1. Field
This disclosure is generally related to analyzing heterogeneous events. More specifically, this disclosure is related to a method and system for analyzing a large set of event data by introducing a probability model to cluster heterogeneous events.
2. Related Art
For many applications, it is useful to analyze heterogeneous, information-rich events. Heterogeneous events are events that may vary by different factors, including event type, descriptors, location and time. For example, one type of heterogeneous event can be found in military applications. The military may monitor field operations that produces events such as meetings between people of interest, field reports filed by personnel, images and sounds recorded by equipment deployed in locations of interest, and improvised explosive device (IED) explosions.
Depending on context, analysts may classify events as shallow or deep. Shallow events are those for which relatively little information is available beyond event type, location, and time. Deep events are those for which a rich set of information is available, such as a long field report or a video sequence capturing the event.
Systems for analyzing event data may collect homogenous or heterogeneous event data. When events are homogenous, all events are of the same type (e.g., observing a pine tree of a particular species) and are characterized by the same set of descriptors (e.g. the girth, height, and age of the tree). Another example of a homogenous event is a “check-in” event where certain software applications may produce events when users check into a venue at a certain time and location.
When the events are heterogeneous, multiple event types are present (e.g. meetings, patrols, and IED explosions), and each event is characterized by a potentially different set of descriptors. For example, an IED detonation can be characterized by descriptors such as power and materials used. These descriptors are inapplicable to other events such as meetings between people, which is characterized by a different set of descriptors (e.g., the set of people involved and the meeting duration). Modeling heterogeneous events is particularly important when there are interactions between events (e.g. meetings between suspected terrorists may precede planting an IED).
Current approaches for analyzing events cannot scale to very large data sets. Furthermore, such approaches typically only deal with homogenous events where arguments are of the same type and described by the same set of descriptors. To process data sets containing heterogeneous events, one can split the heterogeneous events into several data sets, each restricted to a particular type of event. This approach, however, does not allow for modeling interactions between events.
Some researchers have proposed techniques for analyzing interactions between heterogeneous events. Such proposals typically involve manually constructing detectors for specific activities of interest. For example, some researchers have proposed detectors for intrusion detection. However, such manually constructed detectors may not be used for exploratory analysis. Furthermore, each new detection task requires manually developing a dedicated detector. This is a complex, time-consuming and error-prone procedure.