DENSITY-BASED EVENT HANDLING
The handling of an event is determined based on an event density associated with the event. The handling of an event is determined by determining an event density defined as a number of events (K) permitted within an inter-event time difference threshold (W), and determining handling of an event based on a comparison of an inter-event time difference and the inter-event time difference threshold, wherein the inter-event time difference is a difference between timestamps of the event and a K-th event prior to the event.
1 . An apparatus configured to determine handling of events of an event type, comprising:
a processor and a memory communicatively connected to the processor, the processor configured to:
determine an event density defined as a number of events (K) permitted within an inter-event time difference threshold (W); and
determine handling of an event based on a comparison of an inter-event time difference and the inter-event time difference threshold, wherein the inter-event time difference comprises a difference between a timestamp of the event and a timestamp of a K-th event prior to the event.
2 . The apparatus of claim 1 , wherein the processor is configured to:
determine an event type of the event; and
determine the event density based on the event type of the event.
3 . The apparatus of claim 1 , wherein the processor is configured to:
determine the timestamp of the event;
determine the timestamp of the K-th event prior to the event; and
determine the inter-event time difference as the difference between the timestamp of the event and the timestamp of the K-th event prior to the event.
4 . The apparatus of claim 3 , wherein the processor is configured to determine the timestamp of the K-th event prior to the event by identifying the K-th event in an event log.
5 . The apparatus of claim 1 , wherein the processor is configured to:
initiate a first type of event handling for the event based on a first result of the comparison of the inter-event time difference and the inter-event time difference threshold.
6 . The apparatus of claim 1 , wherein the processor is configured to:
initiate a first type of event handling for the event when a result of the comparison of the inter-event time difference and the inter-event time difference threshold is a first result; and
initiate a second type of event handling for the event when the result of the comparison of the inter-event time difference and the inter-event time difference threshold is a second result.
7 . The apparatus of claim 1 , wherein the event comprises receipt of a first request for a session and the K-th event comprises receipt of a K-th request for a session in which the K-th requested session was accepted, wherein the K-th request for a session is prior in time to the first request.
8 . The apparatus of claim 7 , wherein the processor is configured to:
accept the first request for the session based on a determination that the inter-event time difference is equal to the inter-event time difference threshold or is equal to or greater than the inter-event time difference threshold.
9 . The apparatus of claim 7 , wherein the processor is configured to:
deny the first request for the session based on a determination that the inter-event time difference is less than the inter-event time difference threshold or is less than or equal to the inter-event time difference threshold.
10 . The apparatus of claim 1 , wherein the event comprises detection of a first fault and the K-th event comprises detection of a K-th fault prior to the first fault.
11 . The apparatus of claim 10 , wherein the processor is configured to:
initiate a fault recovery procedure responsive to the first fault based on a determination that the inter-event time difference is less than the inter-event time difference threshold or is less than or equal to the inter-event time difference threshold.
12 . The apparatus of claim 1 , wherein the event comprises receipt of a first message and the K-th event comprises receipt of a K-th message prior to the first message.
13 . The apparatus of claim 12 , wherein the processor is configured to:
admit the first message based on a determination that the inter-event time difference is equal to the inter-event time difference threshold or is equal to or greater than the inter-event time difference threshold.
14 . The apparatus of claim 12 , wherein the processor is configured to:
reject the first message based on a determination that the inter-event time difference is less than the threshold or is less than or equal to the threshold.
15 . The apparatus of claim 1 , wherein the processor is configured to:
determine whether to add the event to an event log based on the comparison of the inter-event time difference and the inter-event time difference threshold.
16 . The apparatus of claim 1 , wherein the event comprises one of receipt of a session request, receipt of a session request in which the session request is accepted, receipt of an access request, detection of a fault, or receipt of a message.
17 . The apparatus of claim 1 , wherein handling of the event comprises one of accepting a session, denying a session, permitting access to a system, denying access to a system, initiating a fault recovery procedure, preventing initiation of a fault recovery procedure, initiating an attack prevention procedure, preventing initiation of an attack prevention procedure, accepting a message, or rejecting a message.
18 . The apparatus of claim 1 , wherein the processor is configured to modify the event density.
19 . A computer-readable storage medium storing instructions which, when executed by a computer, cause the computer to perform a method, the method comprising:
determining an event density defined as a number of events (K) permitted within an inter-event time difference threshold (W); and
determining handling of an event based on a comparison of an inter-event time difference and the inter-event time difference threshold, wherein the inter-event time difference comprises a difference between a timestamp of the event and a timestamp of a K-th event prior to the event.
20 . A method, comprising:
using a processor and a memory for:
determining an event density defined as a number of events (K) permitted within an inter-event time difference threshold (W); and
determining handling of an event based on a comparison of an inter-event time difference and the inter-event time difference threshold, wherein the inter-event time difference comprises a difference between a timestamp of the event and a timestamp of a K-th event prior to the event.