Discovering Rules for Clustering and Predicting Asynchronous Events

A wide variety of complex systems generate asynchronous events, including nuclear power plants, computer networks, governments, relational database systems and operating systems. We present Multi-Event Dependency Detection (medd), a novel algorithm for acquiring event correlation rules from historical logs of asynchronous events. Given a new stream of events generated in real time, the rules enable two important activities: clustering sets of related events and predicting events that will occur in the future. The former activity supports data reduction so that human monitors can more easily understand the state of the system generating the events, and the latter activity facilitates prediction of future states of the system by reasoning about events that are likely to occur. Medd's utility is evaluated in experiments with event logs generated by a simulated computer network.