Notes

  • Questions addressing 'how many openings' or 'are there any openings' can be answered by TLBA patterns as well, but for those kind of questions the Visual Analyser app is more suitable where the GUI and user interaction is meant to serve those.
  • Currently implemented algorithms and filters in KAS pattern service are under development, this document does not serve as the 'specification' of working mechanisms of pattern service. Foreseen updates include (as examples demonstrate later in text) generic object matching, including logical NOT and simple OR. After those updates the 'give me similar results' is planned to be implemented.
  • Final KAS pattern search/match specification will be announced in a different document.

Searching/Matching of the Pattern Service

Pattern is a sequence of (pattern) elements. By the pattern element ordering the pattern shape is established. Pattern element ordering prescribes the evaluation order in which pattern element is evaluated and how it is bound to the other pattern elements.

Example: Imagine that we are having a pattern which consists of three elements. We could write it as:

  • Pattern = {element1, element2, element3}.

Search/Matching would run in following order (know as depth-first search):

  • Firstly the matching of element1 constrains (attributes) would occur on the entire data set (data set is restricted by the shared space domain).
  • After the first positive match (constrains specified in element1 conform to the event log in HPA) the matching of element2 will begin on the remaining data set. Data set is traversed sequentially so if element1 is found at 10th row, element2 matching will begin with row 11. By this matching the chronological constrain is satisfied, element1 surpasses element2. This procedure will continue analogically on other elements if they are injected in pattern until the last one is reached. So in our example after first positive match of element2 constrains is found the element3 matching will begin.
  • When the last element is reached (found), in our example element3, the algorithm will begin the search of all possible matches on element3 constrains on the rest of the data set (so if element3 was found at 23rd row the rest of rows will be matched to comply to the element3 constrains).
  • After all rows in data are searched for the last element (element3), traversing to the closest upper element (element2) is made and the search for next possible match is continued on this upper element level (searching for the next positive match of element2 constrains). When the next mach on this level is found, next element in sequence – lower level (element3) will be searched for on the rest of data set (so if the next positive match of element2 is made at 18th row, the search for element3 will begin at row 19)
  • After all rows are searched for on this level (least upper level - element2) and traversed to the closest lower level (element3), the traverse to the closest upper level is made (element1) and search continues as it was described in the previous bullets. This continues until the root element (element1) is reached.
  • This procedure continues until all possible matches of the root element (element1) are found.

Note1: Search/Match is conduced in a shared space domain, not on entire HPA data set.

Note2: In the current version of KAS pattern search/match service, very similar matches are not included in the resulted list. Commonly, only one match for the first element is returned. This is done due to the effort to bring more variance and relevancy in the result.

Element constrains

Each element represents a complex requirement of constrains which are defined by the element attributes. Attributes correspond to the certain values of the HPA log table.

Attributes currently used:

  • eventType = [{creation, modification, opening, deletion, external}]
  • title=[<string>]
  • actor=[<URI>]
  • objectType=[<string>]
  • objectID=[<URI>]

Pattern examples

For demonstration purposes lets use following imaginary table of HPA log on which the pattern search/match examples will be done. The table consists only of columns that represent currently available attributes (constrains) and one additional column, representing ID or the serial number of the log (higher number represents younger entries… oldest one is the first one :).

ideventTypetitleactorobjectTypeobjectID
1creationnote1michalnote_id:n1
2opening jozefnote_id:n1
3modification jozefcomment_id:c1
4opening michalcomment_id:c1
5modificationnoote1michalnote_id:n1
6openingnt2jannote_id:n2
7creation jozefcomment_id:c1
8external jancontent item
9deletion jozefcontent item
10opening michalcomment_id:c1
11modificationntt2jozefnote_id:n2
12modificationnoote1jannote_id:n1
13creationtestjozefwiki_id:w1
14modificationntmichalnote_id:n2
15modificationtestjozefwiki_id:w1
16opening jancomment_id:c1
17openingnoote1frantiseknote_id:n1

pattern_1

Question: Did someone created anything?
Pattern definition:
  • pattern = {element1}
  • element1: eventType = creation
Output (shape – one ID per pattern instance i.e. {ID}):
  • {1}, {7}, {13}

