{"id":"https://openalex.org/W7131283333","doi":"https://doi.org/10.18420/modellierung2026-11","title":"Control-flow Reconstruction Attacks on Business Process Models \u2013 (Extended Abstract)","display_name":"Control-flow Reconstruction Attacks on Business Process Models \u2013 (Extended Abstract)","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7131283333","doi":"https://doi.org/10.18420/modellierung2026-11"},"language":"en","primary_location":{"id":"pmh:doi:10.18420/modellierung2026-11","is_oa":false,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Text/Conference Abstract"},"type":"other","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.18420/modellierung2026-11","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114387461","display_name":"Henrik Kirchmann","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kirchmann, Henrik","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5061175797","display_name":"Stephan A. Fahrenkrog-Petersen","orcid":"https://orcid.org/0000-0002-1863-8390"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fahrenkrog-Petersen, Stephan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038174766","display_name":"Felix Mannhardt","orcid":"https://orcid.org/0000-0003-1733-777X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mannhardt, Felix","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5070529144","display_name":"Matthias Weidlich","orcid":"https://orcid.org/0000-0003-3325-7227"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Weidlich, Matthias","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10703","display_name":"Business Process Modeling and Analysis","score":0.968500018119812,"subfield":{"id":"https://openalex.org/subfields/1404","display_name":"Management Information Systems"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T10703","display_name":"Business Process Modeling and Analysis","score":0.968500018119812,"subfield":{"id":"https://openalex.org/subfields/1404","display_name":"Management Information Systems"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.004900000058114529,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.0019000000320374966,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.7063000202178955},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.6937999725341797},{"id":"https://openalex.org/keywords/business-process","display_name":"Business process","score":0.6184999942779541},{"id":"https://openalex.org/keywords/process-mining","display_name":"Process mining","score":0.5893999934196472},{"id":"https://openalex.org/keywords/business-process-management","display_name":"Business process management","score":0.5874999761581421},{"id":"https://openalex.org/keywords/trace","display_name":"TRACE (psycholinguistics)","score":0.573199987411499},{"id":"https://openalex.org/keywords/tree-traversal","display_name":"Tree traversal","score":0.5633999705314636},{"id":"https://openalex.org/keywords/process-modeling","display_name":"Process modeling","score":0.539900004863739},{"id":"https://openalex.org/keywords/confidentiality","display_name":"Confidentiality","score":0.5063999891281128}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7408999800682068},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.7063000202178955},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.6937999725341797},{"id":"https://openalex.org/C85345410","wikidata":"https://www.wikidata.org/wiki/Q851587","display_name":"Business process","level":3,"score":0.6184999942779541},{"id":"https://openalex.org/C124670913","wikidata":"https://www.wikidata.org/wiki/Q2608526","display_name":"Process mining","level":5,"score":0.5893999934196472},{"id":"https://openalex.org/C80309976","wikidata":"https://www.wikidata.org/wiki/Q7007379","display_name":"Business process management","level":4,"score":0.5874999761581421},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.573199987411499},{"id":"https://openalex.org/C140745168","wikidata":"https://www.wikidata.org/wiki/Q1210082","display_name":"Tree traversal","level":2,"score":0.5633999705314636},{"id":"https://openalex.org/C76956256","wikidata":"https://www.wikidata.org/wiki/Q27610560","display_name":"Process modeling","level":3,"score":0.539900004863739},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.5063999891281128},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.4961000084877014},{"id":"https://openalex.org/C207505557","wikidata":"https://www.wikidata.org/wiki/Q4374012","display_name":"Business process modeling","level":4,"score":0.4530999958515167},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.4383000135421753},{"id":"https://openalex.org/C93453677","wikidata":"https://www.wikidata.org/wiki/Q1017580","display_name":"Business process discovery","level":5,"score":0.4174000024795532},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4000000059604645},{"id":"https://openalex.org/C2775853353","wikidata":"https://www.wikidata.org/wiki/Q5416724","display_name":"Event