SYSTEM AND METHOD FOR PREDICTING EVENTS

• US 20140095425A1
• Filed: 09/28/2012
• Published: 04/03/2014
• Est. Priority Date: 09/28/2012
• Status: Active Grant

• Current Assignee: Sphere Of Influence, Inc.
• Original Assignee: Sphere Of Influence, Inc.
• Inventors: Sipple, John A.
• Granted Patent: US 8,892,484 B2
• Time in Patent Office: Days
• US Class Current: 706/52
• CPC Class Codes: G06N 5/02 Knowledge representation; Symbolic representation
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks

Abstract

A method and apparatus for predicting significant future events based on previous events. Plural messages representing events are received. Attributes of the messages are mapped to respective feature dimensions to define a multidimensional histogram. Co-occurrence of at least two event types are determined based on queries of the multidimensional histogram. Anomalous event types are detected from the messages by comparing feature dimensions of incoming messages to probability density functions of the cluster corresponding to the event type and highly anomalous event types are determined. Causal relationships between each pair of event types are determined and a Bayesian belief network of the pairs of event types is created and used to predict future events based on occurrence of additional events.

Claims

1. A method for predicting significant future events based on previous events, comprising:

receiving plural messages representing events, each message including an event type attribute, a time attribute, a population attribute, and a semantic attribute;

mapping the attributes of the messages to respective feature dimensions to define a multidimensional histogram;

determining co-occurrence of at least two event types based on queries of the multidimensional histogram;

clustering correlated event types based on the corresponding event type attributes using a multiple assignment hierarchal clustering algorithm;

estimating a probability density function corresponding to multiple feature dimensions for each cluster of related event types;

detecting anomalous event types from the messages by comparing feature dimensions of incoming messages to the probability density functions of the cluster corresponding to the event type of the incoming messages;

identifying highly anomalous event types in clusters based on the probability density functions;

aggregating similar anomalous event type clusters to create an anomaly template of multiple pairs of event types;

establishing a temporal sequence of each event type in the anomaly template;

estimating causal relationships between each pair of event types in the anomaly template;

constructing a Bayesian belief network of the pairs of event types;

predicting a significant event by applying the Bayesian belief network to an incoming message; and

applying event types from the Bayesian belief network onto a timeline to establish a sequential set of events related to the significant event.

2. A method for constructing a belief network for predicting significant future events based on previous events, comprising:

receiving plural messages representing events, each message including an event type attribute, a time attribute, a population attribute, and a semantic attribute;

mapping the attributes of the messages to respective feature dimensions to define a multidimensional histogram;

determining co-occurrence of at least two event types based on queries of the multidimensional histogram;

clustering correlated event types based on the corresponding event type attributes using a multiple assignment hierarchal clustering algorithm;

estimating a probability density function corresponding to multiple feature dimensions for each cluster of related event types;

detecting anomalous event types from the messages by comparing feature dimensions of incoming messages to the probability density functions of the cluster corresponding to the event type of the incoming messages;

identifying highly anomalous event types in clusters based on the probability density functions;

aggregating similar anomalous event type clusters to create an anomaly template of multiple pairs of events;

establishing a temporal sequence of each event type in the anomaly template;

estimating causal relationships between each pair of event types in the anomaly template; and

constructing a Bayesian belief network of the pairs of event types.

3. A method for predicting significant future events based on previous events, comprising:

receiving plural messages representing events, each message including an event type attribute, a time attribute, a population attribute, and a semantic attribute;

predicting a significant event by applying a Bayesian belief network to an incoming message; and

applying events from the Bayesian belief network onto a timeline to establish a sequential set of event types related to the significant event type;

wherein the Bayesian belief network is created by;

receiving plural messages representing events, each message including an event type attribute, a time attribute, a population attribute, and a semantic attribute;

mapping the attributes of the messages to respective feature dimensions to define a multidimensional histogram;

determining co-occurrence of at least two event types based on queries of the multidimensional histogram;

clustering correlated event types based on the corresponding event type attributes using a multiple assignment hierarchal clustering algorithm;

estimating a probability density function corresponding to multiple feature dimensions for each cluster of related event types;

detecting anomalous event types from the messages by comparing feature dimensions of incoming messages to the probability density functions of the cluster corresponding to the event type of the incoming messages;

identifying highly anomalous event types in clusters based on the probability density functions;

aggregating similar anomalous event type clusters to create an anomaly template of multiple pairs of event types;

establishing a temporal sequence of each event type in the anomaly template; and

estimating causal relationships between each pair of event types in the anomaly template.

