Methods for identifying partial periodic patterns of infrequent events in an event sequences

[0002] This application is related to the application 091585,757 entitled “Methods for Identifying Partial Periodic Patterns and Corresponding Event Subsequences in an Event Sequence”, which is commonly assigned and concurrently filed herewith, and the disclosure of which is incorporated herein by reference.

[0003] 1. Technical Field

[0004] The present invention generally relates to data mining and, more particularly, to identifying partial periodic patterns in an event sequence. Imperfect patterns may be transformed into perfect patterns through random replacement of events.

[0005] 2. Background Description

[0006] Periodic pattern discovery is an important problem in mining time series data. A periodic pattern is a list of ordered events which repeats itself in an event sequence. Periodic pattern discovery is useful in characterizing the cyclic behavior of time series data. However, in practice, not every portion in the time series data contributes to the repetitiveness of a given pattern(s) in the time series. For example, the stock of a particular company may gain a few points at the beginning of each trading session but may not have much regularity at other times. This type of looser repetitiveness is often referred to as “partial periodicy”.

[0007] Moreover, due to random noise, a pattern may not always be perfectly repeated. Thus, the event sequence can be viewed as a series of perfect pattern repetitions with a few “random replacements”. That is, the event sequence would become a series of perfect repetitions of some pattern after a few replacements (of some of the events in the sequence). If the amount of “replacement” is below some reasonable threshold, the pattern may be considered to be “exhibited” in the event sequence.

[0008] The mining of time series data is a newly developing research area. Most of the previous work on mining time series data includes creating a mapping to the association rule mining technique, i.e., each event corresponds to an item and every certain number of consecutive events are treated as a transaction. Metrics referred to as “support” and “confidence” are used to identify significant patterns from the remaining data. The support of a pattern is the number of occurrences of that pattern within a sequence of events. The confidence of a pattern is defined as the fraction specified by the number of occurrences of the pattern within the sequence of events over the length of the sequence. Most association rule mining methods favor frequently occurring events. However, patterns involving infrequent events may also be as significant as (or even more significant than) frequent events in an event sequence. This issue becomes more critical when different events occur at divergent frequencies. As examples, consider the following three illustrative applications.

[0009] The first application corresponds to the workload on a cluster of web servers. In the example, the cluster consists of 5 servers, with the workload on each server being measured by the following 4 ranks: low; relatively low; relatively high; and high. Thus, there are 4⁵(1024) different events, one for each possible combination of server states. Examination of the cluster states over time may show that the fluctuations of the server states comply with some periodic behavior. Obtaining such knowledge would be very beneficial for understanding the behavior of the cluster and for improving its performance.

[0010] The second application corresponds to earthquakes. In general, earthquakes are classified by their magnitude and type. Scientists may be interested in knowing whether there exists any inherent seismic period so that future earthquake predictions can be made. Note that patterns involving big earthquakes are much more valuable than patterns involving small earthquakes, even though big earthquakes occur at a much lower frequency than small earthquakes.

[0011] The third application is the stock market. Stock investors would like to understand the movement of the stock market so that they can take advantage of the movement to maximize their profits. In the example, the movement of the market on any given day can be categorized by the following descriptions: significant increase; moderate increase; unchanged; moderate decrease; and significant decrease. Even though movements such as significant increase and significant decrease occur less frequently than the other types of movements, the importance of capturing the former types of movements is readily apparent.

[0012] The above examples share a common characteristic; that is, different events may exhibit different rates of occurrence. Further, the above examples also show that patterns involving infrequent events are also of great importance. Thus, it would be desirable and highly advantageous to identify any strong tendency incurred by an event (or combination of events). Consider the following event sequence, a₁a₁a₁a₁a₁a₂a₁a₁a₂a₁a₃a₂a₃a₁a₃a₃a₁a₃a₁a₁. The event a₁occurs 12 times while the event a₂occurs only 3 times. Despite its low frequency, the occurrence of a₂follows a very strong pattern. In particular, an occurrence of a₂is followed by another occurrence of a₂three positions later. This type of tendency or pattern in the event sequence may be very crucial in some application domains.

