Recognizing event patterns from event streams

• US 7,627,544 B2
• Filed: 05/20/2005
• Issued: 12/01/2009
• Est. Priority Date: 05/20/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mital, Vijay, Chkodrov, Gueorgui B.
• Primary Examiner(s): Vincent; David R
• Assistant Examiner(s): Bharadwaj; Kalpana
• Application Number:
  US11/133,701
• Publication Number:
  US 20060265406A1
• Time in Patent Office: 1,656 Days
• Field of Search: 706/46, 707/202, 726/4, 726/22
• US Class Current: 706/48
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions

Abstract

System and method for identifying a pattern. A method of the invention compiles a pattern description where the pattern description defines a series of a first event and a second event relating to the first event. The first event is received and includes a type parameter data, a time parameter data, and a substance parameter data. A system of the invention includes a script component for associating or attaching a first script to the first event. The first script defines the type, time, and substance parameters of the second event as a function of the parameters of the first event according to the pattern description. A pattern recognition engine executes the attached first script and the executed script identifies the second event and thereby identifies the pattern.

Claims

1. A computerized method for identifying a pattern from event streams, said method comprising:

compiling a pattern description, said pattern description defining a series of a first event and a second event, said second event relating to the first event, said first event and the second event having yet to be received;

defining a first script having type, time and substance parameters of the second event as a function of the parameters of the first event according to the pattern description;

receiving the first event, said first event including a type parameter data, a time parameter data, and a substance parameter data;

attaching the first script to the first event, said first script defining executable codes for handling and locating the second event by defining a reaction on an individual event type that may occur in the second event based on the complied pattern description;

executing the attached first script of the first event in real-time as the first event is received; and

identifying the second event after the receiving of the first event, wherein said executed script identifies the received second event based on the defined type, time and substance parameters and thereby identifies the pattern.

2. The method of claim 1 wherein executing comprises correlating parameters in the received second event to the first event to determine if the received second event belongs to the defined series according to the pattern description.

3. The method of claim 1 wherein executing comprises outputting the parameter data of the first event and data relating to the identified pattern to a computing environment for analysis of the parameter data and the data relating to the identified pattern.

4. The method of claim 1 wherein attaching the first script to the first event comprises defining type, time, and substance parameters of the received second event by comparing the related type, time, and substance parameters of the second event to the type, time, and substance parameters of the first event.

5. The method of claim 1 further comprising storing the identified pattern in a data structure for analysis.

6. The method of claim 1 further comprising creating a copy of the defined series in response to the compiled pattern description and the attached script to the first events when one or more of the parameter data of the first event relate to one or more parameter data of the received second event or additional events in the series according to the compiled pattern description.

7. The method of claim 1 wherein said pattern description defines the series of the received first event, the received second event and a third event relating to the first and the second events, wherein the third event is received after receiving the first and second events, and wherein attaching comprises attaching a second script to the received second event, said second script defining type, time and substance parameters of the third event as a function of the parameters of the second event according to the pattern description and wherein executing comprises executing the attached second script of the second event, said executed script identifying the third event upon receiving the third event and thereby identifying the pattern.

8. The method of claim 1 wherein one or more computer-readable media have computer-executable instructions for performing the method recited in claim 1.

9. One or more computer-readable media having computer-executable components for identifying event patterns, said computer-executable components comprising:

a pattern compiling component for compiling a plurality of pattern descriptions, said each of the pattern descriptions defining a series of events in a sequence, said defined series of events having yet to be received;

an event component for collecting a plurality of events, said each of the plurality of events having data parameters relating to each of the plurality of events, said plurality of events to be received sequentially;

a script component for associating a script to each of the plurality of events, said script defining executable codes for handling a subsequent event by defining an operation occurring in the second event based on the complied pattern description, said script defining data parameters of the subsequent event in the series of each of the plurality of events according to the pattern description of each of the plurality of events; and

a pattern recognition engine for executing the script of each of the plurality of events in real-time when a first event is received to identify the subsequent event in the series in real-time relative to the sequential receipt of the plurality of events and thereby identify the pattern in real-time.

10. The computer-readable media of claim 9 wherein the pattern description includes one or more of the following parts:

pattern name, event reference, event filtering, event sequence, event timeout expectations, event correlation, and output results.

11. The computer-readable media of claim 9 wherein the pattern recognition engine correlates data parameters in the second event to the first event to determine if the second event belongs to the defined series according to the pattern description defined by the pattern compiler.

12. The computer-readable media of claim 9 further comprising a host environment for managing the pattern recognition engine, said host environment includes at least one of the following:

an in-memory host environment, a file-based host environment, and a SQL-based host environment.

13. The computer-readable media of claim 12 wherein the pattern recognition engine outputs the parameter data of each of the plurality of events and data relating to the identified pattern to the host environment for further processing of the parameter data and data relating to the identified pattern.

14. The computer-readable media of claim 12 wherein the SQL-based host environment stores parameter data of each of the plurality of events and data relating to the identified pattern outputted by the pattern recognition engine in a database and receives a query from a user for retrieving the stored data in the database.

15. The computer-readable media of claim 9 wherein the pattern recognition engine further creates a copy of the defined series in response to the pattern description compiled by the pattern compiling component and the script attached by the script component to the events in the defined series when one or more of the parameter data of the event relate to one or more parameter data of additional events in the defined series.

16. A system for identifying a pattern in a plurality of events, said system comprising:

a plurality of collecting computers for collecting related events;

a first set of computers for identifying a first portion of each collected series as the first portion of events is collected, wherein each of the collected series matches the first portion of a series of pattern events, the first portion having attached script defining executable codes for handling a second portion of each series by defining an operation occurring in the second portion based on the complied pattern description;

a second set of computers for identifying the second portion of each series as the second portion of events is collected, wherein the first portion of the pattern has been identified by the first set and wherein the attached script is executed in real-time when the first portion has been identified to indicate that the second portion is to be expected before the second portion of events is collected; and

wherein the first portion of the pattern and the second portion of the pattern match the series of pattern events and wherein each series of events including the first and second portions of the pattern is accumulated and stored for evaluation.

17. The system of claim 16 further comprising an interface for receiving a query from a user for retrieving accumulated and stored pattern in response to the query.

18. The system of claim 16 wherein the first set of computers and the second set of computers include pattern recognition engines for correlating the identified first portion of the pattern and the identified second portion of the pattern.

19. The system of claim 16 wherein the first set of computers and the second set of computers store a plurality of pattern descriptions, each of the plurality of pattern descriptions corresponds to each of the series of pattern events.

20. The system of claim 16 wherein the second set of computer servers creates a copy of each of the collected series in response to a pattern description and an attached script to the events collected in the series when one or more of the parameter data of the events identified in the first portion of the series by the first set of computer servers relate to one or more parameter data of the events identified in the second portion of the series by the second set of computer servers.