Raef Mousheimish, Yehia Taher and Karine Zeitouni
DAIVD Laboratory, University of Versailles, France
Automatic Learning of
Predictive CEP RulesBridging the Gap between Data Mining and
Complex Event Processing
33ème conférence sur la Gestion de Données — Principes, Technologies et Applications, Nancy 14-17 novembre 2017
The 11th ACM International Conference on Distributed and Event-Based Systems
Context
• CEP helps to instantaneously react against occurring situations
• Employed in different domains• Environmental monitoring
• Fraud detection
• Financial applications
• Anomaly detection
• CEP engines are totally guided by CEP rules• The only inference mechanism in the CEP world
2
CEP Engine
Events
Composite events, results, alerts, …
CEP Rules
Examples of Rules
• Simple CEP Rule:
SELECT * FROM WE.win:time(2 minutes) HAVING avg(temperature)>10
• Complex CEP Rule:
CREATE WINDOW tempWin.win:keepall() (place String, avg int)
INSERT INTO tempWin SELECT * FROM WE.win:time(2 minutes) HAVING avg(temperature)>10
SELECT * FROM PATTERN [EVERY a = tempWin(avg>15) b = tempWin(avg> a.avg)
3
Motivation
• Event-based systems is an active area of research• Scalability
• Latency
• Distribution
• Almost all scenarios and problems tackled by researchers have reactive traits• Anomaly, traffic jam, fraud detection
• What if anomaly needs to be predicted?• E.g., in a manufacturing process
• The usage of CEP in such examples is not at all evident
4
Predictive CEP
• It has been mentioned several times as a future direction and as proposals on the conceptual level [Fulop, 2010] [Engel, 2012]
• However it remains a vision• No real attempt to produce an easy-to-use predictive CEP system
• The main cause: CEP rules need to be specified manually• No support is provided for users to define these rules
• It is hard for experts to manually write rules that predict situations• This is why domains such as data mining and predictive analytics exist in the first place
• There exists a gap between predictive analytics and CEP that needs to be bridged
5
Our Objectives
• Overtake the de facto approach regarding the definition of CEP rules• Manual to automatic
• Go from merely reactive rules into predictive rules
• Allow for the CEP technology to be easily employed in predictive applications
• Create a generic solution that could be used in different domains
• Bridge a gap between data mining and complex event processing
6
Context & Motivation
High Level Goals
Objectives
ContributionsUnivariate Shapelet Extraction
Sequence Extraction
Automatic Learning of Predictive CEP Rules
Evaluations
Conclusion
Outline
Early Classification on Time Series
• A predictive analytics field that fits exactly our goals of creating a generic and predictive approach
• Time series means timestamped events
• Early classification means predictive rules
• Shapelet-based classification style:• Devised in 2009 [Ye, SIGKDD 2009]
• Temporal patterns that are associated with classes
• By definition it works on univariate time series
• Suitable for anomaly prediction
8
Definitions
• A shapelet sh = (s, δ, cs, score)• s is the subsequence of a time series
• δ is the distance threshold
• cs is the class of the shapelet
• score is a utility score
9
Shapelets
The best shapelets:1. Have the smallest length2. Frequent3. Discriminative
Real artwork Transport Data
Definitions
• A multi-dimensional time series MTS dT = {T1, T2, …, Td}
• Data set of d-dimensional time series: Dd = {(dT, c)}
• TAS (Time-Annotated Sequence) is a sequence of shapelets with time annotations between them: sh1 sh2 sh3
• TAS are associated with a class: sh1 sh2 sh3 c• If the TAS appeared then c will probably occur
10
2 3
2 3
Multivariate Setting
Problem Statement
In general: How to go from classified multivariate time series into ready-to-deploy predictive CEP rules?