[0013] A closer look will now be taken at the following two patterns (a₁, *, *) and (a₂, *, *), wherein * represents an “eternal event”. An eternal event is a virtual event that matches any event. Thus, an eternal event can be used to represent the “don't care” position in a pattern. An eternal event may also be referred to as “non-distinct”, in which case an event such as a₂may also be referred to as “distinct”. Even though the support of (a₁, *, *) is greater than that of (a₂, *, *) (due to the fact that al occurs much more frequently than a₂), no strong tendency is preserved by the occurrence of a₁. In the support/confidence model, in order to find pattern (a₂, *, *), the support threshold has to be set lower than 3. In general, this would lead to the examination of a larger number of patterns which do not exhibit a strong tendency (e.g., (a₁, *, *)). This indicates that support is not necessarily a proper measurement in evaluating periodic patterns. Thus, a new metric to measure the significance of a pattern needs to be designed to meet this goal. The support/confidence thresholds can be viewed as “absolute” bounds applied to every event irrespective of their occurrence frequencies.

[0014] Thus, it would be desirable and highly advantageous to have a new metric for use in data mining which overcomes the deficiencies of the metrics of the prior art. Moreover, it would be desirable and highly advantageous to have a method for identifying significant patterns in subsequences of an event sequence.

[0015] The problems stated above, as well as other related problems of the prior art, are solved by the present invention, a method for identifying partial periodic patterns in event sequences.

[0016] According to a first aspect of the invention, there is provided a method for mining partial periodic patterns in an event sequence, wherein each pattern includes a list of events from the event sequence. At least one subsequence of the event sequence and at least one pattern in the at least one subsequence are identified, such that an information gain of the at least one subsequence with respect to the at least one pattern exceeds a predefined threshold. At least one of the at least one pattern and the at least one subsequence is stored.

[0017] According to a second aspect of the invention, each of the events in a given pattern is one of distinct and non-distinct, wherein each non-distinct event matches any of the distinct events.

[0018] According to a third aspect of the invention, the method further includes the step of determining the information gain of the at least one subsequence with respect to the at least one pattern. The determining step includes the step of dividing the at least one subsequence into contiguous segments, wherein each contiguous segment is a same length as the at least one pattern. For each contiguous segment, the information gain of the contiguous segment is calculated, when all of the events of the contiguous segment match the corresponding events of the at least one pattern. The information loss of the contiguous segment is calculated, when at least one of the events of the contiguous segment does not match the corresponding event of the at least one pattern. The information gain of the at least one subsequence si calculated, by summing the information gain and the information loss of each of the contiguous segments comprised therein.

[0019] According to a fourth aspect of the invention, the step of calculating the information gain of each of the contiguous segments includes the steps of assigning an information value to the at least one pattern, and assigning an information loss to at least one deviated pattern from the at least one pattern.

[0020] According to a fifth aspect of the invention, the step of assigning an information value to the at least one pattern includes the steps of determining an information value of each of the events in the at least one pattern, and summing the information values of each of the events in the at least one pattern.

[0021] According to a sixth aspect of the invention, the step of determining the information value of each of the events in the pattern includes the step of determining a probability of occurrence in the event sequence of each of the events in the pattern.

[0022] According to a seventh aspect of the invention, the method further includes the step of replacing at least one of the events in the at least one pattern, to obtain a higher degree of repetitiveness of the events in the at least one pattern with respect to the at least one subsequence.

[0023] According to an eight aspect of the invention, the at least one subsequence maximizes the information gain of the at least one pattern with respect to any other subsequences of the event sequence.

[0024] According to a ninth aspect of the invention, the step of identifying the at least one subsequence includes the step of identifying a subsequence of the event sequence that maximizes the information gain with respect to a pattern contained therein.

[0025] According to a tenth aspect of the invention, there is provided a method for mining partial periodic patterns in an event sequence, wherein each pattern comprising a list of events from the event sequence. Singular patterns are identified in the event sequence, wherein each singular pattern has only one position filled by one of the events in the event sequence. Complex patterns are identified in the event sequence, wherein each complex pattern has more than one position filled by one of the events in the event sequence. The complex patterns and subsequences of the event sequence that comprise the complex patterns are identified, such that an information gain of each of the subsequences with respect to the complex pattern comprised therein exceeds a predefined threshold. At least one of the complex patterns and the subsequences that contain the complex patterns are stored.

[0026] These and other aspects, features, and advantages of the present invention will become apparent from the following detailed description of preferred embodiments, which is to be read in connection with the accompanying drawings.

