Apparatus for and Method of Generating Complex Event Processing System Rules

• US 20090210364A1
• Filed: 02/20/2008
• Published: 08/20/2009
• Est. Priority Date: 02/20/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: YOM-TOV, Elad, ADI, Asaf
• Granted Patent: US 8,078,556 B2
• Time in Patent Office: Days
• US Class Current: 706/12
• CPC Class Codes: G06N 5/025 Extracting rules from data

Abstract

A novel and useful mechanism enabling a standard learning algorithm to generate rules for complex event processing (CEP) systems. The method creates rules that infer previously defined output events by creating input event feature vectors for each targeted output event. In addition, a method for automatically generating CEP system rules to infer output events which are anomalies (i.e. statistical outliers) of input event sequences is disclosed. Input feature vectors consisting of multiple input events and parameters for each targeted output event are then input into a standard learning algorithm to generate CEP system rules.

Claims

1. A method of creating an input event feature vector for use as input to a standard learning algorithm, said method comprising the steps of:

defining the characteristics of said input event feature vector;

gathering a plurality of input events;

populating individual vector elements of said input event feature vector based on a subset of said plurality of input events; and

constructing said input event feature vector from said individual vector elements.

2. The method according to claim 1, wherein said step of defining the characteristics of said input event feature vector further comprises the steps of:

identifying a plurality of input event fields to be measured;

establishing a metric by which to measure each said input event field;

defining a maximal window for each said metric; and

defining a minimal resolution of each said metric.

3. The method according to claim 1, wherein said individual input event feature vector elements further comprise:

parameters of said defined subset; and

a count of said input events within said defined subset.

4. The method according to claim 3, wherein said parameters of said defined subset of said plurality of input events comprise a combination of said identified fields within each said identified field'"'"'s said respective resolutions, up to each said identified field'"'"'s said maximal window.

5. A method of generating one or more complex event processing system (CEP) rules for inferring a previously identified output event based on a plurality of input events, said method comprising the steps of:

creating an output event feature vector for observed instances of said previously defined output events;

generating an input event feature vector for each observed instance of said previously defined output event; and

executing a standard classification algorithm using said output event feature vector and said input event feature vectors as inputs, thereby extracting one or more CEP rules incorporating one or more said input events and their associated parameters.

6. The method according to claim 5, wherein said output event feature vector comprises a plurality of vector elements further comprising:

an output event;

zero or more parameters of said output event; and

time window of said output event;

7. The method according to claim 5, wherein said step of generating an input event feature vector comprises the steps of:

identifying a plurality input event fields to be measured;

establishing a metric by which to measure each said input event field;

defining a maximal window for each said metric; and

defining a minimal resolution of each said metric.

8. The method according to claim 5 wherein said individual input event feature vector elements further comprise:

parameters of said defined subset; and

a count of said input events within said defined subset.

9. The method according to claim 8, wherein said parameters of said defined subset of said plurality of input events comprise a combination of said identified fields within each said identified field'"'"'s said respective resolutions, up to each said identified field'"'"'s said maximal window.

10. A method of establishing complex event processing system (CEP) rules for detecting input event anomalies, said method comprising the steps of:

defining a time window and time resolution for collecting a plurality of input events;

creating an input event feature vector for each said time resolution; and

executing a standard anomaly detection algorithm using a plurality of said input event feature vectors as inputs, thereby extracting one or more complex event processing system rules for detection of anomaly input events.

11. The method according to claim 10, wherein said step of generating an input event feature vector comprises the steps of:

identifying a plurality input event fields to be measured;

establishing a metric by which to measure each said input event field;

defining a maximal window for each said metric; and

defining a minimal resolution of each said metric.

12. The method according to claim 10, wherein said individual input event feature vector elements further comprise:

parameters of said defined subset; and

a count of said input events within said defined subset.

13. The method according to claim 12, wherein said parameters of said defined subset of said plurality of input events comprise a combination of said identified fields within each said identified field'"'"'s said respective resolutions, up to each said identified field'"'"'s said maximal window.

14. A computer program comprising:

a computer usable medium having computer usable program code for establishing complex event processing system rules from streams of input and output events, said method comprising the steps of;

computer usable program code for creating an output event feature vector;

computer usable program code for generating an input event feature vector for each element of said output event feature vector; and

computer usable program code for executing a standard learning algorithm using said of output event feature vector and said input event feature vectors as inputs, thereby extracting one or more complex event system processing rules.

15. The method of claim 14, wherein said standard learning algorithm comprises a classification algorithm for creating one or complex event processing system rules to infer a previously defined output event.

16. The method of claim 14, wherein said standard learning algorithm comprises an anomaly detection algorithm for creating one or complex event processing system rules to infer input event anomalies.

17. The method according to claim 14, wherein said output event feature vector comprises a plurality of vector elements further comprising:

an output event;

zero or more parameters of said output event; and

time window of said output event;

18. The method according to claim 14, wherein said step of generating an input event feature vector comprises the steps of:

identifying a plurality input event fields to be measured;

establishing a metric by which to measure each said input event field;

defining a maximal window for each said metric; and

defining a minimal resolution of each said metric.

19. The method according to claim 14, wherein said individual input event feature vector elements further comprise:

parameters of said defined subset; and

a count of said input events within said defined subset.

20. The method according to claim 19, wherein said parameters of said defined subset of said plurality of input events comprise a combination of said identified fields within each said identified field'"'"'s said respective resolutions, up to each said identified field'"'"'s said maximal window.