SSE-based intelligent event processing and responding method and system

Abstract

The invention discloses an SSE-based intelligent event processing and responding method and system. The invention relates to the technical field of communication event processing. The column connection table is introduced into the CEP, so that the relevance between event scalar information can be analyzed, and a basis is provided for further analysis of time sequence, causality and spatial relation. After the associated events are identified, the sequence of the events can be tracked by using a time sequence analysis function in the CEP, and a timeline is established. The causal relationship analysis needs to be combined with an association rule and a time sequence to deduce a causal chain between events. By collecting and processing the event stream data in real time and combining the column connection table analysis and the CEP rule configuration, a complex event mode can be automatically identified, and an intelligent response decision is made according to the content and context of the event. The automation level and the intelligence level of event processing are remarkably improved, and the requirement for manual intervention is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of communication event processing, specifically to the technical field of SSE and CEP, and in particular to an intelligent event processing and response method and system based on SSE. Background Art

[0002] Network communication events refer to a series of important events related to information transmission, exchange and processing that occur in a network environment. These events may include, but are not limited to, abnormal situations in the sending, receiving and processing of data, failures of network equipment, identification and response to security threats (such as hacker attacks and virus transmission), and changes or interruptions in network services. Network communication events are crucial to maintaining the stability, security and efficiency of network systems.

[0003] During network communication, various types of events may occur, which may be caused by internal factors (such as software errors, hardware failures) or external factors (such as network attacks, natural disasters). The processing and response speed of these events directly affects the availability of network services and user experience.

[0004] Existing network event processing technologies are similar: after collecting monitoring data, event recognition technology is used to analyze and identify network communication events. Steps include data preprocessing, feature extraction, and pattern matching. Event classification is to classify the identified events according to predefined rules or models so that corresponding response measures can be taken according to the event type.

[0005] However, existing systems are not mature enough in identifying complex event patterns and making intelligent responses, and often need to rely on preset rules, which limits the flexibility and scope of applicability of the system.

[0006] To this end, the present invention proposes an intelligent event processing and response method and system based on SSE. Summary of the invention

[0007] In view of this, the present invention hopes to provide an intelligent event processing and response method and system based on SSE to solve or alleviate the technical problems existing in the prior art, namely, how to identify more complex event patterns and make more intelligent response decisions according to the content and context of the event, and at least provide a beneficial option for this; the technical solution of the present invention is implemented as follows:

[0008] First, intelligent event processing and response methods based on SSE:

[0009] 1. Overview:

[0010] In order to solve the above technical problems, the present invention chooses to focus on the processing and analysis of real-time event streams based on the traditional CEP (stream-based processing) technology, and further introduces a contingency table (ContingencyTable) judgment mechanism to analyze the relationship between two or more qualitative variables and determine whether there is correlation or independence between these variables. The introduction of contingency tables in CEP can help analyze the correlation between event scalar information and provide a basis for further temporal, causal and spatial relationship analysis.

[0011] After identifying related events, the temporal analysis function in CEP can be used to track the order of events and establish a timeline. Causal relationship analysis requires combining association rules and time sequence to infer the causal chain between events. Spatial relationship analysis is applicable to events with spatial attributes, such as geographic location data, and uses spatial analysis technology to identify the distribution and association of events in space.

[0012] (II) Technical solution:

[0013] To achieve the above objectives, the present invention needs to perform the following steps S1 to S5:

[0014] 2.1 Step S1, data collection and preprocessing:

[0015] Event stream data X is collected and normalized to form a data set D to ensure data quality and analysis accuracy. The normalization method is:

[0016]

[0017] Among them, X norm represents the normalized data value. X represents the original data value. min and X max Represents the minimum and maximum values ​​in the data set, respectively.

[0018] By applying this normalization method, all original data values ​​can be converted to values ​​in the range of [0,1], thereby eliminating the impact of different dimensions and numerical ranges on data analysis and processing.

[0019] 2.2 Step S2, execute the contingency table analysis mechanism:

[0020] Any two events (d i ,d j ) into the contingency table to analyze the two events (d i ,d j ) The correlation between the scalar information r, identifying the event group d 1,2 .