[0027] FIG. 1 is a block diagram of a computer processing system 100 to which the present invention may be applied according to an illustrative embodiment thereof;

[0028] FIG. 2 is a flow diagram illustrating the overall process of mining periodic patterns in an event sequence, according to an illustrative embodiment of the invention;

[0029] FIG. 3 is a flow diagram illustrating the process of OIS pruning for all events with all possible period lengths (steps 210 and 212 of FIG. 2), according to an illustrative embodiment of the invention;

[0030] FIG. 4 is a flow diagram illustrating the process of computing OIS values for all events with a given period length 1 (step 310 of FIG. 3), according to an illustrative embodiment of the invention;

[0031] FIG. 5 is a flow diagram illustrating the process of transforming the input event sequence into four sequences of real numbers (step 410 of FIG. 4), according to an illustrative embodiment of the invention;

[0032] FIG. 6 is a flow diagram illustrating the process of computing the OIS value of a particular event at each position for a given period (step 412 of FIG. 4), according to an illustrative embodiment of the invention;

[0033] FIG. 7 is a flow diagram of a process for generating MIG counts based on OIS values for a given period (312 of FIG. 3), according to an illustrative embodiment of the invention;

[0034] FIG. 8 is a flow diagram illustrating a process for computing MIG counts (step 214 of FIG. 2), according to an illustrative embodiment of the invention;

[0035] FIG. 9 is a flow diagram illustrating the process of generating candidate patterns from MIG counters (step 216 of FIG. 2), according to an illustrative embodiment of the invention;

[0036] FIG. 10 is a flow diagram illustrating the process of validating a candidate pattern P (step 218 of FIG. 2), according to an illustrative embodiment of the invention;

[0037] FIG. 11 is a flow diagram illustrating the process of extending the current subsequence to increase information gain (step 1016 of FIG. 10), according to an illustrative embodiment of the invention; and

[0038] FIG. 12 is a flow diagram illustrating the process of maintaining the current subsequence by subtracting information loss (step 1018 of FIG. 10), according to an illustrative embodiment of the invention.

[0039] The present invention is directed to identifying partial periodic patterns in event sequences. Imperfect patterns in an event sequence may be transformed into perfect partial periodic patterns through random replacement of events. The invention is particularly suited for data mining applications, as well as other applications.

[0040] It is to be understood that the present invention may be implemented in various forms of hardware, software, firmware, special purpose processors, or a combination thereof. Preferably, the present invention is implemented in software as an application program tangibly embodied on a program storage device. The application program may be uploaded to, and executed by, a machine comprising any suitable architecture. Preferably, the machine is implemented on a computer platform having hardware such as one or more central processing units (CPU), a random access memory (RAM), and input/output (I/O) interface(s). The computer platform also includes an operating system and micro instruction code. The various processes and functions described herein may either be part of the micro instruction code or part of the application program (or a combination thereof) which is executed via the operating system. In addition, various other peripheral devices may be connected to the computer platform such as an additional data storage device and a printing device.

[0041] It is to be further understood that, because some of the constituent system components and method steps depicted in the accompanying Figures are preferably implemented in software, the actual connections between the system components (or the process steps) may differ depending upon the manner in which the present invention is programmed. Given the teachings of the present invention provided herein, one of ordinary skill in the related art will be able to contemplate these and similar implementations or configurations of the present invention.

[0042] FIG. 1 is a block diagram of a computer processing system 100 to which the present invention may be applied according to an illustrative embodiment thereof. The computer processing system includes at least one processor (CPU) 102 operatively coupled to other components via a system bus 104. A read-only memory (ROM) 106, a random access memory (RAM) 108, a display adapter 110, an I/O adapter 112, and a user interface adapter 114 are operatively coupled to the system bus 104.

[0043] A display device 116 is operatively coupled to the system bus 104 by the display adapter 110. A disk storage device (e.g., a magnetic or optical disk storage device) 118 is operatively coupled to the system bus 104 by the I/O adapter 112.

[0044] A mouse 120 and keyboard 122 are operatively coupled to the system bus 104 by the user interface adapter 114. The mouse 120 and keyboard 122 may be used to input/output information to/from the computer processing system 100. It is to be appreciated that other configurations of computer processing system 100 may be employed in accordance with the present invention while maintaining the spirit and the scope thereof.

[0045] To facilitate a clear understanding of the invention, a brief description of the invention will now be given, followed by definitions of terms and designations employed herein.

