Event Forecasting with Pattern Markov Chains Elias Alevizos, - - PowerPoint PPT Presentation

Event Forecasting with Pattern Markov Chains

Event Forecasting with Pattern Markov Chains

Elias Alevizos, Alexander Artikis, George Paliouras

Complex Event Recognition lab, Institute of Informatics & Telecommunications National Centre for Scientific Research “Demokritos”

http://cer.iit.demokritos.gr/

Event Forecasting with Pattern Markov Chains Introduction

Motivation

start 1 2 3 · · · 50 $ 100 $ 200 $ 500 $

Event Forecasting with Pattern Markov Chains Introduction

Motivation

start 1 2 3 · · · 50 $ 100 $ 200 $ 500 $

◮ Is this a fraud?

Event Forecasting with Pattern Markov Chains Introduction

Motivation

start 1 2 3 · · · 50 $ 100 $ 200 $ 500 $

◮ Is this a fraud? ◮ How long will it last?

Event Forecasting with Pattern Markov Chains Introduction

Motivation

start 1 2 3 · · · 50 $ 100 $ 200 $ 500 $

◮ Is this a fraud? ◮ How long will it last? ◮ With what probability?

Event Forecasting with Pattern Markov Chains Introduction

Online Probabilistic Complex Event Forecasting

◮ Patterns defined as regular expressions. ◮ Consume streams of events and forecast when a pattern is

expected to be fully matched.

◮ Revise forecasts to reflect changes in the state of the pattern. ◮ Remember “arbitrarily” long sequences.

Event Forecasting with Pattern Markov Chains Introduction

Assumptions

◮ Selection strategy: (partition)-contiguity. ◮ Stream generated by a m-order Markov process. ◮ Stream stationary. ◮ A forecast reports for how many transitions we will have to

wait until a full match.

Event Forecasting with Pattern Markov Chains Theory

Regular Expression → Pattern Markov Chain

R = a · c · c. Σ = {a, b, c}. No memory.

start 1 2 3 b, c a a c b c a b a b, c

Event Forecasting with Pattern Markov Chains Theory

Regular Expression → Pattern Markov Chain

R = a · c · c. Σ = {a, b, c}. No memory.

start 1 2 3 b, c a a c b c a b a b, c

1 2 3 P(b) + P(c) P(a) P(a) P(c) P(b) P(c) P(b) P(a) 1.0

Event Forecasting with Pattern Markov Chains Theory

Regular Expression → Pattern Markov Chain

0b 0c 1a 2c 3c P(b | b) P(c | b) P(a | b) P(a | a) P(c | a) P(b | a) P(c | c) P(b | c) P(a | c) 1.0 P(c | c) P(b | c) P(a | c)

Event Forecasting with Pattern Markov Chains Implementation

Waiting-Time and Forecasts

◮ Warm-up period to learn distributions. ◮ Set a threshold, e.g., Pfcast = 50%.

start 1 2 3 4 a b b b a a a b b a

1 2 3 4 5 6 7 8 9 10 11 12

Number of future events

0.2 0.4 0.6 0.8 1

Completion Probability

state:0 interval:5,12 state:1 state:2 state:3

Event Forecasting with Pattern Markov Chains Implementation

Example: R = a · b · b · b.

start 1 2 3 4 a b b b a a a b b a

1 2 3 4 5 6 7 8 9 10 11 12

Number of future events

0.2 0.4 0.6 0.8 1

Completion Probability

state:1 interval:3,8

Event Forecasting with Pattern Markov Chains Implementation

Example: R = a · b · b · b.

start 1 2 3 4 a b b b a a a b b a

1 2 3 4 5 6 7 8 9 10 11 12

Number of future events

0.2 0.4 0.6 0.8 1

Completion Probability

state:2 interval:2,4

Event Forecasting with Pattern Markov Chains Implementation

Example: R = a · b · b · b.

start 1 2 3 4 a b b b a a a b b a

1 2 3 4 5 6 7 8 9 10 11 12

Number of future events

0.2 0.4 0.6 0.8 1

Completion Probability

state:3 interval:1,1

Event Forecasting with Pattern Markov Chains Empirical Analysis

Credit Card Fraud Management: Real Dataset (m = 1).

