Automatic Learning of
Predictive CEP Rules
Bridging the Gap between Data Mining and
Complex Event Processing
Raef Mousheimish, Yehia Taher and Karine Zeitouni
DAIVD Laboratory, University of Versailles, France
The 11th ACM International Conference on Distributed and Event-Based Systems
Context
• CEP helps to instantaneously react against occurring situations
• Employed in different domains
•
•
•
•
Environmental monitoring
Fraud detection
Financial applications
Anomaly detection
• CEP engines are totally guided by CEP rules
• The only inference mechanism in the CEP world
CEP Rules
Events
CEP Engine
Composite events,
results, alerts, …
2
Motivation
• Event-based systems is an active area of research
• Scalability
• Latency
• Distribution
• Almost all scenarios and problems tackled by researchers have reactive traits
• Anomaly, traffic jam, fraud detection
• What if anomaly needs to be predicted?
• E.g., in a manufacturing process
• The usage of CEP in such examples is not at all evident
3
Predictive CEP
• It has been mentioned several times as a future direction and
as proposals on the conceptual level [Fulop, 2010] [Engel, 2012]
• However it remains a vision
• No real attempt to produce an easy-to-use predictive CEP system
• The main cause: CEP rules need to be specified manually
• No support is provided for users to define these rules
• It is hard for experts to manually write rules that predict situations
• This is why domains such as data mining and predictive analytics exist in the first place
• There exists a gap between predictive analytics and CEP that needs to be
bridged
4
Our Objectives
• Overtake the de facto approach regarding the definition of CEP rules
• Manual to automatic
• Go from merely reactive rules into predictive rules
• Allow for the CEP technology to be easily employed in predictive applications
• Create a generic solution that could be used in different domains
• Bridge a gap between data mining and complex event processing
5
CEP
• Require rules to alert upcoming
situations, which usually have to be given
manually
• Always assuming that users have the required
knowledge, which is sometimes is not available
or not precise (a weak point of CEP)
• CEP employs relatively simple techniques
to apply fundamental computer science to
business problems, like statistics and
exploitation of historical data
• Usually it is concerned with only the detection
of situations
PA
• Automate the process of rule generation
•
Support the weak point of CEP
• PA employ fundamental computer
science to business problems but in an
intelligent manner. It learns from
historical data to make predictions
about future events
•
•
With this, CEP could be made more
automatic and intelligent
Improved accuracy, speed, consistency,…
6
Early Classification on Time Series
• A PA field that fits exactly our goals of creating a generic and predictive approach
• Time series means timestamped events
• Early classification means predictive rules
• Shapelet-based classification style
• Devised in 2009 [Ye, 2009]
• By definition it works on univariate
time series
• More suitable for anomaly prediction
The best shapelets:
1. Have the smallest length
2. Frequent
3. Discriminative
7
Definitions
• A time series T = {t1, t2, …, tn} and |T| = n.
• To measure the similarity between two time series the Euclidean distance is used
||T1, T2||
• A shapelet sh = (s, δ, cs, score)
•
•
•
•
s is the time series
δ is the distance threshold
cs is the class of the shapelet
score is a utility score
• A multi-dimensional time series MTS dT = {T1, T2, …, Td}
• Data set of d-dimensional time series: Dd = {(dT, c)}
• TAS is a sequence of shapelets with time annotations between them:
sh1
2
sh2
3
sh3
8
Our Proposal
• Two stages:
1.
2.
Extend the shapelets learning algorithm to deal with multivariate time series, and to learn
complete and predictive patterns with sequence and time constraints
Transform these patterns on-the-fly into predictive CEP rules, and create a ready-to-use CEP
engine with predictive capabilities
• USE: Univariate Shapelet Extractor (stage 1)
• This module uses state of the art shapelet extraction techniques to learn shapelets from
univariate time series
• SEE: SEquence Extractor (stage 1)
• This module combines the extracted shapelets from the different dimensions in order to build
complete rules
• AutoCEP (stage 2)
• This modules transforms the learned patterns into predictive CEP rules
9
The Overall Architecture
Extract
univariate
shapelets
Dd
Classified
MTS
USE
CEP
Engine
Combine
shapelets
into TAS
Shapelets
Predictive
CEP Rules
SEE
autoCEP
TASD
Design
-time
Runtime
Transform
TAS into
CEP rules
10
Step 1: USE
Shapelet
Learning
Shapelet
Learning
Shapelet
Learning
Shapelet
Learning
Shapelet
Learning
MTS = Multivariate Time Series
Shapelet
Learning
Univariate Time Series
Shapelets
11
Step 2: SEE
MTS encoded:
Sequence
Learning
Sequences
Time Constraint Learning
Δt1
Time-annotated
Sequences
Δt2
12
Step 3: AutoCEP
• The whole picture
Δt2
• Each TAS is transformed into a set of simple
rules and one complex rule
• A simple rule is a transformation of each
individual shapelet into the CEP language
• A complex rule is a transformation of the whole
pattern into the CEP language
Transformed
into simple rules
Transformed
into a complex rule
• It captures all constraints: sequence and time windows between shapelets (i.e., between
simple rules)
Create a unique
Named Window
For each TAS
For each shapelet in TAS
Create complex
CEP rule
Create simple
CEP rule
13
Named Windows Creation
• The chaining of simple rules and complex rules is done through CEP Named
Windows
• NW is a table-structured window with column headers and data types (like an
SQL table).