[0046] The invention provides a new metric, henceforth referred to as “information gain”, to measure the degree of significance of patterns exhibited within a subsequence of data. The invention also provides an efficient method for mining significant periodic patterns together with their corresponding subsequences.

[0047] According to the invention, the model of an imperfect periodic pattern is relaxed by allowing a pattern to be significant during a contiguous portion of the entire sequence. A user is asked to specify the minimum information gain a significant pattern must carry over a subsequence of data. Upon satisfying this requirement, the subsequence(s) that maximizes the information gain of a pattern will be identified. In the previous example, the pattern (a₂, *, *) is very significant in the subsequence a₂a₁a₁a₂a₁a₃a₂a₁a₁, but not over the entire sequence.

[0048] Let t={a₁, a₂, . . . ,} be a set of events. A pattern with period 1 is an array of l events (p₁, p₂, . . . , p₁), each of which is either an event in t or an eternal event *. The jth position of the pattern is “instantiated” if p_jis an event in t. For any two patterns P=(p₁, p₂, . . . , p₁) and p′=(p₁′, p₂′, . . . , p₁′) of the same period 1, P is a “superpattern” of P′ (P′ is a “subpattern” of P) if p′_j=* or p_j=p′_j, for all 1<=j<=1. Note that an event can appear at multiple positions in a pattern. For example, (a₁, a₄, *, *, a₄) is a pattern of period 5 and its first, second and fifth positions are instantiated. It is also a superpattern of (a₁, *, *, *, a₄). A pattern is called a “singular pattern” if only one position is instantiated. A pattern is called a “complex pattern” if multiple positions are instantiated.

[0049] Our model of an imperfect periodic pattern of (p₁, p₂, . . . , p₁) allows for replacement of a small number of the p_j's in an otherwise perfect repetition of the pattern. That is, according to the invention, an imperfect periodic pattern is a pattern that can be made into a perfect periodic pattern after a few replacements in the event sequence.

[0050] For an event a_jand a sequence D of events, let Prob(a_j) be the expected probability that a_joccurs at any given position in D. Then, the information of a_jwith respect to D is defined as I(a_j)=log (1/Prob(a_j))=−log Prob(a_j). The information of the eternal event * is always 0 since Prob(*)=1. The information of a pattern P=(p₁, p₂, . . . , p₁) is the summation of the information carried by each individual position. For example, the information of pattern (a₁, a₄, *, *, a₄) is I(a₁)+I(a₄)+I(*)+I(*)+I(a₄). Given a pattern P=(p₁, p₂, . . . , p₁) and a segment of l events D′=d₁, d₂, . . . , d₁, D′ is in compliance with P at position j if and only if either p_jis an eternal event * or p_j=d_j, and D′ supports P (or P matches D′) if D′ is in compliance with P at all positions. Given a sequence of N events D=d₁, d₂, . . . , d_Nand a pattern P, the support of P within D is the number of segments d_l×j+1, d_l×j+2, . . . , d_l×j+1in D that support P. Given a pattern P=(p₁, p₂, . . . , p₁) with period 1 and a segment of l events D′=d₁, d₂, . . . , d₁, the information loss of D′ on position j with respect to P is the information of the event p_jif D′ is not in compliance with P at position j and there is no information loss otherwise. The overall information loss of D′ with respect to P is the summation of the information loss of each position. Given a pattern P with period l and a sequence D of N (N>=1) events: d₁, d₂, . . . , d_N, the information loss of D with respect to P is the summation of the information loss of each segment d_l×j+1, d_l×j+2, . . . , d_l×j+1with respect to P. The information gain of D with respect to P is defined as I(P)×(S_D(P)−1)−L_D(P) where I(P), S_D(P), and L_D(P) are the information of P, the support of P within D, and the information loss of D with respect to P, respectively. Given a pattern P, a sequence D and an information gain threshold g, if there exists a subsequence D″ of D such that the information gain of D″ with respect to P is at least g, then P is a “valid pattern”. Consider the event sequence a₁a₁a₁a₁a₁a₂a₁a₁a₂a₁a₃a₂a₃a₁a₃a₃a₁a₃a₁a₁. The information of the occurrence of a₁is −log₃(12/20)=0.46 while the information of the occurrence of a₂is −log₃(3/20))=1.73. The information gain of (a₂, *, *) in subsequence a₂a₁a₁a₂a₁a₃a₂a₃a₁is 3.46, while the information gain of (a₁, *, *) in subsequence a₁a₁a₁a₁a₁a₂a₁a₁a₂a₁a₃a₂is 1.38. If g=3 is specified as the information gain threshold, then pattern (a₂, *, *) would satisfy the threshold, but not (a₁, *, *). This is due to the fact that the event a, occurs much more frequently than a₂.