[0021] 2.2.1 Step S200, perform contingency table analysis:

[0022]

[0023] Where r represents the correlation of scalar information between two events. n represents the sample size, i.e., the number of event pairs. x and y represent event d i and d j ∑ represents the summation symbol.

[0024] By calculating this correlation coefficient r, we can quantify the event d i and d j According to the value of r, we can determine whether two events have significant correlation and identify the event group with strong correlation. 1,2 If the value of r is close to 1 or -1, it means that there is a strong positive correlation or a strong negative correlation between the two events; if the value of r is close to 0, it means that the correlation between the two events is weak.

[0025] 2.2.2 Step S201, identification:

[0026] If the correlation r exceeds the preset threshold T, the event (d i ,d j ) is updated to event group d 1,2 And participate in step S3.

[0027] 2.3 Step S3, determination:

[0028] Based on the identified event groups d 1,2 , input into the analysis rule base, and find the event group d 1,2 The corresponding event type a, temporal relationship b, causal relationship c and spatial relationship e form a real-time event d(a,b,c,e).

[0029] in:

[0030] (1) Event type a: user behavior events (clicks, purchases, and / or browsing) and system status events (such as failures, maintenance, and / or upgrades).

[0031] (2) Temporal relationship b: event group d 1,2 Simultaneous occurrence, event group d 1,2 Sequential occurrence, event group d 1,2 Periodic occurrence or group of events 1,2 recurrence;

[0032] (3) Causal relationship c: direct causation (in event group d 1,2 In the case of one event directly causing another event to occur), indirect causation (in the case of a group of events 1,2causality (in which one event leads to another through a series of intermediate steps) or no causality (event sequence d 1,2 There is no causal relationship between them).

[0033] (4) Spatial relations: location relations in the same place or network topology;

[0034] 2.4 Step S4, execute the preset CEP rule configuration:

[0035] The CEP system is configured with processing rules, which use the Pattern API tool to define event patterns and set matching conditions and filtering rules.

[0036] The real-time event d(a, b, c, e) stream is input into the CEP system, and the complex event d(m) is identified based on the matching conditions and filtering rules.

[0037] 2.4.1 Step S400, matching conditions:

[0038] S4000, analyzing whether the event type matches: checking whether the event type a in the real-time event d(a,b,c,e) matches the event type defined in the CEP rule. For example, the rule specifies that only events of the type "user login" are concerned.

[0039] S4001, Analyze whether the timing relationship matches: Analyze the time sequence and duration between events to ensure that they meet the timing relationship defined in the CEP rules. For example, the rule requires that the "purchase behavior" event must occur within 5 minutes after the "user login" event.

[0040] S4002, analyzing whether the causal relationship matches: judging whether there is a causal relationship between events depends on business logic and context information. For example, the rule considers the "system failure" event as the direct cause of the "service interruption" event.

[0041] S4003, analyzing whether the spatial relationship matches: Analyze the geographical location or virtual space location where the event occurred to ensure that they conform to the spatial relationship defined in the CEP rule. For example, the rule focuses on events that occur in a specific area or network node.

[0042] S4004, analyzing whether the attributes match: checking whether other attributes of the event (such as value, label or status) meet the CEP rules. For example, the rule requires that the numerical attribute contained in the event must be greater than a certain threshold.

[0043] 2.4.2 Step S401, filtering rules:

[0044] S4010, frequency filtering: limit the number of times the same type of event is processed in the same period of time. For example, the rule stipulates that only one "system warning" event is processed per minute to avoid information overload.

[0045] S4011, perform importance filtering: Sort events by severity or business value and only process events that reach the corresponding level of importance. For example, the rule marks "Emergency Shutdown" events as high priority to ensure that they are processed first.

[0046] S4012, perform time window filtering: only process events within a specific time window and ignore events outside the window. For example, the rule specifies that only user-related operation events are processed during working hours.

[0047] S4013, perform complex condition filtering: combine multiple matching conditions and / or other filtering rules to jointly determine whether the event is further processed. For example, the rule requires that the event must meet both the "type matching" and "value greater than a threshold" conditions to be identified as a complex event.

