Stream Processing Algorithms that model behavior changes
- Creators
- Capponi, Agostino
- Chandy, Mani
Abstract
This paper presents algorithms that fuse information in multiple event streams to update models that represent system behavior. System behaviors vary over time; for example, an information network varies from heavily loaded to lightly loaded conditions; patterns of incidence of disease change at the onset of pandemics; file access patterns change from proper usage to improper use that may signify insider threat. The models that represent behavior must be updated frequently to adapt to changes rapidly; in the limit, models must be updated continuously with each new event. Algorithms that adapt to change in behavior must depend on the appropriate length of history: Algorithms that give too much weight to the distant past will not adapt to changes in behavior rapidly; algorithms that don't consider enough past information may conclude incorrectly, from noisy data, that behavior has changed while the actual behavior remains unchanged. Efficient algorithms are incremental -- the computational time required to incorporate each new event should be small and ideally independent of the length of the history.
Additional Information
© 2005 California Institute of Technology.Attached Files
Submitted - TechReport1.pdf
Files
Name | Size | Download all |
---|---|---|
md5:6094d431e086bfbf923280276c9bb117
|
464.5 kB | Preview Download |
Additional details
- Eprint ID
- 27075
- Resolver ID
- CaltechCSTR:2005.004
- Created
-
2005-04-01Created from EPrint's datestamp field
- Updated
-
2019-10-03Created from EPrint's last_modified field
- Caltech groups
- Computer Science Technical Reports
- Series Name
- Computer Science Technical Reports
- Series Volume or Issue Number
- 2005.002