[0051] Two properties associated with data mining are the downward closure property and the triangle inequality. The downward closure property may be defined as follows: for three itemsets A, B, and AB, the support of AB is always less than the minimum support of A and B. The triangle inequality may be defined as follows: for three itemsets A, B, and AB, the information gain of AB is less than or equal to the sum of that of A and B.

[0052] Although the information gain is a more meaningful metric for the problems addressed previously, it does not preserve the downward closure property (as the support does). For example, the pattern (a₁, a₂, *) may have enough information gain while both (a₁, *, *) and (*, a₂, *) do not. We cannot take advantage of the standard pruning technique developed for mining association rules. The observation that the triangle inequality is still preserved by the information gain motivates us to devise a threefold method.

[0053] For any two patterns p=(p₁, p₂, . . . , p₁) and P′=(p₁′, p₂′, . . . , p₁′) of the same period 1, P and P′ are “complementary” if either p_j=* or p_j′=* for all 1<=j<=1. A set of patterns of the same period are said to be complementary if every pair of patterns in the set are complementary. Given a set P of complementary patterns of the same period 1, the “minimum common superpattern” (MCSP) of the set P is the pattern P′ of period 1, which satisfies the following two conditions:

[0054] (1) Each pattern in the set P is a subpattern of pattern P′.

[0055] (2) There does not exist another subpattern P″ of P′ such that each pattern in the set P is also a subpattern of P″.

[0056] It follows from the definition that the information of the MCSP of a set, P, of complementary patterns is the summation of the information of each pattern in P. For example, (a₁, a₃, *, *, *), (*, *, *, a₂, *), and (*, *, *, *, a₄) are complementary and their MCSP is (a₁, a₃, *, a₂, a₄). The triangle inequality can be stated as, given an event sequence D and a set of complementary patterns P, let Q be the minimum common super pattern of P, then the information gain of D with respect to Q is at most the summation of that of each pattern in P. An example of triangle inequality is that the information gain of (a₁, a₂, *) cannot exceed the summation of that of (a₁, *, *) and (*, a₂, *).

[0057] A brief description of the present invention will now be given with respect to FIG. 2. More detailed descriptions of the present invention follow with respect to FIGS. 3-12.

[0058] FIG. 2 is a flow diagram illustrating the overall process of mining periodic patterns in an event sequence, according to an illustrative embodiment of the invention. The optimal information surplus (OIS) values are calculated for all distinct events and all possible periods in a given event sequence (step 210). An OIS value is a bound of the information gain that an event could accumulate for a given period. It is then determined whether an event exists with positive OIS value (step 212). If not, the method is terminated. Otherwise, maximum information gain (MIG) counting is used to further prune the candidate patterns (step 214). A MIG value is a bound of the information gain that an event could accumulate for a given position in a pattern of a given period. The candidate patterns are generated, based upon the MIG counts (step 216). The candidate patterns are then validated (step 218).

[0059] FIG. 3 is a flow diagram illustrating the process of OIS pruning for all events with all possible period lengths (steps 210 and 212 of FIG. 2), according to an illustrative embodiment of the invention. The method of FIG. 3 (i.e., steps 310 and 312) is repeated for each period 1.

[0060] For a period length 1, the OIS values for all events are computed (step 310). Next, the MIG counters are generated (step 312). It is then determined whether there exists any more periods 1 (step 314). If so, the method returns to step 310. Otherwise, the method is terminated.

[0061] FIG. 4 is a flow diagram illustrating the process of computing OIS values for all events with a given period length 1 (step 310 of FIG. 3), according to an illustrative embodiment of the invention. The method of FIG. 4 (i.e., steps 410 and 412) is repeated for each distinct event a_k.

[0062] For a distinct event a_k, the input event sequence is transformed into four sequences of real numbers, x(a_k), y(a_k), z(a_k), and e(a_k) (step 410). The OIS value of a_kis computed at each position in the period (step 412). It is then determined whether there exists any more distinct events a_k(step 414). If so, the method returns to step 410. Otherwise, the method is terminated.