[0048] S4014, perform deduplication filtering: filter out duplicate or similar events to avoid duplicate processing. For example, the rule removes duplicate events by comparing unique identifiers or key attributes of the events.

[0049] 2.5 Step S5, result output and index:

[0050] The identified complex events d(m) are output to the result set O, and an ordinal index is established in the result set O to facilitate subsequent query and management.

[0051] (III) Mechanism for solving technical problems:

[0052] By collecting event stream data and normalizing it, we can ensure data quality and analysis accuracy. Normalization eliminates the impact of different dimensions and numerical ranges on data analysis and processing, making subsequent analysis more accurate.

[0053] Through contingency table analysis, the linear correlation of scalar information between events is quantified. Event groups with strong correlation are identified to provide a basis for subsequent complex event identification. Based on the identified event groups, the event type, temporal relationship, causal relationship, and spatial relationship are determined. The determination of this information provides detailed context for the identification and response of subsequent complex events.

[0054] Real-time events are filtered and identified through matching conditions and filtering rules. Matching conditions ensure that events conform to predefined patterns, while filtering rules further refine which events should be processed. This step is key to identifying complex events and making intelligent response decisions based on event content and context.

[0055] The identified complex events are output to the result set and indexed for subsequent query and management, so that users can easily view and process the identified complex events, further supporting intelligent response decisions.

[0056] Second, intelligent event processing and response system based on SSE:

[0057] include:

[0058] An event listener responsible for real-time monitoring of events from different sources (such as sensors, applications, services, etc.). Use SSE technology to achieve continuous data stream reception to ensure the real-time and integrity of the data.

[0059] Event handlers, including:

[0060] (1) A classification and preprocessing module that performs preliminary classification and preprocessing (such as formatting and denoising) of received events to prepare for subsequent intelligent processing and response.

[0061] (2) An intelligent analysis module that executes the above-mentioned SSE-based intelligent event processing and response method algorithm.

[0062] A response decision engine selects a response strategy based on the output of the intelligent analysis module.

[0063] Response executors that execute the strategies determined by the response decision engine, including sending notifications, calling external services, and triggering actions in other systems.

[0064] Resource management and optimizer that monitors system resource usage (such as CPU, memory, network bandwidth).

[0065] User interfaces and APIs that provide operating and programming interfaces to system administrators and third-party developers.

[0066] Compared with the prior art, the present invention has the following beneficial effects:

[0067] 1. Improve the intelligent level of event processing: This invention can automatically identify complex event patterns and make intelligent response decisions based on the content and context of the event by collecting and processing event stream data in real time, combining contingency table analysis and CEP rule configuration. This significantly improves the automation and intelligence level of event processing and reduces the need for manual intervention.

[0068] 2. Enhance the accuracy and timeliness of event response: The matching conditions and filtering rules in the CEP rule configuration of the present invention can accurately filter out events that meet specific patterns, thereby ensuring the accuracy and timeliness of response.

[0069] 3. Improve business operation efficiency and effectiveness: The present invention can monitor and analyze events in business operations in real time, and promptly identify potential problems and opportunities. Through intelligent response decisions, enterprises can take action faster, optimize business processes, and improve operational efficiency and effectiveness.

[0070] 4. Enhanced data insight and decision support: Based on SSE and CEP technologies, this invention has good scalability and flexibility. Enterprises can customize and expand event processing rules according to actual needs to adapt to the ever-changing business environment and needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 It is a schematic diagram of the method flow of the present invention;

[0072] Figure 2 It is a schematic diagram of the system composition of the present invention. DETAILED DESCRIPTION

[0073] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings. In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways different from those described herein, and those skilled in the art can make similar improvements without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below;

[0074] Embodiment 1: Figure 1 As shown, this embodiment discloses an intelligent event processing and response method based on SSE, which includes the following steps S1 to S5.

[0075] In this embodiment, regarding step S1, data collection and preprocessing:

[0076] Event stream data X is collected and normalized to form a data set D to ensure data quality and analysis accuracy. The normalization method is:

[0077]

[0078] Among them, X norm represents the normalized data value. X represents the original data value. min and X max Represents the minimum and maximum values ​​in the data set, respectively.