1. How to go from classified multivariate time series into time-annotated sequences?
2. How to transform time-annotated sequences into ready predictive CEP rules?
11
Contribution 1Input: Classified multivariate time series
Output: Time-annotated sequences
Contribution 2Input: Time-annotated sequences
Output: Predictive CEP rules
Our Proposal
• Two Contributions:1. USE & SEE algorithms to extract predictive temporal patterns with time and sequence
constraints (TAS)
2. A compiler (autoCEP) that transforms these patterns on-the-fly into predictive CEP rules
12
USE SEEDdClassified MTS
Shapelets TAS
autoCEPCEP
Engine
Predictive CEP Rules
Learning time
Real time
Univariate Shapelet Extractor
SEquenceExtractor
Transform TAS into CEP rules
TAS records
Multivariate time series
Step 1: Univariate Shapelet Extractor (USE)
13
Shapelet Learning
Shapelet Learning
Shapelet Learning
Shapelet Learning
Shapelet Learning
Shapelet Learning
MTS = Multivariate Time Series
Univariate Time Series Shapelets
USE SEEDd Classified MTS
Shapelets TAS
autoCEPCEP
EnginePredictive CEP Rules
Parameter-Free
Shapelet Learning
14
Get all subsequences between the lengths
For each subsequence
Calculate SimilaritiesCalculate Distance
ThresholdCalculate Utility
Score
End Loop
Three types of distance measures: Euclidean Distance (default)Dynamic time warpingMass (frequency domain) [Yeh, ICDM 2016]
Pruning• Top K pruning
• Normal top-k pruning
• Depending on the utility score
• Cover pruning
15
Sort
Mark the instances that
it covers
While not all data set is covered and there is still shapelets to test Marked > 0
acceptyes
no
Step 2: SEquenceExtractor (SEE)
16
Δt1
Time Constraint Learning
Sequence Learning
shapelets that constitute the sequences are associated with the same class
Time-annotated Sequences
Dd encoded:
USE SEEDd Classified MTS
Shapelets TAS
autoCEPCEP
EnginePredictive CEP Rules
Parameter-Free
Sequences
• Each TAS is transformed into a set of simplerules and one complex rule
• A simple rule is a transformation of eachindividual shapelet into the CEP language
• A complex rule is a transformation of the wholepattern into the CEP language
• It captures all constraints: sequence and time windows between shapelets (i.e., between simple rules)
Step 3: Automatic Generation of CEP Rules (AutoCEP)
17
Δt2
Transformed into simple rules
Transformed into a complex rule
USE SEEDd Classified MTS
Shapelets TAS
autoCEPCEP
EnginePredictive CEP Rules
Simple CEP Rule Generation
• Each shapelet in a TAS is transformed into a CEP rule
• A simple rule matches whenever received events are similar to the shapelet that it represents
• To convey this in CEP jargons: for sh = (s, δ, cs, score)
18
…
Δt2
Transformed into simple rules
Transformed into a complex rule
• Named window NW created
• 3 simple rules created• They emit their matches to NW
• Complex Rule: • For every a=NW(dim=3) b=NW(dim=1, start – a.start ≤ 2) c=NW(dim=2, start – b.start ≤ 3)
• The chaining of simple rules and complex rules is done through CEP Named Windows
Complex CEP Rules Generation
19
CEP Rule 1CEP Rule 2Input Stream: Sensors
ResultsNamed Window
listenslistens
outputs outputs
CEP Engine
2 3
Dim 1
Dim 2
Dim 3
Complete Picture of CEP Rules Generation
• Named Windows:
• Simple CEP Rules:
20
• Complex CEP Rules:
Experiments: Multivariate Time Series
• Different variants of classification:1. Closest classification: Classify according to closest pattern so far
2. First Classification: Classify according to the first matched pattern
3. Abnormality Detection: Ignore normal instances
4. Majority voting: Check every instance with every rule
21https://archive.ics.uci.edu/
Objectives
QualityPerformanceInterpretability
Metrics
Average f-score (the higher the better)Earliness: (the lower the better)Accuracy (the higher the better)Applicability (the higher the better)Learning time (the lower the better)
Closest Classification: Comparison
22
WaferECG
Robots
[REACT, 2015][MSD, 2013]
Approach Avg. f-score
Earliness App. Acc.