[0063] FIG. 5 is a flow diagram illustrating the process of transforming the input event sequence into four sequences of real numbers (step 410 of FIG. 4), according to an illustrative embodiment of the invention. The method of FIG. 5 (i.e., steps 510 through 524) is repeated for each event d occurring at the ith position in the sequence.

[0064] The four sequences of real numbers are designated as x, y, z, and e, as shown at step 410 of FIG. 4. These four sequences capture the information loss, information, information adjustment, and the number of occurrences of ak in previous l positions in the event sequence, respectively, for each position of the event sequence. According to the method of FIG. 5, each event in the sequence is examined sequentially.

[0065] For an event d occurring at the ith position in the sequence, it is determined whether d is a_k(step 510). If d is not a_k, then the method proceeds to step 522. However, if d is a_k, then the method proceeds to step 512.

[0066] At step 512, the variable dis is assigned to be the distance to the previous occurrence of a_kin the sequence. The real numbers to which the event d is transformed in sequences x and y are computed (step 514). Step 514 can also be represented as follows:

[0067] x(a_k,l,i)<−┌(dis−l)/l I(a_k)

[0068] y(a_k,l,i)<−I(a_k)

[0069] Then, it is determined whether event a_kalso occurred at position (i−1) in the event sequence (step 516). If so, zero is assigned to the information adjustment in the z sequence z(a_k,l,i)) (step 518), and the method proceeds to step 524. Otherwise, −I(a_k) is assigned to the information adjustment in the z sequence (i.e., z(a_k,l,i)) (step 520), and the method proceeds to step 524.

[0070] At step 522 (d is not a_k, at step 510), zero is assigned to all x, y, and z sequences (i.e., x(ak,l,i), y(a_k,l,i), z(a_k,l,i)), and the method proceeds to step 524. At step 524, the number of occurrences of a_kin previous l positions is assigned to the e sequence (i.e., e(a_k,l,i)).

[0071] It is then determined whether there exists any more events d occurring at the ith position in the sequence (step 514). If so, the method returns to step 510. Otherwise, the method is terminated.

[0072] FIG. 6 is a flow diagram illustrating the process of computing the OIS value of a particular event at each position for a given period (step 412 of FIG. 4), according to an illustrative embodiment of the invention.

[0073] A variable f is initialized to zero (0) and an index i is set to one (1) (step 610). It is determined whether the end of the event sequence has been reached (step 612). If so, the process is terminated. Otherwise, f is calculated from the real number in sequence x, y, z, and e, which corresponds to the event in position i (step 614). Step 614 can also be represented as follows: f<−max{e(a_k,l,i),f+x(a_k,l,i)+y(a_k,l,i)+z(a_k,l,i). The corresponding OIS value is computed (step 616). Step 616 can also be represented as follows: OIS(a_k,l,i)<−f−I(a_k). The index i is incremented (step 616), and the process returns to step 612.

[0074] FIG. 7 is a flow diagram of a process for generating MIG counts based on OIS values for a given period (step 312 of FIG. 3), according to an illustrative embodiment of the invention.

[0075] The set of candidate events E is initialized to be empty and an index s is set to one (1) (step 710). It is then determined whether the end of the event sequence has been reached (step 712). If so, then the process proceeds to step 724. Otherwise, the set of events with positive OIS value at position (s×l−1) are put into a set T (step 714). Step 714 can also be represented as follows: T(l,s)<−{a_k| OIS (a_k,l,s×l−1)>0}.

[0076] The following steps 716 through 718 are repeated for each event a_kin T (i.e. , a_kεT(l,s). At step 716, it is determined whether there exist another l−1 events in T such that the summation of their OIS value at position s×l−1 reaches the threshold g. If not, the method proceeds to step 720. Otherwise, a_kis put into the set E (i.e., E(l)<−E(l)∪{a_k}) (step 718), and the method proceeds to step 720.

[0077] At step 720, it is determined whether there exists any more events ak in the set T. If so, the process returns to step 716. Otherwise, the process proceeds to step 722. At step 722, the index s is incremented by one (1), and the method returns to step 712.

[0078] At step 724, for each event in the set E, 1 MIG counters are initialized, one for each position in a pattern of period l.

[0079] FIG. 8 is a flow diagram illustrating a process for computing MIG counts (step 214 of FIG. 2), according to an illustrative embodiment of the invention.

