Scaled exponential smoothing for real time histogram

1. A system for processing a stream of data events, comprising:

at least one computer device, having:

a set of histogram data that maintains a running value for each of a plurality of buckets, the running value for each bucket in the plurality of buckets representing a number of data events having an associated value in a range of values represented by the bucket;

a bucket identification system for identifying a bucket b into which a new data event value belongs and incrementing the running value of the bucket b by a count;

an exponential smoothing system that applies a decay factor to the histogram data utilizing a first algorithm that increments the count for the running value associated with bucket b; wherein:

the exponential smoothing system scales each running value by a scaling factor (1/K);

the first algorithm is implemented using an equation: H s ′[b]=H s [b]+(1−K)/K where H s ′[b] is a newly calculated running value for the bucket b, H s [b] is an existing running value for the bucket b, and K is a decay constant; and

no calculation is required on each remaining bucket q; and

an analysis system for analyzing data event values in view of the histogram data.

2. The system of claim 1 , wherein the bucket identification system includes a binary tree algorithm to identify bucket b.

3. The system of claim 1 , further comprising a periodic rescaling system that rescales each of the running values.

4. The system of claim 1 , wherein the stream of data events comprise real time data corresponding to operations performed in conjunction with a source selected from the group consisting of: a financial institution, a network, a device, a computer program, a business, and an enterprise.

5. The system of claim 1 , wherein the analysis system includes a process selected from the group consisting of: identifying potentially fraudulent activities, identifying trends and patterns, identifying risks, identifying problems, and identifying business opportunities.

6. A computer program product stored on a computer readable storage medium, which when executed, processes a stream of data events, the program product comprising:

program code configured for accessing a set of histogram data that maintains a running value for each of a plurality of buckets, the running value for each bucket in the plurality of buckets representing a number of data events having an associated value in a range of values represented by the bucket;

program code configured for identifying a bucket b into which a new data event value belongs and incrementing the running value of the bucket b by a count;

program code configured for utilizing an exponential smoothing process to apply a decay factor to the set of histogram data utilizing a first algorithm that increments the count for the running value associated with bucket b; and a second algorithm for each remaining running value; wherein:

the first algorithm is implemented using an equation:

H′[b]=K*H[b ]+(1 −K )*1,

wherein H′[b] is a newly calculated running value for the bucket b, H[b] is an existing running value for the bucket b, and K is a decay constant; and

the second algorithm is implemented using an equation: H′[q]=K*H[q]+(1−K)*0=K*H[q],

wherein H′[q] is a newly calculated running value for every remaining bucket q, H[q] is an existing running value, and K is the decay constant; and

program code configured for analyzing data event values in view of the histogram data.

7. The program product of claim 6 , wherein the program code configured for identifying the bucket b includes a binary tree algorithm.

8. The program product of claim 6 , further comprising program code configured for periodically rescaling each of the running values.

9. The program product of claim 6 , wherein the stream of data events comprise real time data corresponding to operations performed in conjunction with a source selected from the group consisting of: a financial institution, a network, a device, a computer program, a business, and an enterprise.

10. The program product of claim 6 , wherein the computer program code configured for analyzing includes a process selected from the group consisting of: identifying potentially fraudulent activities, identifying trends and patterns, identifying risks, identifying problems, and identifying business opportunities.

11. A method of processing a stream of data events, comprising:

providing a histogram that includes a running value for each of a plurality of buckets, the running value for each bucket in the plurality of buckets representing a number of data events

having an associated value in a range of values represented by the bucket;

obtaining a new data event value;

identifying a bucket b into which the new data event value belongs and incrementing the running value of the bucket b by a count;

applying an exponential smoothing process that includes a decay factor to each running value, wherein the exponential smoothing process utilizes a first algorithm that increments the count for the running value associated with bucket b, and a second algorithm for each remaining running value; wherein:

the first algorithm is implemented using an equation:

H′[b]=K*H[b ]+(1 +K )*1,

wherein H′[b] is a newly calculated running value for the bucket b, H[b] is an existing running value for the bucket b, and K is a decay constant; and

the second algorithm is implemented using an equation: H′[q]=K*H[q]+(1−K)*0=K*H[q],

wherein H′[q] is a newly calculated running value for every remaining bucket q, H[q] is an existing running value, and K is the decay constant; and

an analysis system for analyzing data event values in view of the histogram.

12. The method of claim 11 , wherein identifying the bucket includes using a binary tree algorithm.

13. The method of claim 11 , wherein the stream of data events comprise real time data corresponding to operations performed in conjunction with a source selected from the group consisting of: a financial institution, a network, a device, a computer program, a business, and an enterprise.

14. The method of claim 11 , wherein analyzing includes a process selected from the group consisting of: identifying potentially fraudulent activities, identifying trends and patterns, identifying risks, identifying problems, and identifying business opportunities.