系統流程與資料庫設計之一致性分析

The Conformance Analysis for System Process and Database Design

李智琦(CHIH-CHI LI)

指導教授 ： 李興漢

大同大學/經營設計學院/資訊經營學系所/碩士(2012年)

摘要

資訊技術的不斷演進，使得越來越多企業開始使用具有高度整合性的資訊系統，同時對於商業流程的工作流程技術給予相當的重視，由於系統分析與設計階段，資料庫扮演極重要的角色，資料庫設計不良將會導致與企業流程不相符，亦演變成資訊安全方面的問題或事件。而近年來，企業電腦舞弊犯罪案件層出不窮，目前針對資訊安全事件的處理，偏重於事後稽核，但往往卻已喪失先機，所以若能及早發現問題，提供企業在控管上的評估，就可降低潛在的風險。有鑑於此，本研究提出資料存取稽核規則，以關聯式資料庫為基礎，針對現有資料庫綱要、資料庫指令碼進行分析，從資料庫綱要中的資料表如主鍵、外來鍵、空值、弱實體關係、參考完整性限制與基數限制，資料庫指令碼中的觸發程序與預存程序，配合流程與資料提出資料存取稽核規則。以資料存取稽核規則為根本，建立資料庫流程稽核機制，此機制將企業資料庫存取流程與企業標準流程透過事件驅動程序鏈將流程萃取出之資料存取流程做差異比對後，探討企業資料庫設計架構，是否符合企業標準流程，達到事前預防、事後稽核之成效，提供企業在資訊安全上的改善方向。

關鍵字

系統分析與設計 ； 工作流程探勘 ； 事件驅動程序鏈 ； 關聯式資料庫

並列摘要

This Information technology is growing nowadys, there are more and more companies start using a highly integrated information systems, Also, they put emphasize on business workflow technology. Database plays a very important role in the stage of system analysis and design.The poor database would not consistent with the business process. Moreover, it would cause information security issues.Recent years, there are more and more computer fraud criminal cases; however, we are focus on the post-audit, Post-audit are often already the loss of opportunities. In the conclustion, if we can detect the problem early and provide assessment of the enterprises on the control, company would reduce the potential risks.For this reason, the study proposes Data Access Audit Rule, and use Relational Database as the base to analyze the existing Schema and Programming. We will use PK, FK, Null, Weak Entity, Integrity Constraints, Cardinality, Trigger and Stored Procedure to follow the procedure and Data Access Audit Rule.By using Data Access Audit Rule to build up the mechanism, we would make comparison between corporation data access processes and data comes from EPC which extract from corporation’s standard operation procedure. After the comparison, we can make the conclusion to the structure of enterprise database design, and see if they are match the standard operation procedure. In the conclusion, we can provide the improvement for information security and achieve the Pre-Audit and Post-Audit.

並列關鍵字

Relational Database ； System Analysis and Design ； Event-driven process chain ； Workflow Mining

參考文獻

5. D. Hollingsworth. (1994). WFMC TC00-1003 Workflow Management Coalition The Workflow Reference Model. Retrieved from

8. J.E. Cook, A.L. Wolf. (1999). Software process validation: Quantitatively measuring the correspondence of a process to a model. ACM Transactions on Software Engineering and Methodology, 8 (2):147–176.

9. J. E. Cook, and A. L. Wolf. (1998) . Discovering Models of Software Processes from Event-based Data. ACM Transactions on Software Engineering and Methodology, Vol. 7, No. 3, 215-249.

10. J. E. Cook, and A. L. Wolf. (1998). Event-Based Detection of Concurrency. ACM SIGSOFT Software Engineering Notes, Vol. 23,35-45.

11. L. Maruster, A. J. M. M. Weijters, W. M. P. van der Aalst, and A. van den Bosch. (2002). Process Mining：Discovering Direct Successors in Process Logs. Proceedings of International Conference on Discovery Science.