[0079] By applying this normalization method, all raw data values ​​can be converted to values ​​in the range of [0,1], thereby eliminating the impact of different dimensions and numerical ranges on data analysis and processing. In this way, regardless of the dimensions and numerical ranges of the original data, the normalized data will fall within a unified range, which facilitates subsequent data analysis and processing. Through normalization, the impact of different dimensions and numerical ranges on data analysis can be eliminated, thereby improving the accuracy of data analysis.

[0080] In this embodiment, regarding step S2, a contingency table analysis mechanism is performed: any two events (d i ,d j ) into the contingency table to analyze the two events (d i ,d j ) The correlation between the scalar information r, identifying the event group d 1,2 The purpose of this step is to identify the correlation of scalar information between any two events in the data set and to identify groups of events with strong correlation.

[0081] Specifically, step S200, performing contingency table analysis:

[0082]

[0083] Where r represents the correlation of scalar information between two events. n represents the sample size, i.e., the number of event pairs. x and y represent event d i and d j ∑ represents the summation symbol.

[0084] By calculating this correlation coefficient r, we can quantify the event d i and d j According to the value of r, we can determine whether two events have significant correlation and identify the event group with strong correlation. 1,2 If the value of r is close to 1 or -1, it means that there is a strong positive correlation or a strong negative correlation between the two events; if the value of r is close to 0, it means that the correlation between the two events is weak.

[0085] By calculating the correlation of scalar information between events, we can more accurately identify groups of events with specific correlation patterns, thereby improving the accuracy of event identification. Based on the correlation of scalar information between events, we can make more intelligent response decisions. For example, if there is a strong positive correlation between two events, we can predict that when one event occurs, the other event may also occur, and formulate a corresponding response strategy accordingly. And by identifying groups of events with strong correlations, we can optimize the event processing process. For example, we can combine and process groups of events with strong correlations to reduce duplication of work and improve processing efficiency.

[0086] Specifically, step S201, identification: the purpose of this step is to combine events with strong correlation into a new event group according to the correlation of scalar information between events, and participate in subsequent processing steps.

[0087] If the correlation r exceeds the preset threshold T, the event (d i ,d j ) is updated to event group d 1,2 And participate in step S3. This threshold T is an empirical value or is set according to actual needs. It is used to determine whether there is sufficient correlation between two events to form an event group. If the correlation r exceeds the preset threshold T (that is, the value of r is greater than or equal to T), the event (di, dj) is updated to the event group d1,2. This means that we believe that there is a strong correlation between the two events and they can be treated as a whole. Finally, the identified event group d1,2 participates in step S3 for subsequent processing and analysis.

[0088] Furthermore, the Python execution program of step S2 is as follows:

[0089] import numpy as np

[0090] #D is a two-dimensional NumPy array containing event scalar information

[0091] #Each row represents an event, and each column represents a scalar information

[0092] D=np.array([[1,2],[2,3],[3,4],[4,5],[5,6]])

[0093] #Preset correlation threshold T

[0094] T=0.7

[0095] # Calculate the sample size n

[0096]

[0097] print("Identified event groups (event index pairs):", event_groups)

[0098] In the above program, D is a two-dimensional NumPy array, where each row represents an event and each column represents a scalar information. A correlation threshold T is preset to determine whether there is a strong correlation between events.

[0099] Get the sample size n, i.e. the number of events, through D.shape[0]. Create an nxn zero matrix r_matrix to store the correlation between each pair of events.

[0100] Use two nested loops to traverse each pair of events. For each pair of events, calculate the correlation r of the scalar information between them. Store the calculated correlation r in r_matrix. Since the correlation is symmetric, the values ​​of r_matrix[i,j] and r_matrix[j,i] are the same.

[0101] Traverse r_matrix, if a certain correlation value is greater than or equal to the preset threshold T, then add the corresponding event index pair to the event_groups list. Finally, print the identified event group (event index pair).

[0102] In this embodiment, regarding step S3, it is determined that: based on the identified event group d 1,2 , input into the analysis rule base, and find the event group d 1,2 The corresponding event type a, temporal relationship b, causal relationship c and spatial relationship e form a real-time event d(a,b,c,e). 1.