[0080] The period length l is initialized to one (1) (step 810). It is determined whether the set E is empty for period l (step 812). If so, then the process proceeds to step 828. Otherwise, for each event a_kin E, a counter b (b(a_k,l,p)) is initialized for each of the l distinct positions (1≦p≦1)(step 814).

[0081] The following steps 816 through 824 are repeated for each event d occurring at the ith. At step 816, for an event d occurring at the ith position in the sequence, the position p of the event d in the pattern is calculated.

[0082] The following steps 818 through 822 are repeated for each event a_kin the set E. At step 818, it is determined whether a_kis d. If so, the counter b for event d and the MIG counter for event d are both updated with respect to position p (step 820), and the process proceeds to step 824. Otherwise, only the counter b is updated (step 822), and the process proceeds to step 824. Step 820 can also be represented as follows:

[0083] b(d,l,p)<−max{0,b(d,l,p)}+I(d)

[0084] MIG(d,l,p)<−max{b(d,l,p)−I(d), MIG(d,l,p)}

[0085] Step 824 can also be represented as follows:

[0086] b(d,l,p)<−max{0,b(d,l,p)}−I(d)

[0087] At step 824, is it determined whether there exists any more events a_kin the set E. If so, the process returns to step 818. Otherwise, the process proceeds to step 826.

[0088] At step 826, it is determined whether there exists any more events d occurring at the i_thposition. If so, the process returns to step 816. Otherwise, the process proceeds to step 828.

[0089] At step 828, it is determined whether l is less than a pre-specified maximum period length (L_max). If not, then the process is terminated. Otherwise, the period l is incremented (step 830), and the process returns to step 812.

[0090] FIG. 9 is a flow diagram illustrating the process of generating candidate patterns from MIG counters (step 216 of FIG. 2), according to an illustrative embodiment of the invention.

[0091] The period l is initialized to be one (1) (step 910). It is determined whether the set E is empty for period l (step 912). If so, the process proceeds to step 924. Otherwise, it is determined whether there is an unexamined pattern of period 1 (step 914). If not, the process proceeds to step 924. Otherwise, the unexamined pattern P is taken (step 916). The summation of the MIG counters of all positions in P is calculated and assigned to m(P) (step 918). Step 918 can also be represented as follows: m(P)<−Σ_1≦i≦lMIG (p_i,l,i). It is determined whether m(P) reaches the threshold g (i.e., is m(P)>g) (step 920). If not, the process returns to step 914). Otherwise, the pattern P is taken as a candidate pattern for validation (step 922), and the process returns to step 914.

[0092] At step 924, it is determined whether 1<L_max. If so, the period l is incremented by one (1) (step 926), and the method returns to step 912. Otherwise, the process is terminated.

[0093] FIG. 10 is a flow diagram illustrating the process of validating a candidate pattern P (step 218 of FIG. 2), according to an illustrative embodiment of the invention.

[0094] The maximum information gain (gain(P)), the information gain of the current subsequence c((P)), the starting position (start_c(P)), the ending position (end_c(P)), and an index j are set to zero (0) (step 1010). It is determined whether the end of the event sequence has been reached (step 1012). If so, the method is terminated. Otherwise, it is determined whether the current segment d_l×j+1, d_l×j+2, . . . , d_l×j+lsupports P (step 1014). If so, the current subsequence is extended by accumulating additional information gain (step 1016), and the method proceeds to step 1020. Otherwise, the Xcurrent subsequence is maintained by subtracting information loss (step 1018), and the process proceeds to step 1020. At step 1020, the index j is incremented, and then the process returns to step 1012.

[0095] FIG. 11 is a flow diagram illustrating the process of extending the current subsequence to increase information gain (step 1016 of FIG. 10), according to an illustrative embodiment of the invention.

