A language and architecture for adaptive event pattern detection

Current event stream processing (ESP) systems monitor situations of importance using statically defined event patterns. However, the dynamic nature of modern applications requires the observations of complex situations to cope with patterns that evolve over time. This research has developed an adaptive ESP architecture with a focus on the development of an event processing language (EPL) and pattern adaptation and learning approaches. The EPL provides a clean and formal semantics of operators and event time, with pattern uncertainty built-in as an EPL capability. The formal definition of the EPL has used denotational and translational semantics using the operator and temporal models defined in this work. The operator model includes repetition operators, a bounding operator, and an operator hierarchy that clearly defines the relationship between the conjunction and sequence operators. The temporal model has defined the semantics of an event using a unifying framework that can handle point-based and interval-based semantics. To enhance the EPL with the ability to cope with uncertainty, an uncertainty model has been defined that computes event pattern probability using a recursive definition of the language. The uncertainty model has been used to define an iterative event pattern learning and adaptation mechanism with four phases: event pattern exploration, event pattern extraction, event pattern learning, and event pattern adaptation. The pattern exploration phase uses an event pattern search space reduction algorithm developed in this research. The correlated event group mining algorithm uses the all-confidence and similarity measures with the help of a domain expert to identify the set of events that can be combined together to reduce the number of possible event patterns. Since the reduced set of event patterns can still be large, pattern sampling is done using pattern similarity functions based on the number of events and operators, the order of events and operators, and dissimilarity among pairs of events in incoming event streams. Finally, in the learning phase, this research has designed an detection-based event pattern learning technique based on the uncertainty model developed for the EPL called the operator probability The results of this research demonstrate the enhancement of an EPL with the ability to handle uncertainty that can be used for event pattern learning and adaptation on a reduced set of event patterns.