[0104] Specifically, input event group: First, the event group d identified in step S2 is 1,2 As input, it is passed into the analysis rule base.

[0105] Specifically, match the event type: In the analysis rule base, according to the event group d 1,2 The features of the event group are matched to the corresponding event type a. Event type a includes user behavior events (such as clicks, purchases and / or browsing) and system status events (such as failures, maintenance and / or upgrades). The principle of this step is based on rule matching, that is, matching the event group features with the event type definition in the rule base.

[0106] Specifically, determine the temporal relationship: Next, determine the event group d 1,2The timing relationship b between them. The timing relationship b includes simultaneous occurrence, sequential occurrence, periodic occurrence or repeated occurrence. The principle of this step is to determine the timing relationship between them through comparison and analysis based on the timestamp or sequence information of the events.

[0107] Specifically, analyze the causal relationship: Then, analyze the event group d 1,2 Causal relationship c. Causal relationship c includes direct causation (one event directly causes another event to occur), indirect causation (one event causes another event to occur through a series of intermediate steps), or no causation (there is no causal relationship between the event groups). The principle of this step is to determine the causal relationship between events through reasoning and analysis based on the logical connection and dependency between events.

[0108] Specifically, determine the spatial relationship: Finally, determine the event group d 1,2 Spatial relations e between them. Spatial relations e include the position relations in the same place or network topology. The principle of this step is to determine the spatial relations between them through comparison and analysis based on the spatial information of events, such as geographical location or network topology.

[0109] Specifically, to form a real-time event: the matched event type a, the determined temporal relationship b, the analyzed causal relationship c and the determined spatial relationship e are combined to form a real-time event d(a, b, c, e). This real-time event d contains the event group d 1,2 Complete information can be used for subsequent response decisions.

[0110] It can be understood that the principle of this step is based on rule matching and event analysis. By analyzing the rule base, the event type, temporal relationship, causal relationship, and spatial relationship corresponding to the event group d1, 2 are found, and this information is combined to form a real-time event. This rule-based and analysis-based approach helps us understand and process complex event patterns more accurately. Through the determination process of step S3, we can more accurately identify and understand the characteristics and relationships of the event group d1, 2, thereby improving the accuracy of event processing. This helps us make more accurate response decisions. Based on the complete information of the real-time event d (a, b, c, e), we can make more intelligent response decisions. For example, we can formulate targeted response strategies based on event type, temporal relationship, causal relationship, and spatial relationship. Through the determination process of step S3, we can optimize the event processing process.

[0111] For example, certain events may be processed preferentially or the processing order may be adjusted according to the characteristics and relationships of the real-time events d.

[0112] Furthermore, the Python execution program of step S3 is as follows:

[0113]

[0114]

[0115] else:

[0116] real_time_event['causal_relation'] = 'none' # default is no causal relation

[0117] #Determine spatial relationship

[0118] ifd1['location']==d2['location']:

[0119] real_time_event['spatial_relation']='same_location'

[0120] return real_time_event

[0121] #Call the judgment function

[0122] real_time_event=judge_event_group(d1,d2,rule_base)

[0123] print("Real-time event d:",real_time_event)

[0124] In the above procedure, d1 and d2 are two events in the event group identified in step S2, which contain information such as event type, timestamp, and location or network position. rule_base is the analysis rule base, which contains possible values ​​of event type, temporal relationship, causal relationship, and spatial relationship.

[0125] The judge_event_group function receives d1, d2, and rule_base as input and returns a real-time event real_time_event that contains event type, temporal relationship, causal relationship, and spatial relationship. The function determines the various attributes of the real-time event by comparing the event type, timestamp, and location or network location of d1 and d2, and matching them with the definition in the analysis rule base.

[0126] Finally, the function returns the real-time event real_time_event, which is a dictionary containing information about event type, temporal relationship, causal relationship, and spatial relationship.

[0127] In this embodiment, regarding step S4, the preset CEP (complex event processing) rule configuration is executed. The CEP system has been configured with processing rules, which use the Pattern API tool to define event patterns and are set with matching conditions and filtering rules. Next, the real-time event d(a, b, c, e) stream is input into the CEP system, and the complex event d(m) is identified based on these matching conditions and filtering rules.

