Method and apparatus for providing statistical event correlation in a network
A method and apparatus for providing event correlation in a network are disclosed. For example, the method extracts a plurality of events of interest from a database, and creates one or more event time series from the plurality of events of interest, wherein each of the one or more event time series comprises a set of events of a same type and of a same location that occur within a given time period. The method forms one or more composite events from the one or more event time series, and performs one or more pair-wise correlations for at least one of: the event time-series, or the one or more composite events. The method then identifies one or more pair-wise correlations that are statistically significant.
1. A method for providing event correlation in a network, comprising:
extracting a plurality of events of interest from a database;
creating an event time series from the plurality of events of interest, wherein the event time series comprises a set of events of a same type and of a same location that occur within a given time period;
forming a composite event from the event time series;
performing a pair-wise correlation for the event time-series or the composite event;
identifying a pair-wise correlation that is statistically significant; and
performing a common time-series conversion on the event time series, wherein the performing the common time-series conversion results in a binary time-series, wherein the binary time-series has a first value to represent a time-window over which an event occurred and a second value to represent a time-window over which the event did not occur.
2. The method of claim 1 , further comprising:
applying a correlation rule.
3. The method of claim 2 , wherein the correlation rule comprises an expectation parameter, wherein the expectation parameter specifies whether a correlation is significant, wherein the expectation parameter comprises a spatial relationship.
4. The method of claim 1 , further comprising:
performing an automatic drill-down on the pair-wise correlation that is statistically significant, wherein the automatic drill-down comprises performing a multi-layer analysis.
5. The method of claim 1 , wherein the performing the pair-wise correlation accepts input in a binary format or a non-binary format.
6. The method of claim 1 , wherein the forming the composite event is performed by aggregating over an event type.
7. The method of claim 1 , wherein the forming the composite event is performed by aggregating over a time.
8. The method of claim 1 , wherein the forming the composite event is performed by aggregating over a space.
9. A method for providing event correlation in a network, comprising:
extracting a plurality of events of interest from a database;
creating an event time series from the plurality of events of interest, wherein the event time series comprises a set of events of a same type and of a same location that occur within a given time period;
forming a composite event from the event time series;
performing a pair-wise correlation for the event time-series or the composite event; and
identifying a pair-wise correlation that is statistically significant, wherein the pair-wise correlation is performed by computing a standard Pearson's product-moment correlation coefficient.
10. A method for providing event correlation in a network, comprising:
extracting a plurality of events of interest from a database;
creating an event time series from the plurality of events of interest, wherein the event time series comprises a set of events of a same type and of a same location that occur within a given time period;
forming a composite event from the event time series;
performing a pair-wise correlation for the event time-series or the composite event; and
identifying a pair-wise correlation that is statistically significant, wherein the identifying the pair-wise correlation that is statistically significant is performed by computing a confidence interval using Fisher's z-transforms.
11. A method for providing event correlation in a network, comprising:
extracting a plurality of events of interest from a database;
creating an event time series from the plurality of events of interest, wherein the event time series comprises a set of events of a same type and of a same location that occur within a given time period;
forming a composite event from the event time series;
performing a pair-wise correlation for the event time-series or the composite event; and
identifying a pair-wise correlation that is statistically significant, wherein the identifying the pair-wise correlation that is statistically significant is performed by using a significance test that takes accounts for autocorrelation, wherein the significance test comprises a circular permutation test that generates samples using circular permutations and uses the samples to estimate a standard deviation.
12. A method for providing event correlation in a network, comprising:
extracting a plurality of events of interest from a database;
creating an event time series from the plurality of events of interest, wherein the event time series comprises a set of events of a same type and of a same location that occur within a given time period;
forming a composite event from the event time series;
performing a pair-wise correlation for the event time-series or the composite event; and
identifying a pair-wise correlation that is statistically significant, wherein the identifying the pair-wise correlation that is statistically significant is performed by using a significance test that takes accounts for autocorrelation, wherein the significance test computes a standard deviation by replacing a sample size by an effective sample size.
13. A non-transitory computer-readable medium having stored thereon a plurality of instructions, the plurality of instructions including instructions which, when executed by a processor, cause the processor to perform a method for providing event correlation in a network, comprising:
extracting a plurality of events of interest from a database;
creating an event time series from the plurality of events of interest, wherein the event time series comprises a set of events of a same type and of a same location that occur within a given time period;
forming a composite event from the event time series;
performing a pair-wise correlation for the event time-series or the composite event;
identifying a pair-wise correlation that is statistically significant; and
performing a common time-series conversion on the event time series, wherein the performing the common time-series conversion results in a binary time-series, wherein the binary time-series has a first value to represent a time-window over which an event occurred and a second value to represent a time-window over which the event did not occur.
14. The non-transitory computer-readable medium of claim 13 , further comprising:
applying a correlation rule.
15. The non-transitory computer-readable medium of claim 14 , wherein the correlation rule comprises an expectation parameter, wherein the expectation parameter specifies whether a correlation is significant, wherein the expectation parameter comprises a spatial relationship.
16. A non-transitory computer-readable medium having stored thereon a plurality of instructions, the plurality of instructions including instructions which, when executed by a processor, cause the processor to perform a method for providing event correlation in a network, comprising:
extracting a plurality of events of interest from a database;
creating an event time series from the plurality of events of interest, wherein the event time series comprises a set of events of a same type and of a same location that occur within a given time period;
forming a composite event from the event time series;
performing a pair-wise correlation for the event time-series or the composite event; and
identifying a pair-wise correlation that is statistically significant, wherein the pair-wise correlation is performed by computing a standard Pearson's product-moment correlation coefficient.
17. An apparatus for providing event correlation in a network, comprising:
means for extracting a plurality of events of interest from a database;
means for creating an event time series from the plurality of events of interest, wherein the event time series comprises a set of events of a same type and of a same location that occur within a given time period;
means for forming a composite event from the event time series;
means for performing a pair-wise correlation for the event time-series or the composite event;
means for identifying a pair-wise correlation that is statistically significant; and
means for performing a common time-series conversion on the event time series, wherein the performing the common time-series conversion results in a binary time-series, wherein the binary time-series has a first value to represent a time-window over which an event occurred and a second value to represent a time-window over which the event did not occur.