• NW could be treated exactly like a stream of events but the only difference is that
it is created explicitly
• CEP rules could listen to NWs and match events that enter these windows
• For every TAS
Δt2
a unique named window is created
14
Simple CEP Rule Creation
• Each shapelet in a TAS is transformed into a CEP rule
• A simple rule matches whenever received events are similar to the shapelet that
it represents
• To convey this in CEP jargons: for sh = (s, δ, cs, score)
…
• When a simple rule matches it should emit its start and end time and the
dimension that it is concerned with to its unique named window. To do this:
15
Complex CEP Rule Creation
2
sh3
3
sh1
sh2
• Named window NW1 created
NW1 (start, end, dimension)
(1,4,3), (2,5,3), (4,8,1), (6,11,2),…
• 3 simple rules created
• They emit their matches to NW1
• Complex Rule:
• For every a=NW(dim=3) 
b=NW(dim=1, start – a.start ≤ 2) 
c=NW(dim=2, start – b.start ≤ 3)
• createComplexRule(SH, W, NW):
• When the complex rule matches the
class could be predicted
16
Evaluation
• AutoCEP records the variation of classes over time for a given stream
• Closest classification: the most similar so far
17
Closest Classification: Comparison
Wafer
ECG
[REACT, 2015]
[MSD, 2013]
Robots
18
Sensitivity of Parameters
The ECG dataset
20
Learning Time
Brute and mass to compute distances
O means an optimized version with multithreading
Time Complexity
USE(brute) =
O(d.n.(m2.log(n)))
USE(mass) =
O(d.n.log(n))
SEE = O(n.m.d!)
autoCEP has no
time complexity
21
Interpretability of Rules
22
Conclusion
• Assumptions:
• The approach works with the existence of classified multivariate time series
• Contributions:
• Generic to be used whenever the assumption is fulfilled
• The first approach to automatically generate predictive CEP rules
• CEP could be more easily employed in predictive applications
• It is more suitable for predicting abnormal instances
• Limitations:
• Doesn’t deal with categorical events
• Learning time is expensive
24
References
[Margara, 2014] et al. “Learning from the past: automated rule generation for
complex event processing”. DEBS, 2014.
[Margara, 2014] et al. “Towards automated rule learning for complex event
processing”. Tech Report, 2013.
[Mutschler, 2012] et al. “Learning event detection rules with noise hidden Markov
models”. AHS, 2012.
[Sen, 2010] et al. “An approach for iterative event pattern recommendation”. DEBS,
2010.
[Turchin, 2009] et al. “Tuning complex event processing rules using the predictioncorrection paradigm”. DEBS, 2009.
[Ye, 2009], and Eamonn Keogh. "Time series shapelets: a new primitive for data
mining." Proceedings of the 15th ACM SIGKDD international conference on
Knowledge discovery and data mining. ACM, 2009.
25
References
• [Fulop, 2010] Fülöp, Lajos Jenő, et al. "Survey on complex event processing and
predictive analytics." Proceedings of the Fifth Balkan Conference in Informatics. 2010.
• [Engel, 2012] Engel, Yagil, Opher Etzion, and Zohar Feldman. "A basic model for
proactive event-driven computing." Proceedings of the 6th ACM international conference
on distributed event-based systems. ACM, 2012.
• [REACT, 2015], Lin, H.-H. Chen, V. S. Tseng, and J. Pei. Reliable early
classication on multivariate time series with numerical and categorical attributes.
In Advances in Knowledge Discovery and Data Mining, pages 199-211. Springer,
2015.
• [MSD, 2013] Ghalwash, V. Radosavljevic, and Z. Obradovic. Extraction of
interpretable multivariate patterns for early diagnostics. In Data Mining (ICDM),
2013 IEEE 13th International Conference on, pages 201-210. IEEE, 2013.
26
27