This extended paper presents 1) a novel hierarchy and recursion extension to the process tree model; and 2) the first, recursion aware process model discovery technique that leverages hierarchical information in event logs, typically available for software systems. This technique allows us to analyze the operational processes of software systems under real-life conditions at multiple levels of granularity. The work can be positioned in-between reverse engineering and process mining. An implementation of the proposed approach is available as a ProM plugin. Experimental results based on real-life (software) event logs demonstrate the feasibility and usefulness of the approach and show the huge potential to speed up discovery by exploiting the available hierarchy.
 Process discovery algorithms typically aim at discovering process models from event logs that best describe the recorded behavior. Often, the quality of a process discovery algorithm is measured by quantifying to what extent the resulting model can reproduce the behavior in the log, i.e. replay fitness. At the same time, there are many other metrics that compare a model with recorded behavior in terms of the precision of the model and the extent to which the model generalizes the behavior in the log. Furthermore, several metrics exist to measure the complexity of a model irrespective of the log. This paper presents an approach for recovering application-level views of the interaction behaviors between systems that communicate via networks. Rather than illustrating a single behavior, a sequence diagram is constructed that describes the characteristics of multiple combined behaviors. The approach has several properties that make it particularly suitable for analyzing heterogeneous systems. First, since the interactions are retrieved from observing the network communication, our technique can be applied to systems that are implemented in different languages and run on different platforms. Second, it does not require the availability or modification of source code. After the behaviors are extracted, we employ methods to merge multiple observed behaviors to a single sequence diagram that illustrates the overall behavior.The contributions of this paper are a technique for observing and processing the network communication to derive a model of the behavior. Furthermore, it describes a series of model transformations to construct a sequence diagram view of all observed behaviors.