EXstream: Explaining Anomalies in Event Stream Monitoring
EXstream: Explaining Anomalies in Event Stream Monitoring
复制标题
DOI：
10.5441/002/edbt.2017.15
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Haopeng Zhang;Y. Diao;A. Meliou
中科院分区：
文献类型：
--
作者：
Haopeng Zhang;Y. Diao;A. Meliou
在本文中，我们介绍了EXstream系统，该系统为用户在基于cep的监测结果上注释的异常行为提供高质量的解释。考虑到对解释的新要求，即简洁性、与人类解释的一致性和预测能力，大多数现有技术无法产生同时满足这三个要求的解释。这项工作的关键技术贡献包括对CEP监测异常的最佳解释的正式定义，以及生成足够特征空间的三种关键技术，分别描述每个特征对解释的贡献，以及选择一小部分特征作为最佳解释。使用两个真实用例的评估表明，EXstream在简明性和一致性方面明显优于现有技术，同时实现了相当高的预测能力，并保持了数据流系统的高效实现。
In this paper, we present the EXstream system that provides high-quality explanations for anomalous behaviors that users annotate on CEP-based monitoring results. Given the new requirements for explanations, namely, conciseness, consistency with human interpretation, and prediction power, most existing techniques cannot produce explanations that satisfy all three of them. The key technical contributions of this work include a formal definition of optimally explaining anomalies in CEP monitoring, and three key techniques for generating sufficient feature space, characterizing the contribution of each feature to the explanation, and selecting a small subset of features as the optimal explanation, respectively. Evaluation using two real-world use cases shows that EXstream can outperform existing techniques significantly in conciseness and consistency while achieving comparable high prediction power and retaining a highly efficient implementation of a data stream system.