reconstruction","level":3,"score":0.37860000133514404},{"id":"https://openalex.org/C174998907","wikidata":"https://www.wikidata.org/wiki/Q357662","display_name":"Work in process","level":2,"score":0.3314000070095062},{"id":"https://openalex.org/C114289077","wikidata":"https://www.wikidata.org/wiki/Q3284399","display_name":"Statistical model","level":2,"score":0.30550000071525574},{"id":"https://openalex.org/C179299601","wikidata":"https://www.wikidata.org/wiki/Q1017605","display_name":"Business Process Model and Notation","level":5,"score":0.2930000126361847},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.2921999990940094},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.289900004863739},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.289000004529953},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.28029999136924744},{"id":"https://openalex.org/C2775948798","wikidata":"https://www.wikidata.org/wiki/Q5160261","display_name":"Conformance checking","level":5,"score":0.2800999879837036},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2797999978065491},{"id":"https://openalex.org/C65898831","wikidata":"https://www.wikidata.org/wiki/Q574852","display_name":"Event tree","level":3,"score":0.27880001068115234},{"id":"https://openalex.org/C162754035","wikidata":"https://www.wikidata.org/wiki/Q17006331","display_name":"Artifact-centric business process model","level":5,"score":0.2603999972343445},{"id":"https://openalex.org/C166052673","wikidata":"https://www.wikidata.org/wiki/Q83021","display_name":"Empirical evidence","level":2,"score":0.257099986076355},{"id":"https://openalex.org/C2778791037","wikidata":"https://www.wikidata.org/wiki/Q673661","display_name":"Abstract process","level":3,"score":0.25529998540878296},{"id":"https://openalex.org/C179800331","wikidata":"https://www.wikidata.org/wiki/Q15260703","display_name":"Event tree analysis","level":3,"score":0.2551000118255615}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:doi:10.18420/modellierung2026-11","is_oa":false,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Text/Conference Abstract"},{"id":"doi:10.18420/modellierung2026-11","is_oa":true,"landing_page_url":"https://doi.org/10.18420/modellierung2026-11","pdf_url":null,"source":{"id":"https://openalex.org/S7407052918","display_name":"Gesellschaft f\u00fcr Informatik (GI)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article-journal"}],"best_oa_location":{"id":"doi:10.18420/modellierung2026-11","is_oa":true,"landing_page_url":"https://doi.org/10.18420/modellierung2026-11","pdf_url":null,"source":{"id":"https://openalex.org/S7407052918","display_name":"Gesellschaft f\u00fcr Informatik (GI)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Organizations":[0],"increasingly":[1],"share":[2],"process":[3,14,68,81,84,153,160],"models":[4,17,46,139],"discovered":[5],"from":[6,83,96],"event":[7,125,132,164],"logs":[8],"to":[9,29,79,100],"support":[10],"transparency,":[11],"benchmarking,":[12],"and":[13,127],"improvement.":[15],"These":[16],"often":[18],"generalize":[19],"observed":[20],"behavior":[21],"but":[22],"may":[23,166],"include":[24],"execution":[25],"frequencies":[26],"or":[27,148],"probabilities":[28],"enhance":[30],"interpretability.":[31],"While":[32],"this":[33],"practice":[34],"is":[35],"common,":[36],"it":[37],"raises":[38],"an":[39],"important":[40],"question:":[41],"can":[42,113],"publishing":[43,159],"such":[44,121],"enriched":[45],"unintentionally":[47],"reveal":[48,136],"confidential":[49],"information":[50],"about":[51],"the":[52,58,115,131],"underlying":[53],"processes?":[54],"This":[55],"paper":[56],"presents":[57],"first":[59],"empirical":[60],"study":[61],"of":[62,130,140,152],"control-flow":[63,117],"reconstruction":[64,72,91,151],"attacks":[65,73],"on":[66,119],"business":[67],"models.":[69],"We":[70],"define":[71],"as":[74,122],"\"play-out\"":[75],"strategies":[76,92,112],"that":[77,137,158],"attempt":[78],"regenerate":[80],"executions":[82],"trees,":[85],"potentially":[86],"exploiting":[87],"frequency":[88],"annotations.":[89],"Several":[90],"are":[93,143],"proposed,":[94],"ranging":[95],"uniform":[97],"random":[98],"traversal":[99],"frequency-informed":[101],"probabilistic":[102],"approaches.":[103],"Using":[104],"real-world":[105],"datasets,":[106],"we":[107],"evaluate":[108],"how":[109],"accurately":[110],"these":[111],"reproduce":[114],"original":[116],"based":[118],"measures":[120],"trace":[123],"similarity,":[124],"dependencies,":[126],"statistical":[128],"characteristics":[129],"log.":[133],"Our":[134],"findings":[135],"frequency-annotated":[138],"structured":[141],"processes":[142],"particularly":[144],"vulnerable,":[145],"enabling":[146],"partial":[147],"even":[149,162],"full":[150],"behavior.":[154],"The":[155],"results":[156],"highlight":[157],"models,":[161],"without":[163],"logs,":[165],"pose":[167],"significant":[168],"confidentiality":[169],"risks.":[170]},"counts_by_year":[],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2026-02-25T00:00:00"}