Recognizing event patterns from event streams

• US 20060265406A1
• Filed: 05/20/2005
• Published: 11/23/2006
• Est. Priority Date: 05/20/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mital, Vijay, Chkodrov, Gueorgui B.
• Granted Patent: US 7,627,544 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions

Abstract

System and method for identifying a pattern. A method of the invention compiles a pattern description where the pattern description defines a series of a first event and a second event relating to the first event. The first event is received and includes a type parameter data, a time parameter data, and a substance parameter data. A system of the invention includes a script component for associating or attaching a first script to the first event. The first script defines the type, time, and substance parameters of the second event as a function of the parameters of the first event according to the pattern description. A pattern recognition engine executes the attached first script and the executed script identifies the second event and thereby identifies the pattern.

Claims

1. A method for identifying a pattern, said method comprising:

compiling a pattern description, said pattern description defining a series of a first event and a second event relating to the first event;

receiving the first event, said first event including a type parameter data, a time parameter data, and a substance parameter data;

attaching a first script to the first event, said first script defining type, time and substance parameters of the second event as a function of the parameters of the first event according to the pattern description; and

executing the attached first script of the first event, said executed script identifying the second event and thereby identifying the pattern.

2. The method of claim 1 wherein executing comprises correlating parameters in the second event to the first event to determine if the second event belongs to the defined series according to the pattern description.

3. The method of claim 1 wherein executing comprises outputting the parameter data of the first event and data relating to the identified pattern to a computing environment for analysis of the parameter data and the data relating to the identified pattern.

4. The method of claim 1 wherein attaching the first script to the first event comprises defining type, time, and substance parameters of the second event by comparing the related type, time, and substance parameters of the second event to the type, time, and substance parameters of the first event.

5. The method of claim 1 further comprising storing the identified pattern in a data structure for analysis.

6. The method of claim 1 further comprising creating a copy of the defined series in response to the compiled pattern description and the attached script to the first events when one or more of the parameter data of the first event relate to one or more parameter data of the second event or additional events in the series according to the compiled pattern description.

7. The method of claim 1 wherein said pattern description defining the series of the first event, the second event and a third event relating to the first and the second event, and wherein attaching comprises attaching a second script to the second event, said second script defining type, time and substance parameters of the third event as a function of the parameters of the second event according to the pattern description and wherein executing comprises executing the attached second script of the second event, said executed script identifying the third event and thereby identifying the pattern.

8. The method of claim 1 wherein one or more computer-readable media have computer-executable instructions for performing the method recited in claim 1.

9. One or more computer-readable media having computer-executable components for identifying event patterns, said computer-executable components comprising:

a pattern compiling component for compiling a plurality of pattern descriptions, said each of the pattern descriptions defining a series of events in a sequence;

an event component for collecting a plurality of events, said each of the plurality of events having data parameters relating to each of the plurality of events;

a script component for associating a script to each of the plurality of events, said script defining data parameters of a subsequent event in the series of each of the plurality of events according to the pattern description of each of the plurality of events;

a pattern recognition engine for executing the script of each of the plurality of events to identify the subsequent event in the series and thereby identify the pattern.

10. The computer-readable media of claim 9 wherein the pattern description includes one or more of the following parts:

pattern name, event reference, event filtering, event sequence, event timeout expectations, event correlation, and output results.

11. The computer-readable media of claim 9 wherein the pattern recognition engine correlates data parameters in the second event to the first event to determine if the second event belongs to the defined series according to the pattern description defined by the pattern compiler.

12. The computer-readable media of claim 9 further comprising a host environment for managing the pattern recognition engine, said host environment includes at least one of the following:

an in-memory host environment, a file-based host environment, and a SQL-based host environment.

13. The computer-readable media of claim 12 wherein the pattern recognition engine outputs the parameter data of each of the plurality of events and data relating to the identified pattern to the host environment for further processing of the parameter data and data relating to the identified pattern.

14. The computer-readable media of claim 12 wherein the SQL-based host environment stores parameter data of each of the plurality of events and data relating to the identified pattern outputted by the pattern recognition engine in a database and receives a query from a user for retrieving the stored data in the database.

15. The computer-readable media of claim 9 wherein the pattern recognition engine further creates a copy of the defined series in response to the pattern description compiled by the pattern compiling component and the script attached by the script component to the events in the defined series when one or more of the parameter data of the event relate to one or more parameter data of additional events in the defined series.

16. A system for identifying a pattern in a plurality of events, said system comprising:

a plurality of collecting computers for collecting related events as a series of pattern events;

a first set of computers for identifying a first portion of the pattern in each collected series, wherein each of the collected series matches the first portion of the series of pattern events;

a second set of computers for identifying a second portion of the pattern in each series in which the first portion of the pattern has been identified by the first set; and

wherein the first portion of the pattern and the second portion of the pattern match the series of pattern events and wherein each series of events including the first and second portions of the pattern is accumulated and stored for evaluation.

17. The system of claim 16 further comprising an interface for receiving a query from a user for retrieving accumulated and stored pattern in response to the query.

18. The system of claim 16 wherein the first set of computers and the second set of computers include pattern recognition engines for correlating the identified first portion of the pattern and the identified second portion of the pattern.

19. The system of claim 16 wherein the first set of computers and the second set of computers store a plurality of pattern descriptions, each of the plurality of pattern descriptions corresponds to each of the series of pattern events.

20. The system of claim 16 wherein the second set of computer servers creates a copy of each of the collected series in response to a pattern description and an attached script to the events collected in the series when one or more of the parameter data of the events identified in the first portion of the series by the first set of computer servers relate to one or more parameter data of the events identified in the second portion of the series by the second set of computer servers.