Determining causes of events in data
A method and system for determining causes. The method includes generating a set of cause indices. Each cause index includes a cause, at least one pattern, and a probability of the cause for the pattern. The method also includes receiving a data set, and determining that one or more indexed patterns match a pattern in the data set. Further, the method includes retrieving causes for the indexed patterns that match the pattern in the data set, as well as determining probabilities of the retrieved causes for the pattern in the data set.
1. A method, implemented by a computer processor, of determining causes, comprising:
generating cause indices, wherein for each of the cause indices, the generating comprises:
retrieving a cause of a previous event;
indexing, with the cause of the previous event, patterns of data elements that contributed to the previous event;
indexing, with the cause of the previous event, a key value set comprising common values from the contributing patterns; and
indexing, with the cause of the previous event, a probability of the cause of the previous event for a pattern of data elements matching the key value set; receiving a new pattern of data elements;
retrieving, from the cause indices, causes indexed with patterns matching the new pattern, wherein the retrieved causes are selected based on similarity degrees between the new pattern and key value sets indexed with the retrieved causes;
ranking the retrieved causes according to probabilities indexed with the retrieved causes; and
selecting, as a cause of an event associated with the new pattern, a highest ranking cause from the retrieved causes; and
displaying the selected cause on a user interface;
wherein at least one of the cause indices comprise a two-level cause index having a first level and a second level, wherein the two-level index is organized by the format:
cause i:
{
[key value set A], [candidate value set A], [probability A of cause i], [key value set B], [candidate value set B], [probability B of cause i]
}
and wherein:
cause i is the cause of the previous event;
in the first level, key value set A is common values from a group of patterns contributing to the cause i, candidate value set A is remaining values from the group of patterns that are not included in key value set A, and probability A of cause i is a probability of cause i for a pattern matching key value set A; and
in the second level, key value set B is common values from a subset of candidate value set A, candidate value set B is remaining values from the group of patterns contributing to the cause i that are not included in key value set A or key value set B, and probability B of cause i is a probability of cause i for a pattern matching key value set B.
2. The method of claim 1 , wherein the similarity degrees between the new pattern and the key value sets indexed with the retrieved causes are above a threshold similarity degree.
3. The method of claim 1 , wherein the retrieving the causes comprises:
determining that none of the similarity degrees is above a first threshold similarity degree; and
determining that at least one of the similarity degrees is above a second threshold similarity degree.
4. The method of claim 1 , wherein the data elements in the new pattern comprise test data.
5. The method of claim 1 , wherein for each of the cause indices, the generating further comprises indexing, with the cause of the previous event, a candidate value set comprising remaining values from the contributing patterns that are not in the key value set.
6. The method of claim 1 , wherein for each of the cause indices, the generating further comprises:
generating a first level of a cause index for the cause of the previous event, wherein the first level includes at least one of the contributing patterns and the probability.
7. The method of claim 1 , wherein a pattern from the contributing patterns is indexed by more than one of the cause indices.
8. The method of claim 1 , wherein at least one of the cause indices comprise two one-level index items.