autoCEP 90.5% 28.7% 100% 92.6%
REACT 91.9% 32.8% 100% -
Full 1NN 87.2% 100% 100% 89.9%
Approach Avg. f-score
Earliness App. Acc.
autoCEP 81% 21.2% 100% 82.7%
REACT 76.7% 10.5% 100% -
Full 1NN 87.7% 100% 100% 88.7%
MSD 58.8% 12.8% 100% -
Approach Avg. f-score Earliness App. Acc.
autoCEP 76.6% 50% 100% 80.8%
REACT 72.7% 40.7% 94.7% -
Full 1NN 71.9% 100% 100% 79.3%
MSD 39.6% 27.4% 96.3% -
All Classifications
23
85.891.3
82.2
94.9
27 28.6 30
100
86.3 85.782.4
95.1
33 35 37
100
FIRST CLASSIFICATION CLOSEST CLASSIFICATION ABNORMALITY DETECTION MAJORITY VOTING
Classification Methods
Wafer:Acc Wafer:Earliness ECG:Acc ECG:Earliness
Sensitivity of Parameters
24
The ECG dataset
Lengths (min, max) Distance Measure
Pruning minAcc (SEE)
Learning Time
25
Brute and mass to compute distances
O means an optimized version with multithreading
Time Complexity
USE(brute) = O(d.n.(m2.log(n)))
USE(mass) = O(d.n.log(n))
SEE = O(n.m.d!)
autoCEP has no time complexity
Empirical experiments with synthetic data
Interpretability of Rules
26
ECG Data Example Wafer Data Example
Conclusion
Learning of advanced temporal patterns from multivariate time series with USE & SEE
• Adopt shapelets in the multivariate settings
• Step further from current state-of-the-art approaches
• Including sequencing and time constraints
Automatic learning of predictive CEP rules with autoCEP• Learn data-driven rules
• First approach to learn predictive rules
• Employ the CEP technology in predictive contexts without complexity
More Optimization techniques will be integrated
27
References
[Margara, 2014] et al. “Learning from the past: automated rule generation for complex event processing”. DEBS, 2014.
[Margara, 2014] et al. “Towards automated rule learning for complex event processing”. Tech Report, 2013.
[Mutschler, 2012] et al. “Learning event detection rules with noise hidden Markov models”. AHS, 2012.
[Sen, 2010] et al. “An approach for iterative event pattern recommendation”. DEBS, 2010.
[Turchin, 2009] et al. “Tuning complex event processing rules using the prediction-correction paradigm”. DEBS, 2009.
[Ye, 2009], and Eamonn Keogh. "Time series shapelets: a new primitive for data mining." Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining. ACM, 2009.
28
References
• [Fulop, 2010] Fülöp, Lajos Jenő, et al. "Survey on complex event processing and predictive analytics." Proceedings of the Fifth Balkan Conference in Informatics. 2010.
• [Engel, 2012] Engel, Yagil, Opher Etzion, and Zohar Feldman. "A basic model for proactive event-driven computing." Proceedings of the 6th ACM international conference on distributed event-based systems. ACM, 2012.
• [REACT, 2015], Lin, H.-H. Chen, V. S. Tseng, and J. Pei. Reliable early classication on multivariate time series with numerical and categorical attributes. In Advances in Knowledge Discovery and Data Mining, pages 199-211. Springer, 2015.
• [MSD, 2013] Ghalwash, V. Radosavljevic, and Z. Obradovic. Extraction of interpretable multivariate patterns for early diagnostics. In Data Mining (ICDM), 2013 IEEE 13th International Conference on, pages 201-210. IEEE, 2013.
29
30