Chronicle Recognition Improvement Using Temporal Focusing and Hierarchization Christophe Dousson and Pierre Le Maigat France Telecom R&D, 2 avenue Pierre Marzin, 22307 Lannion cedex, France. {christophe.dousson,pierre.lemaigat}@orange-ftgroup.com Abstract (like the Event Manager of ILOG/JRules based on a modi- fied RETE algorithm for processing time constraints [Berstel, This article falls under the problem of the sym- 2002]) or separate the processing of temporal data from the bolic monitoring of real-time complex systems or others like in [Dousson, 2002]. This article mainly deals with of video interpretation systems. Among the vari- this second approach where temporal constraints are managed ous techniques used for the on-line monitoring, we by a constraint graph between relevant time points of the sce- are interested here in the temporal scenario recog- narios. There are two approaches for dealing with tempo- nition. In order to reduce the complexity of the ral constraints: STRS recognizes scenarios by an analysis of recognition and, consequently, to improve its per- the past [Rota and Thonnat, 2000] and SPRS which performs formance, we explore two methods: the first one is an analysis of scenarios that can be recognized in the future the focus on particular events (in practice, uncom- [Ghallab, 1996]. Two main problems in the SPRS approach mon ones) and the second one is the factorization of are the fact that scenarios have to be bounded in time in order common temporal scenarios in order to do a hierar- to avoid never expected ending scenario (in practice, when chical recognition. In this article, we present both working on real-time systems, it is difficult to exhibit sce- concepts and merge them to propose a focused hi- nario which cannot be bounded in time); and, second, that erarchical recognition. This approach merges and SPRS engine has to maintain all partially scenarios which generalizes the two main approaches in symbolic possibly leads to use a large amount of memory space. To recognition of temporal scenarios: the Store To- partially avoid those drawbacks, the implementation of SPRS tally Recognized Scenarios (STRS) approach and algorithms in [Dousson, 2002] introduces a clock and dead- the Store Partially Recognized Scenarios (SPRS) lines which are used to garbage collect the pending scenarios. approach. On the other hand, the main problem with STRS algorithms is to maintain all previously recognized scenarios. To our knowledge, no work has been published on how long such 1 Introduction scenarios should be maintained. In addition, STRS does not Symbolic scenario recognition arises in monitoring of dy- provide any kind of “prediction” as SPRS does. namic systems in many areas such as telecommunications A first attempt to take the benefits of both approaches was networks supervision, gas turbine control, healthcare moni- made in [Vu et al., 2003]. It consists of a hierarchization of toring or automatic video interpretation (for an overview, re- the constraint graph of the scenario. It deals only with graphs fer to [Cordier and Dousson, 2000]). where all information about time constraints can be retrieved Such scenarios could be obtained among other things by from a path where temporal instants can be totally ordered. experts, by automatic learning [Fessant et al., 2004; Vautier The hierarchy constructs an imbricated sequence of scenar- et al., 2005] or by deriving a behavioral model of the system ios containing only two events at a time. The principle of the [Guerraz and Dousson, 2004]. Due to the symbolic nature recognition is, at any instant, to instantiate elementary scenar- of those scenarios, the engine performing the recognition is ios and when an event is integrated in a high-level scenario, rarely directly connected to sensors. There is often (at least) looking for previously recognized elementary scenarios. The one dedicated calculus module which transforms the “raw” purpose of this article is to generalize this method; the start- data sent by the system into symbolic events. Typically this ing point will be an SPRS approach and the generalization module can compute a numerical quantity and sends sym- mixes reasoning on past and future. As a byproduct, STRS bolic events when the computed value reaches given thresh- and SPRS methods appear as two extreme kinds of the pro- olds. In cognitive vision, this module is usually a video- pose focused hierarchical recognition. processing which transforms images into symbolic data. The next section presents the used SPRS approach and de- Often those scenarios are a combination of logical and tem- tails some aspects which are relevant to this paper. The sec- poral constraints. In those cases, symbolic scenario recogni- tion 