduced, hinging on multi-view learning scheme. Specifically, we introduce here an alternative meta-learning method for probabilistically combining the predictions of different base DDMs. The entire learning method is embedded into a conceptual system architecture that is meant to support the detection and analysis of deviances in a Business Process Management scenario. We also discuss a wide and comprehensive experimental analysis of the proposed approach and of a state-of-the-art DDM discovery solution. The experimental findings confirm the flexibility, reliability and effectiveness of the proposed deviance detection approach, and the improvement gained over its previous version.

Process mining methods have been proven effective in turning historical log data into actionable process knowledge. However, most of them work under the assumption that the events reported in the logs can be easily mapped to well-defined process activities, that are the terms in which analysts are used to reason on the processes’ behaviors. We here consider the challenging scenario where this assumption does not hold: the log traces are sequences of low-level operations with no explicit reference to the corresponding high-level process activities. In this setting, we face the fundamental problem of bringing the log traces to the abstraction level of the analyst’s perspective. Formally, given a trace Φ, and on the basis of a high-level behavioral description of the processes, we search for every possible interpretation⟨σ, W⟩ of Φ, where σ is a sequence of high-level activities whose execution may have generated the sequence of low-level operations Φ, and, in turn, W is a process that may have triggered the execution of σ. We address this problem probabilistically, and propose a framework that builds a compact representation of Φ’s interpretations, each associated with a probability score. This probability measures how likely the associated interpretation is the correct one, and it is evaluated adopting a revision paradigm guided by the background knowledge provided by the processes’ models. Notably, our approach can deal with “complex” activities (i.e., each generating a sequence of low-level operations, rather than a single one), and with the case that the traces encode process instances exhibiting some deviation from the expected behaviors encoded in the process models.

The increasing availability of large process log repositories calls for efficient solutions for their analysis. In this regard, a novel specialized compression technique for process logs is proposed, that builds a synopsis supporting a fast estimation of aggregate queries, which are of crucial importance in exploratory and high-level analysis tasks. The synopsis is constructed by progressively merging the original log-tuples, which represent single activity executions within the process instances, into aggregate tuples, summarizing sets of activity executions. The compression strategy is guided by a heuristic aiming at limiting the loss of information caused by summarization, while guaranteeing that no information is lost on the set of activities performed within the process instances and on the order among their executions. The selection conditions in an aggregate query are specified in terms of a graph pattern, that allows precedence relationships over activity executions to be expressed, along with conditions on their starting times, durations, and executors. The efficacy of the compression technique, in terms of capability of reducing the size of the log and of accuracy of the estimates retrieved from the synopsis, has been experimentally validated.

We consider the scenario where the executions of different business processes are traced into a log, where each trace describes a process instance as a sequence of low-level events representing basic kinds of operations. In this context, we address a novel problem: given a description of the processes' behaviors in terms of high-level activities instead of low-level events, and in the presence of uncertainty in the mapping between events and activities, find all the interpretations of each trace $$\Phi $$. Specifically, an interpretation is a pair $$\langle \sigma , W \rangle $$ that provides a two-level "explanation" for $$\Phi $$: $$\sigma $$ is a sequence of activities that may have triggered the events in $$\Phi $$, and W is a process whose model admits $$\sigma $$. To solve this problem, we propose a probabilistic framework representing "consistent" $$\Phi $$'s interpretations, where each interpretation is associated with a probability score.

The issue of devising efficient and effective solutions for supporting the analysis of process logs has recently received great attention from the research community, as effectively accomplishing any business process management task requires understanding the behavior of the processes. In this paper, we propose a new framework supporting the analysis of process logs, exhibiting two main features: a flexible data model (enabling an exhaustive representation of the facets of the business processes that are typically of interest for the analysis) and a graphical query language, providing a user-friendly tool for easily expressing both selection and aggregate queries over the business processes and the activities they are composed of. The framework can be easily and efficiently implemented by leveraging either “traditional” relational DBMSs or “innovative” NoSQL DBMSs, such as Neo4J.

Modeling behavioral aspects of business processes is a hard and costly task, which usually requires heavy intervention of business experts. This explains the increasing attention given to process mining techniques, which automatically extract behavioral process models from log data. In the case of complex processes, however, the models identified by classical process mining techniques are hardly useful to analyze business operations at a suitable abstraction level. In fact, the need of process abstraction emerged in several application scenarios, and abstraction methods are already supported in some business-management platforms, which allow users to manually define abstract views for the process at hand. Therefore, it comes with no surprise that process mining research recently considered the issue of mining processes at different abstraction levels, mainly in the form of a taxonomy of process models, as to overcome the drawbacks of traditional approaches. This paper presents a general framework for the discovery of such a taxonomy, and offers a survey of different kinds of basic techniques that can be exploited to this purpose: (1) workflow modeling and discovery techniques, (2) clustering techniques enabling the discovery of different behavioral process classes, and (3) activity abstraction techniques for associating a generalized process model with each higher level taxonomy node. © 2013 Wiley Periodicals, Inc.

Social insect sex and caste ratios are well-studied targets of evolutionary conflicts, but the heritable factors affecting these traits remain unknown. To elucidate these factors, we carried out a short-term artificial selection study on female caste ratio in the ant Monomorium pharaonis. Across three generations of bidirectional selection, we observed no response for caste ratio, but sex ratios rapidly became more female-biased in the two replicate high selection lines and less female-biased in the two replicate low selection lines. We hypothesized that this rapid divergence for sex ratio was caused by changes in the frequency of infection by the heritable bacterial endosymbiont Wolbachia, because the initial breeding stock varied for Wolbachia infection, and Wolbachia is known to cause female-biased sex ratios in other insects. Consistent with this hypothesis, the proportions of Wolbachia-infected colonies in the selection lines changed rapidly, mirroring the sex ratio changes. Moreover, the estimated effect of Wolbachia on sex ratio (~13% female bias) was similar in colonies before and during artificial selection, indicating that this Wolbachia effect is likely independent of the effects of artificial selection on other heritable factors. Our study provides evidence for the first case of endosymbiont sex ratio manipulation in a social insect. This article is protected by copyright. All rights reserved.