Abstract: A method of correlating events in a stream of data packets in which each data packet includes an event type identifier and an attribute associated with a type of event. A plurality of data packets of the stream of data packets is received and correlation set of selectors is applied to the received data packets. Each selector of the correlation set of selectors is responsive to data packets of a predetermined type of event to extract the attribute from the data packets. The method further includes assessing two or more data packets of the received data packets as correlating events if attributes extracted from the two or more data packets match. Additionally, the method includes accessing a correlation session in a data store for each correlating events match, the correlation session holding data items of tasks that process said correlating events.

Abstract: A method of detecting a reference sequence of events in a sample sequence of events, wherein each event is of a certain event type and holds a set of data attributes, includes the steps of: picking candidate combinations of events from said sample sequence so that the event types within each candidate combination match the event types in the reference sequence, calculating an overall similarity score for each candidate combination from at least (i) an event occurrence score based on occurrence deviations of the events of a candidate combination with respect to the matching events of the reference sequence and (ii) an attribute match score based on similarity deviations between the data attributes of the events of a candidate combination and the data attributes of the matching events of the reference sequence, and identifying the candidate combination with the best overall similarity score as reference sequence detected.

Abstract: A method of visualizing sets of correlated events of a stream of events on a display, each event having a time of occurrence in the stream and at least one attribute indicating its correlation with the other events of a set, including the steps of plotting a glyph for each event on the display at a radial distance and an angular position with respect to an origin; the radial distance and the size of a glyph being proportional to the occurrence time of its event; the angular position of the glyph of a succeeding event in a set being chosen equal to that of the preceding event in the set unless these two glyphs would over-lap in which case the angular position of the glyph of said subsequent event is shifted in a given direction by an amount just sufficient to avoid such overlap; and the angular position of the glyph of the first event in a set being chosen so that overlapping of all glyphs is minimized.

Abstract: A method of processing a source set of raw events of unknown event types to a target set of typed events, each raw event being a package of data items containing data values of detectable data types, includes the steps of: providing a library of event type objects each of which relates to a given event type and contains a structured set of attributes of given data types; for each raw event, determining at least one event type object in the library which meets the following criteria: (i) the data items of the raw event can each be mapped to one of the attributes of said event type object, and (ii) the detected data types of the raw event each match the given data type of the respective attribute mapped; and generating a typed event from the raw event by structuring the data values of the raw event in the form of the event type object determined.