[0128] The real-time event d(a, b, c, e) stream is input into the CEP system, and the complex event d(m) is identified based on the matching conditions and filtering rules.

[0129] (1) Matching conditions:

[0130] Analyze whether the event type matches (S4000): Check whether the event type a in the real-time event d (a, b, c, e) matches the event type defined in the CEP rule.

[0131] The operation method is: by comparing event type a with the event types defined in the CEP rule base, if they match, continue with the subsequent analysis; otherwise, the event is not considered as part of the complex event.

[0132] Analyze whether the timing relationship matches (S4001): Analyze the time sequence and duration between events to ensure that they comply with the timing relationship defined in the CEP rules.

[0133] The operation method is: use timestamps or time intervals to compare the time sequence and duration of events, and match them with the timing relationship defined in the CEP rules.

[0134] Analyze whether the causal relationship matches (S4002): Determine whether there is a causal relationship between events, which depends on business logic and context information.

[0135] The operation method is: infer the causal relationship between events through business logic and context information, and match them with the causal relationship defined in the CEP rules.

[0136] Analyze whether the spatial relationship matches (S4003): Analyze the geographical location or virtual space location where the event occurs to ensure that they comply with the spatial relationship defined in the CEP rules.

[0137] The operation method is: use geographic location or network topology information to compare the spatial location of the event and match it with the spatial relationship defined in the CEP rule.

[0138] Analyze whether the attributes match (S4004): Check whether other attributes of the event (such as value, label or status) comply with the CEP rules.

[0139] The operation method is: extract the attributes of the event and match them with the attributes defined in the CEP rule.

[0140] (2) Filtering rules:

[0141] Execute frequency filtering (S4010): limit the number of times the same type is processed in the same period of time to avoid information overload.

[0142] The operation method is: use counters or time windows to track the processing frequency of the same type of events, and filter them according to the rules.

[0143] Execute importance filtering (S4011): Sort the events according to their severity or business value, and only process events with a corresponding level of importance.

[0144] This is done by assigning severity levels to events and using rules to process only events that reach a certain severity level.

[0145] Execute time window filtering (S4012): only process events within a specific time window and ignore events outside the window.

[0146] The operation method is: define a time window and only process events that occur within the time window.

[0147] Performing composite condition filtering (S4013): combining multiple matching conditions and / or other filtering rules to jointly determine whether the event is further processed.

[0148] The operation method is: use logical operators (such as AND, OR) to combine multiple matching conditions and filtering rules, and decide whether to process the event based on the combination result.

[0149] Perform de-duplication filtering (S4014): filter out duplicate or similar events to avoid duplicate processing.

[0150] This is done by using unique identifiers or key attributes to compare events and remove duplicate or similar events.

[0151] It is understandable that by matching conditions and filtering rules, complex events that meet specific patterns can be more accurately identified, thereby improving the accuracy of event processing. Based on the identified complex events, more intelligent response decisions can be made because complex events contain more event context and relationship information. Through filtering rules, the event processing process can be optimized, unnecessary event processing can be reduced, and processing efficiency can be improved. By reducing duplicate events and filtering out unimportant events, the system processing burden can be reduced, thereby improving system performance.

[0152] Furthermore, the Python execution program of step S4 is as follows:

[0153]

[0154]

[0155]

[0156] In the above program, the CEPRule class defines a CEP rule, which includes event type, temporal relationship, causal relationship, spatial relationship, and attribute matching pattern. Various Pattern classes define different types of matching patterns, such as temporal relationship, causal relationship, etc. The match method in these classes is used to check whether the event meets a specific matching pattern. In the match method of the CEPRule class, check whether the event meets all predefined matching conditions in turn. If all conditions are met, True is returned, indicating that the event is a complex event; otherwise, False is returned. Real-time event processing creates a real-time event and matches it using predefined CEP rules. According to the matching results, the corresponding information is output.

[0157] In this embodiment, regarding step S5, result output and indexing: In the previous steps, the system has identified complex events d(m) through a series of matching and reasoning processes. The task of this step is to collect these identified complex events and output them into a unified result set O.

