Discovering Event Queries from Traces: Laying Foundations for Subsequence-Queries with Wildcards and Gap-Size Constraints

We introduce subsequence-queries with wildcards and gap-size constraints (swg-queries, for short) as a tool for querying event traces. Intuitively, swg-queries describe situations of interest (e. g. abnormal job execution) within a certain range in historic event data in form of a query string and different window size constraints. Hence an swg-query q is given by a string s over an alphabet of variables and types, a global window size w and a tuple c = ((c^-_1, c^+_1), (c^-_2, c^+_2), .. ., (c^-_{|s|-1}, c^+_{|s|-1})) of local gap-size constraints. The query q matches in a trace t$ (i. e. , a sequence of types) if the variables can uniformly be substituted by types such that the resulting string occurs in t as a subsequence that spans an area of length at most w, and the ith gap of the subsequence (i. e. , the distance between the ith and i-1th position of the subsequence) has length at least c^-_i and at most c^+_i. We formalise and investigate the task of discovering an swg-query that describes best the traces from a given sample S of traces, and we present an algorithm solving this task. As a central component, our algorithm repeatedly solves the matching problem (i. e. , deciding whether a given query matches in a given trace), which is an NP-complete problem (in combined complexity). Hence, the matching problem is of special interest in the context of query discovery, and we therefore subject it to a detailed (parameterised) complexity analysis to identify tractable subclasses, which lead to tractable subclasses of the discovery problem as well. We complement this by a reduction proving that any query discovery algorithm also yields an algorithm for the matching problem. Hence, lower bounds on the complexity of the matching problem directly translate into according lower bounds of the query discovery problem.

Authors

• Sarah Kleest-Meißner

Keywords

No keywords are indexed for this paper.