3 is dedicated to the temporal focusing which enables the tion can process the scenarios uniformly as a set of constraints system to focus on uncommon events prior to others. Events IJCAI-07 324 could be not only basic events coming directly from the su- Figure 2 shows the mechanism of the recognition algorithm pervised system but aggregated indicators. So the temporal on a small example: when CRS receives f at 1, it creates the focusing could be used in order to control the computation of new instance I1 and updates the forthcoming window of the such indicators on particular temporal windows and to avoid node e. When a new f occurs at 3, instance I2 is created (the useless computation. As such indicators could be themselves forthcoming windows of I1 is updated “using” a clock tick scenarios, section 4 presents how the hierarchical recognition set at 3). When e occurs, I3 is created (from I2) and I1 is deals with common subscenarios. Finally, we show that both destroyed as no more event e could from now be integrated concepts could be merged and experimentally lead to good into (instance I2 is not destroyed, waiting for another poten- improvement of performances. This will be the object of the tial e between 5 and 6). As all events of I3 are instantiated section 5. the chronicle I3 is recognized. We conclude in section 6 by experimentation on detect- ing naive servers in a Reflected Distributed Denial of Service f [1,3] e Chronicle model (RDDoS) attack. (f,1) (f,3) (e,5) time 2 Chronicle Recognition System (f,1) e,[2,4] (f,1) e,[3,4] - Discarded - Our approach is based on the chronicle recognition as pro- I1 posed in [Dousson, 2002] which falls in the field of SPRS I2 (f,3) e,[4,6] (f,3) e,[5,6] methods. A chronicle is given by a time constraint graph la- (f,3) (e,5) beled by predicates. Chronicle instances I3 An instance of event is a pair (e, t) where t is the date of the event and e is its type. When no ambiguity results, we Figure 2: Created instances of a chronicle by the incoming sometimes do not distinguish between an event and its type. event stream (f,1)(f,3)(e, 5). Figure 1 shows a chronicle which contains four events: the event e (if instantiated) must occur between 1 and 3 units of AssertNoMore time after an instantiation of f, the event g must occur be- 2.2 From Clock to “ ” Event. tween 0 and 3 units of time after e and between −1 and 4 In first implementations of chronicle recognition, a clock was units of time after e. introduced in order to discard “impossible” instances when the clock goes past one of their forthcoming windows (see f [1,3] e behavior of I1 in figure 2). [0,3] g In order to take into account some jitter in data transmis- [-1,4] e' sion a possible delay δ can be taken into account. This de- lay bounds the maximum difference observed at reception be- Figure 1: A chronicle. tween two events sending at the same time by the (possibly distributed) system. Basically, the event integration algorithm could be written as following: Note that the complete formalism is based on a reified logic (a chronicle is a conjunctive formula) and introduces also integrate((e, t)); predicates on persistency or event absence. In this article we setGarbageClock(t − δ) choose to present in details the focusing from the time con- straint graph point of view, other predicates are also taken into The main drawback is that it implies that events arrive account but not discussed here. roughly in a FIFO manner (the allowed jitter is bounded by δ): so, when the FIFO hypothesis should be relaxed (and it 2.1 Recognition Algorithms is often the case when the monitored system is distributed), δ should be increased and the garbage efficiency decreases 3. Let CRS (Chronicle Recognition System) denote the algo- In order to avoid this, instead of a clock, we define a new rithm of recognition. Basically the mechanism of CRS is, input message: “AssertNoMore(e, I)”, where e is an event at each incoming event, to try to integrate it in all the pend- type and I an extended interval. It specifies to CRS that, from ing (and partial) instances of the chronicle model and/or cre- now on, it will not receive more events of type e with an oc- ated a new instance and calculating (using constraint propa- curence date in I. This mechanism is implemented in CRS by gation [Dechter et al., 1991]) new forthcoming windows for managing one forthcoming window for each event type which all the forthcoming events of each instance. An instance of is updated when receiving an “AssertNoMore” message. a chronicle model is then a partial instantiation of this model We do not describe here how CRS deals with this asser- and forthcoming windows fc(e) of a non-instantiated event e tion as it is very close to the previous CRS.