[0158] The system maintains a result set O, and whenever a complex event d(m) is identified, it is added to O. In this way, O contains all complex events identified by the system.

[0159] Furthermore, in order to facilitate subsequent query and management, a unique sequence index needs to be established for each complex event in the result set O. This index can be a simple serial number or a more complex timestamp or hash value, depending on the requirements and design of the system.

[0160] Specifically, whenever a complex event d(m) is added to the result set O, the system assigns it a unique index. This index is associated with the complex event d(m) and stored in O. In this way, a specific complex event can be quickly located through the index later.

[0161] It is understandable that by creating an ordinal index for complex events, the efficiency of subsequent queries can be greatly improved. Because the index is usually much faster than directly searching the entire result set, users can find the complex events they need more quickly. Ordinal indexes not only help with queries, but also help with managing result sets. For example, the index can be used to track the addition and removal of complex events, or to sort and group result sets. As the system processes more and more complex events, the result set O may become very large. Ordinal indexes can help the system scale better because the index can remain relatively small and efficient even if the result set is large.

[0162] Furthermore, the Python execution program of step S5 is as follows:

[0163] #Add complex events to the result set

[0164] result_set=ResultSet()

[0165] event1=ComplexEvent(1,"user_login",{"user":"alice","time":"2023-04-01T12:00:00Z"})

[0166] event2=ComplexEvent(2,"user_purchase",{"user":"bob","time":"2023-04-01T13:00:00Z","amount":100})

[0167] result_set.add_event(event1)

[0168] result_set.add_event(event2)

[0169] #Get complex events by index

[0170] print(result_set.get_event_by_index(1))

[0171] print(result_set.get_event_by_index(2))

[0172] In the above program, the ComplexEvent class defines a complex event, including event ID, event type and attributes. When the ResultSet class is initialized, it creates an empty list events to store complex events, and creates an empty dictionary index to establish a mapping relationship between event ID and index. The add_event method adds the passed complex event to the events list, and establishes a mapping from event ID to index for the event in the index dictionary. The get_event_by_index method searches for the corresponding index in the index dictionary by event ID, and then returns the complex event corresponding to the index from the events list. The method to add a complex event to the result set is: create a ResultSet instance result_set. Create two ComplexEvent instances event1 and event2, representing user login and user purchase events respectively. Call the add_event method of result_set to add event1 and event2 to the result set and create indexes for them. Call the get_event_by_index method of result_set, pass in the event ID, get and print the corresponding complex event.

[0173] Embodiment 2, as Figure 2 As shown, this embodiment discloses an intelligent event processing and response system based on SSE. The system is designed to monitor and process events from different sources in real time, and make intelligent response decisions based on the content and context of the event:

[0174] (1) Event Listener: The event listener is responsible for real-time monitoring of events from different sources (such as sensors, applications, services, etc.). It uses SSE technology to achieve continuous data stream reception and ensure the real-time and integrity of the data. The event listener will continuously monitor the specified data source, and once a new event is generated, it will immediately capture it and pass it to the subsequent event processor.

[0175] (2) Event handler:

[0176] (2.1) Classification and preprocessing module: This module is responsible for preliminary classification and preprocessing of received events, such as formatting, denoising, etc. When the event listener captures a new event, the classification and preprocessing module will first classify it and then preprocess it as needed.

[0177] (2.2) Intelligent Analysis Module: This module executes the SSE-based intelligent event processing and response method (S1-S5), further analyzing and processing the pre-processed events to identify more complex event patterns. The intelligent analysis module receives the pre-processed event data and identifies the complex patterns and relationships in the events.

[0178] (3) Response Decision Engine: Based on the output of the intelligent analysis module, the response decision engine selects the most appropriate response strategy. The response decision engine receives the output of the intelligent analysis module and selects an appropriate response strategy based on preset rules or strategy libraries. These strategies may include sending notifications, calling external services, triggering actions in other systems, etc.

[0179] (4) Response Executor: The response executor is responsible for executing the strategy determined by the response decision engine. It is the interface for the system to interact with the outside world and is responsible for converting the system's response into actual actions or notifications. Once the response decision engine determines the appropriate response strategy, the response executor will immediately execute the strategy, such as sending notifications to relevant personnel, calling external services for further processing, triggering actions in other systems, etc.

