Event Sequence Filtering via Directed Acyclic Graph Equivalence Classes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies face challenges in identifying and filtering sequences of events from large datasets, particularly in real-time, due to the complexity of human behavior patterns that often diverge from statistical distributions, leading to false positives and delayed detection of new behavior patterns, which is critical in security and monitoring applications.
Innovation Solution
A directed acyclic graph (DAG) data structure is used to represent equivalence classes of events, allowing for efficient filtering and identification of event sequences by combining initial and final sub-sequences with common equivalence classes, enabling the generation of executable code to evaluate incoming events and detect partial or full sequences, including security occurrences.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If statistical methods or machine learning approaches are used to model event information, then analysis capability is improved, but false positive determinations increase and detection of new behavior patterns is delayed
Solution Approach 1:
The patent segments event sequences into distinct patterns and representations, breaking down complex event data into manageable units that can be analyzed without relying on statistical distributions. This segmentation allows for precise identification of actual event patterns while reducing false positives caused by statistical assumptions about human behavior.
2Measurement precision
If statistical methods are used to model event sequences, then analysis capability is improved, but detection speed of new behavior patterns deteriorates
Solution Approach 1:
The patent performs preliminary actions by pre-processing and representing event sequences in a structured format before analysis. Event sequences are transformed into event graphs and patterns are pre-identified, enabling rapid detection of new behavior patterns without requiring extensive statistical computation when new events occur.
3Measurement precision
If detailed analysis and comparison of individual events is performed to determine relationships, then identification accuracy is improved, but processing complexity increases
Solution Approach 1:
The patent introduces an intermediary representation layer between raw events and analysis. Event graphs serve as intermediaries that capture relationships between events in a structured format, simplifying the analysis process while maintaining identification accuracy. This intermediary structure avoids the need for complex pairwise comparisons of all individual events.
4Loss of information
If sequences of events are identified from large datasets, then information mining capability is improved, but processing time increases
Solution Approach 1:
The patent changes the parameters of event representation by transforming events into a standardized format with specific attributes and relationships. This parameter transformation enables efficient indexing and searching, allowing rapid identification of event sequences in large datasets without sacrificing information extraction capability.
Data Source
AI summary
A sequence identification apparatus comprising a processor, wherein the apparatus is adapted to access a directed acyclic graph data structure of equivalence classes of events in event sequences identified in a plurality of time-ordered events, and wherein the graph is optimized such that initial and final sub-sequences of event sequences having common equivalence classes are combined in the graph, the apparatus comprising: a code generator adapted to generate executable code corresponding to the graph such that the code includes an instruction sequence for each event classification of the graph, the code sequence for an event classification being adapted to evaluate criteria to determine if an event corresponds to the event classification; a virtual machine adapted to execute the generated executable code such that, in use, the executable code filters incoming time-ordered events based on the graph.