4. A system for predicting significant future events based on previous events, comprising:

at least one processor;

at least one memory operatively coupled to at least one of the at least one processors and having computer readable instructions stored thereon, the instructions, when executed by at least one of the at least one processors, cause the at least one processors to;

receive plural messages representing events, each message including an event type attribute, a time attribute, a population attribute, and a semantic attribute;

map the attributes of the messages to respective feature dimensions to define a multidimensional histogram;

determine co-occurrence of at least two event types based on queries of the multidimensional histogram;

cluster correlated event types based on the corresponding event type attributes using a multiple assignment hierarchal clustering algorithm;

estimate a probability density function corresponding to multiple feature dimensions for each cluster of related event types;

detect anomalous event types from the messages by comparing feature dimensions of incoming messages to the probability density functions of the cluster corresponding to the event type of the incoming messages;

identify highly anomalous event types in clusters based on the probability density functions;

aggregate similar anomalous event type clusters to create an anomaly template of multiple pairs of event types;

establish a temporal sequence of each event type in the anomaly template;

estimate causal relationships between each pair of event types in the anomaly template;

construct a Bayesian belief network of the pairs of event types;

predict a significant event by applying the Bayesian belief network to an incoming message; and

apply event types from the Bayesian belief network onto a timeline to establish a sequential set of events related to the significant event.

5. A system for constructing a belief network for predicting significant future events based on previous events, comprising:

at least one processor;

at least one memory operatively coupled to at least one of the at least one processors and having computer readable instructions stored thereon, the instructions, when executed by at least one of the at least one processors, cause the at least one processors to;

receive plural messages representing events, each message including an event type attribute, a time attribute, a population attribute, and a semantic attribute;

map the attributes of the messages to respective feature dimensions to define a multidimensional histogram;

determine co-occurrence of at least two event types based on queries of the multidimensional histogram;

cluster correlated event types based on the corresponding event type attributes using a multiple assignment hierarchal clustering algorithm;

estimate a probability density function corresponding to multiple feature dimensions for each cluster of related event types;

detect anomalous event types from the messages by comparing feature dimensions of incoming messages to the probability density functions of the cluster corresponding to the event type of the incoming messages;

identify highly anomalous event types in clusters based on the probability density functions;

aggregate similar anomalous event type clusters to create an anomaly template of multiple pairs of events;

establish a temporal sequence of each event type in the anomaly template;

estimate causal relationships between each pair of event types in the anomaly template; and

construct a Bayesian belief network of the pairs of event types.

6. A system for predicting significant future events based on previous events, comprising:

at least one processor;

at least one memory operatively coupled to at least one of the at least one processors and having computer readable instructions stored thereon, the instructions, when executed by at least one of the at least one processors, cause the at least one processors to;

receive plural messages representing events, each message including an event type attribute, a time attribute, a population attribute, and a semantic attribute;

predict a significant event by applying a Bayesian belief network to an incoming message; and

apply events from the Bayesian belief network onto a timeline to establish a sequential set of event types related to the significant event type;

wherein the Bayesian belief network is created by;

receiving plural messages representing events, each message including an event type attribute, a time attribute, a population attribute, and a semantic attribute;

mapping the attributes of the messages to respective feature dimensions to define a multidimensional histogram;

determining co-occurrence of at least two event types based on queries of the multidimensional histogram;

clustering correlated event types based on the corresponding event type attributes using a multiple assignment hierarchal clustering algorithm;

estimating a probability density function corresponding to multiple feature dimensions for each cluster of related event types;

detecting anomalous event types from the messages by comparing feature dimensions of incoming messages to the probability density functions of the cluster corresponding to the event type of the incoming messages;

identifying highly anomalous event types in clusters based on the probability density functions;

aggregating similar anomalous event type clusters to create an anomaly template of multiple pairs of event types;

establishing a temporal sequence of each event type in the anomaly template; and

estimating causal relationships between each pair of event types in the anomaly template.