EVENT-PROCESSING OPERATORS
First Claim
Patent Images
1. A method comprising:
- receiving a stream of events;
for each event in the received stream of events, determining whether the event is associated with one of a plurality of event clusters;
for each event determined to not be associated with any of the plurality of event clusters, placing an alert event into an output stream; and
periodically redefining the plurality of event clusters based on a subset of the events in the received stream of events.
1 Assignment
0 Petitions
Accused Products
Abstract
Novel event-processing operators are provided. These novel operators can be advantageously utilized in implementing event processors and event-processing systems. The novel event-processing operators include operators for event filtering by clustering, operators for event partitioning by classification, operators for event abstraction by hypothesis testing, and operators for event filtering by point estimation.
-
Citations
21 Claims
-
1. A method comprising:
-
receiving a stream of events; for each event in the received stream of events, determining whether the event is associated with one of a plurality of event clusters; for each event determined to not be associated with any of the plurality of event clusters, placing an alert event into an output stream; and periodically redefining the plurality of event clusters based on a subset of the events in the received stream of events. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A method comprising:
-
receiving a first stream of events; for each event in the received stream of events, determining whether the event has a probability equal to or greater than a predetermined threshold of being associated with one of a plurality of classifications in accordance with a generalized linear model comprising a predetermined distribution function, a linear predictor, and a predetermined link function; for each event determined to have a probability equal to or greater than the predetermined threshold of being associated with one of the plurality of classifications, placing the event in an output stream along with a mark indicating the associated classification; for each event determined to not have a probability equal to or greater than the predetermined threshold of being associated with one of the plurality of classifications, placing the event in an output stream along with a mark indicating that the event is not associated with one of the plurality of classifications; receiving a second stream of events, each event in the second stream being marked as being associated with one of the plurality of classifications; and based on events in the second stream, estimating unknown parameters in the linear predictor. - View Dependent Claims (8, 9, 10)
-
-
11. A method comprising:
-
receiving a stream of events; identifying a subset of events in the received stream; determining whether the subset of events fails a hypothesis about a statistical distribution of events in the received stream; placing an alert event into an output stream when the subset of events fails the hypothesis. - View Dependent Claims (12, 13, 14, 15, 16)
-
-
17. A method comprising:
-
receiving a stream of events; for each event in the received stream of events, evaluating a predicate comprising predetermined parameters; for each event for which the predicate evaluates to true, placing an alert event into an output stream; and estimating values for the predetermined parameters based on a subset of the events in the received stream. - View Dependent Claims (18, 19, 20, 21)
-
Specification