[0096] It is determined whether the information gain of the current subsequence (c(P)) is greater than zero (step 1110). If so, the information gain of the current subsequence (c(P)) and the ending position of the current subsequence (end_c(P) ) are updated (step 1112), and the process proceeds to step 1116. Otherwise, the information gain of the current subsequence (c(P)) and the starting (start_c(P)) and ending positions (end_c(P)) of the current subsequence are updated (step 1114), and the process proceeds to step 1116. Step 1112 can also be represented as follows:

[0097] c(P)<−c(P)+I(P)

[0098] end_c(P)<−l×j+l

[0099] Step 1114 can also be represented as follows:

[0100] c(P)<−I(P)

[0101] start_c(P)<−l×j+l

[0102] end_c(P)<−l×j+l

[0103] At step 1116, it is determined whether c(P)−I(P) is greater than the maximum information gain (gain(P)). If so, the maximum information gain (gain(P)) and the starting (start_c(P)) and ending positions (end_c(P)) of the maximum subsequence are updated to be that of the current subsequence (step 1118), and the process is terminated. Otherwise, the process is terminated. Step 1118 can also be represented as follows:

[0104] gain(P)<−c(P)−I(P)

[0105] start_gain(P)<−start_c(P)

[0106] end_gain(P)<−end_c(P)

[0107] FIG. 12 is a flow diagram illustrating the process of maintaining the current subsequence by subtracting information loss (step 1018 of FIG. 10), according to an illustrative embodiment of the invention.

[0108] An index i is initialized to be one (1) and a variable loss is initialized to be zero (0) (step 1210). It is determined whether d_l×j+iis in compliance with P on the ith position (step 1212). If so, the process proceeds to step 1216. Otherwise, loss is accumulated (loss<−loss+I(p_i)) (step 1214), and the process proceeds to step 1216.

[0109] At step 1216, the index i is incremented. It is determined whether i≦l (step 1218). If so, the process returns to step 1212. Otherwise, the information gain of the current subsequence (c(P)) is updated (c(P)<−max{0,c(P)}−loss) (step 1220).

[0110] A brief description of the motivation behind the present invention will now be given. It is to be appreciated that a desirable metric for use in periodic pattern discovery should be a relative measurement which takes into account the frequency of occurrences of different events. In particular, we want to favor those patterns that would rarely occur by randomness given the occurrence frequency of involved events. In order to extract the patterns that are truly significant, the degree of significance should be a measurement of disparity from prior expectation and should intuitively have the following properties:

[0111] (a) For a given pattern P, each repetition would have a positive contribution to the significance of P. Consequently, the significance of a pattern is a monotonic increasing function of the number of occurrences if other conditions remain unchanged.

[0112] (b) If the pattern consists of more rare events, it's occurrence should have a higher degree of significance. In other words, the significance of a pattern should be a monotonic decreasing function of the joint probability of involved events.

[0113] (c) If there is less noise interleaved in a list of repetitions of a pattern, then the corresponding event subsequence would produce a higher degree of significance. In addition, noise can be measured by the difficulty in obtaining the right replacement event(s) in order to “mend” to perfect repetitions.

[0114] The absence of a frequent event A would have less impact to the overall significance than that of a less frequent event (e.g., B) because it would be easier to obtain an occurrence of A than that of B.

[0115] Since the system/user behavior may change over time, many patterns may only be valid for a period of time. The degree of significance (i.e., information gain) of a pattern may be diluted if we only consider the entire event sequence. In addition, a user may be interested not only in a significant pattern, but also where and/or when the pattern is significant. In the web server example provided hereinabove, the workload on these servers may present a significant pattern within a certain time period, e.g., 8am to 5pm each weekday. The identification of a significant pattern in a subsequence is of great importance in many applications. However, most previous research focused on discovering patterns that are significant over the entire data sequence.

[0116] A summary of the invention will now be provided. The invention provides a method for mining partial periodic patterns. In particular, the method identifies a pattern and subsequence combination, wherein the pattern is significant within the subsequence. The new metrics information and information gain are provided to measure the knowledge encapsulated in a pattern and the degree of significance of the pattern exhibited by a subsequence of data, respectively. The length of a pattern can be arbitrary, e.g., from a few events to several thousands, and is to be discovered by the mining method of the invention. Since the downward closure does not hold with information gain, an efficient method is provided for mining significant patterns and associated subsequences based on the triangle inequality that is preserved by the information gain metric. First, the significant patterns involving one event are discovered. Next, candidate patterns involving multiple events are generated based on the triangle inequality. Finally, all candidate patterns are validated and for each pattern which is significant, the corresponding subsequence containing the pattern is also identified.

[0117] Although the illustrative embodiments have been described herein with reference to the accompanying drawings, it is to be understood that the present system and method is not limited to those precise embodiments, and that various other changes and modifications may be affected therein by one skilled in the art without departing from the scope or spirit of the invention. All such changes and modifications are intended to be included within the scope of the invention as defined by the appended claims.