1 2 3 4 5 6 7

State

0.2 0.4 0.6 0.8

Prediction Threshold

20 40 60 80 100

1 2 3 4 5 6 7

State

0.2 0.4 0.6 0.8

Prediction Threshold

2 4 6 8 10

1 2 3 4 5 6 7

State

0.2 0.4 0.6 0.8

Prediction Threshold

5 10 15

Event Forecasting with Pattern Markov Chains Empirical Analysis

Credit Card Fraud Management: Real Dataset (m = 3).

1 11 12 13 2 21 3 4 5 6 7

State

0.2 0.4 0.6 0.8

Prediction Threshold

20 40 60 80 100

1 11 12 13 2 21 3 4 5 6 7

State

0.2 0.4 0.6 0.8

Prediction Threshold

2 4 6 8 10

1 11 12 13 2 21 3 4 5 6 7

State

0.2 0.4 0.6 0.8

Prediction Threshold

5 10 15

Event Forecasting with Pattern Markov Chains Empirical Analysis

Maritime Monitoring: Real Dataset.

R = Turn · GapStart · GapEnd · Turn, where Turn = (TurnNorth + TurnEast + TurnSouth + TurnWest)

3te 7tw 9tn 11 ts 13 gse14 gsn15 gsw 16 gss17 gen18 gew 19 ges20 gee State 0.2 0.4 0.6 0.8 Prediction Threshold 20 40 60 80 100 3te 7tw 9tn 11 ts 13 gse14 gsn15 gsw 16 gss17 gen18 gew 19 ges20 gee State 0.2 0.4 0.6 0.8 Prediction Threshold 50 100 150 200 250 300 350 3te 7tw 9tn 11 ts 13 gse14 gsn15 gsw 16 gss17 gen18 gew 19 ges20 gee State 0.2 0.4 0.6 0.8 Prediction Threshold 2 4 6 8 10

Event Forecasting with Pattern Markov Chains Empirical Analysis

Summary & Future Work

◮ Contributions:

◮ Regular expressions as opposed to sequential patterns. ◮ Forecasts with guaranteed precision, if Markov process. ◮ Useful forecasts even in applications where we do not know

beforehand the stream properties.

Event Forecasting with Pattern Markov Chains Empirical Analysis

Summary & Future Work

◮ Contributions:

◮ Regular expressions as opposed to sequential patterns. ◮ Forecasts with guaranteed precision, if Markov process. ◮ Useful forecasts even in applications where we do not know

beforehand the stream properties.

◮ Future work:

◮ Constraints on event properties. ◮ More selection strategies. ◮ Support drift. ◮ Forecasts that correspong to real time (not transitions).

Event Forecasting with Pattern Markov Chains Appendix

Appendix

Event Forecasting with Pattern Markov Chains Appendix

Validation tests

0.2 0.4 0.6 0.8 1

Prediction threshold

0.2 0.4 0.6 0.8 1

Precision score

• rder=0
• rder=1
• rder=2

f(x)=x

Figure: R = a · (a + b)∗ · c

0.2 0.4 0.6 0.8 1

Prediction threshold

0.2 0.4 0.6 0.8 1

Precision score

• rder=0
• rder=1
• rder=2

f(x)=x

Event Forecasting with Pattern Markov Chains Appendix

Credit cards (precision for m = 1, 2, 3)

0.2 0.4 0.6 0.8 1 Prediction threshold 0.2 0.4 0.6 0.8 1 Precision score Precision (on recognized) Precision (on ground truth) f(x)=x 0.2 0.4 0.6 0.8 1 Prediction threshold 0.2 0.4 0.6 0.8 1 Precision score Precision (on recognized) Precision (on ground truth) f(x)=x 0.2 0.4 0.6 0.8 1 Prediction threshold 0.2 0.4 0.6 0.8 1 Precision score Precision (on recognized) Precision (on ground truth) f(x)=x

Event Forecasting with Pattern Markov Chains Appendix

Maritime (precision)

R = Turn · GapStart · GapEnd · Turn

0.2 0.4 0.6 0.8 1

Prediction threshold

0.2 0.4 0.6 0.8 1

Precision score

Precision f(x)=x

Event Forecasting with Pattern Markov Chains Appendix

Maritime (precision)

R = TurnNorth · (TurnNorth + TurnEast)∗ · TurnSouth

0.2 0.4 0.6 0.8 1

Prediction threshold

0.2 0.4 0.6 0.8 1

Precision score

• rder=1
• rder=2

f(x)=x