CT-NOR: Representing and Reasoning About Events in Continuous Time

TL;DR

This paper introduces CT-NOR, a generative continuous-time model for analyzing event relationships in networked systems, enabling dependency discovery and change detection through EM fitting and hypothesis testing.

Contribution

The paper proposes a novel continuous-time generative model for event analysis, along with an EM algorithm and hypothesis testing methods for dependency and change-point detection.

Findings

Successfully applied to real network event data

Effective in dependency discovery and change detection

Formalized relation to noisy-or model in discretized time

Abstract

We present a generative model for representing and reasoning about the relationships among events in continuous time. We apply the model to the domain of networked and distributed computing environments where we fit the parameters of the model from timestamp observations, and then use hypothesis testing to discover dependencies between the events and changes in behavior for monitoring and diagnosis. After introducing the model, we present an EM algorithm for fitting the parameters and then present the hypothesis testing approach for both dependence discovery and change-point detection. We validate the approach for both tasks using real data from a trace of network events at Microsoft Research Cambridge. Finally, we formalize the relationship between the proposed model and the noisy-or gate for cases when time can be discretized.