[0180] (5) Resource Management and Optimizer: This component is responsible for monitoring the usage of system resources, such as CPU, memory, network bandwidth, etc. Its goal is to ensure that the system can run efficiently with limited resources.

[0181] Furthermore, the Python framework program of this embodiment is as follows:

[0182]

[0183]

[0184]

[0185]

[0186] In the above program, the event listener (EventListener) uses the sseclient library to create an SSE client and receive SSE events from the specified URL in real time. The received event data (JSON format) is placed in the queue for subsequent processing. The event processor (EventProcessor) provides the registration function for preprocessing and analysis functions. It obtains events from the listener's queue and executes the registered preprocessing and analysis functions in sequence. The response decision engine and executor (ResponseEngine) provide the registration function for response strategies. The registered response strategy is executed according to the event content. The main loop continues to obtain events from the listener, process them, and execute the response strategy.

[0187] All the above embodiments only express the implementation methods of the relevant practical applications of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be based on the attached claims.

Claims

1. An intelligent event processing and response method based on SSE, characterized in that: The steps include: S1, collect event stream data X to form data set D; S2, any two events (d i ,d j ) into the contingency table to analyze the two events (d i ,d j ) The correlation between the scalar information r, identifying the event group d 1,2 ; S3, based on the identified event group d 1,2 , input into the analysis rule base, and find the event group d 1,2 The corresponding event type a, temporal relationship b, causal relationship c and spatial relationship e form a real-time event d(a,b,c,e); S4, inputting the real-time event d(a, b, c, e) stream into the CEP system, and identifying the complex event d(m) according to the matching conditions and filtering rules; S5, output the identified complex event d(m) to the result set O.

2. The processing and response method according to claim 1, characterized in that: In S1, the stream data X needs to be normalized before forming the data set D: Among them, X norm represents the normalized data value; X represents the original data value; X min and X max Represents the minimum and maximum values ​​in the data set, respectively.

3. The processing and response method according to claim 1, characterized in that: In S2, the filling and identification methods are: Where r represents the correlation of scalar information between two events; n represents the sample size; x and y represent event d i and d j Scalar information of S201, if the correlation r exceeds the preset threshold T, the event (d i ,d j ) is updated to the event group d 1,2 and participate in said S3.

4. The processing and response method according to claim 1, characterized in that: In S3, the event type a includes user behavior events and system status events; The timing relationship b includes event group d 1,2 Simultaneous occurrence, event group d 1,2 Sequential occurrence, event group d 1,2 Periodic occurrence or group of events 1,2 recurrence; The causal relationship c includes direct causation, indirect causation or no causation; The spatial relationship e includes a location relationship in the same place or a network topology.

5. The processing and response method according to claim 4, characterized in that: In S4, the matching adjustment is performed by: S4000, analyzing whether the event type matches; S4001, analyzing whether the timing relationship matches; S4002, analyze whether the cause-effect relationship matches; S4003, analyzing whether the spatial relationship matches; S4004, analyzing whether the attributes match.

6. The processing and response method according to claim 4, characterized in that: In S4, the filtering rule is: S4010, performing frequency filtering; S4011, perform importance filtering; S4012, perform time window filtering; S4013, perform compound condition filtering; S4014, perform deduplication filtering.

7. The processing and response method according to claim 1, 5 or 6, characterized in that: In S4, the CEP system processing rule uses the Pattern API tool to define the event pattern and sets the matching condition and the filtering rule.

8. The processing and response method according to claim 1, characterized in that: In S5, an ordinal index is established in the result set O.

9. An intelligent event processing and response method system based on SSE, characterized in that: include: Event listeners responsible for real-time monitoring of events from different sources; An event processor for executing the processing and response method according to any one of claims 1 to 8; A response decision engine selects a response strategy based on the output of the intelligent analysis module.

10. The processing and response system according to claim 9, characterized in that: The event processor includes: a classification and preprocessing module for performing preliminary classification and preprocessing on received events; An intelligent analysis module that executes the SSE-based intelligent event processing and response method algorithm.

Images