# Network Traffic Analysis with Process Mining: The UPSIDE Case Study

arXiv: https://arxiv.org/abs/2512.23718 · HTML: https://mlsanity.com/paper/2512.23718/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 29 references that are in the map.
- First posted on arXiv 10 Dec 2025.

## Builds on (most cited first, 3 of 3)

- [Control-flow anomaly detection by process mining-based feature extraction and dimensionality reduction](https://mlsanity.com/paper/2502.10211/) (2025)
- [Cloud-gaming:Analysis of Google Stadia traffic](https://mlsanity.com/paper/2009.09786/) (2020)
- [Can process mining help in anomaly-based intrusion detection?](https://mlsanity.com/paper/2206.10379/) (2022)

## Built on by (most cited first, 2 of 2)

- [Enhancing Anomaly-Based Intrusion Detection Systems with Process Mining](https://mlsanity.com/paper/2604.18066/) (2026)
- [Dynamic Risk Assessment by Bayesian Attack Graphs and Process Mining](https://mlsanity.com/paper/2604.18080/) (2026)

## Abstract (arXiv)

Online gaming is a popular activity involving the adoption of complex systems and network infrastructures. The relevance of gaming, which generates large amounts of market revenue, drove research in modeling network devices' behavior to evaluate bandwidth consumption, predict and sustain high loads, and detect malicious activity. In this context, process mining appears promising due to its ability to combine data-driven analyses with model-based insights. In this paper, we propose a process mining-based method that analyzes gaming network traffic, allowing: unsupervised characterization of different states from gaming network data; encoding such states through process mining into interpretable Petri nets; and classification of gaming network traffic data to identify different video games being played. We apply the method to the UPSIDE case study, involving gaming network data of several devices interacting with two video games: Clash Royale and Rocket League. Results demonstrate that the gaming network behavior can be effectively and interpretably modeled through states represented as Petri nets with sufficient coherence and specificity while maintaining a good classification accuracy of the two different video games.