pattern_2

Question: I would like to know if it is possible to find under this domain (shared space) such activity (pattern), where after the creation of some object (does not matter of what type) the opening of any kind (not necessarily same object) came, and after those two a modification was conducted (any object).
Pattern Definition:
  • pattern = {element1, element2, element3}
  • element1: eventType=creation
  • element2: eventType=opening
  • element3: eventType=modification
Output (shape three IDs per pattern instance {ID,ID,ID}):
  • Internally evaluated before applying filter (see Note2):
{1,2,3}, {1,2,5}, {1,2,11}, {1,2,12}, {1,2,14}, {1,2,15}, {1,4,5}, {1,4,11}, {1,4,12}, {1,4,14}, {1,4,15}, {1,6,11}, {1,6,12}, {1,6,14}, {1,6,15}, {1,10,11}, {1,10,12}, {1,10,14}, {1,10,15}, {7,10,11}, {7,10,12}, {7,10,14}, {7,10,15}
  • KAS service returns:
{1,2,3}, {7,10,11}

pattern_3

Question: Was note (any note) read before it was modified?
Pattern Definition:
  • pattern = {element1, element2}
  • element1: eventType=opening + objectType=note
  • element2: eventType=modification + objecType=note
Output (shape two IDs per pattern instance {ID,ID}):
  • Internally evaluated before applying filter (see Note2):
{2,5}, {2,11}, {2,12}, {2,14}, {6,11}, {6,12}, {6,14}
Note: here real outcomes does not comply to our envisioned ones probably, cause the second returned instance portray a intersection of two different objects/notes a opening of the note one (_id:n1) and modification of note two (_id:n2). This could be worked around by adding or modification of element constrain, such as objectID. But this workaround have to be repeated for all notes. As you can see the use of title constrain is not used (rather objectID), cause title can change over time.
  • KAS service return:
{2,5}, {6,11}
Note: Some post-processing is already made by KAS as can be seen, but this outcome is rather ‘lucky’ that is correct so under different circumstances the output could have been wrong.

pattern_4 (pattern_3 modified)

Question: was a note (_id:n1) read before modification?
Pattern Definition:
  • pattern = {element1, element2}
  • element1: eventType=opening + objectID=_id:n1
  • element2: eventType=modification + objecID=_id:n1
Output (shape two IDs per pattern instance {ID,ID}):
  • Internally evaluated before applying filter (see Note2):
{2,5}, {2,12}
  • KAS service returns:
{2,5}
Note: In this example, a second instance of found pattern can be interesting, but it is filtered out by the KAS service. This behavior will be modified in next versions of service to include possibility of showing similar search outcomes.

Upcoming functionality:

Ability to form NOT questions (negative attribute)

pattern_5

Question: Did michal created something else than notes?
Pattern Definition:
  • pattern = {element1, element2}
  • element1: actor=michal + eventType=creation +(objectType= note + negative=true)
Output (shape one ID per pattern instance {ID}):
  • -none
Note: michal didn’t crated nothing else only notes.

pattern_6

Question: Michal created the nt1, I would like to know if it was modified by someone else as well (modifications of document not done by michal).
Pattern Definition:
  • pattern = {element1, element2}
  • element1:(actor=michal + negative = true) + eventType=modification + objectID= _id:n1
Output (shape one ID per pattern instance {ID}):
  • {12}

Ability to use generic types (generic attribute)

pattern_7

Question: What objects were created and then modified by the same person?
Pattern Definition:
  • pattern = {element1, element2}
  • element1: (actor=x + generic=true) + eventType=creation + (objetID=y + generic=true)
  • element2: (actor=x + generic=true) + eventType=modification + (objetID=y + generic=true)
Output (shape two IDs per pattern instance {ID,ID}):
  • {1,5}, {13,15}
Note: It is not sufficient to use generic attribute only for the actor, cause results found could contain a creation of the object _id:n1 and after that a modification of the object _id:n2 which is not the behavior that we want {1,14}.

pattern_8

Question: Are there any objects which were created by someone and were opened by someone else at least two times?
Pattern Definition:
  • pattern = {element1, element2, element3}
  • element1: (actor=x + generic=true) + eventType=creation
  • element2: (actor=x + generic=true + negative = true) + eventType=opening
  • element3: (actor=x + generic=true + negative = true) + eventType=opening
Note: To achieve at least two openings appearing after each other (in log there could be more than two after each other, but returned will be combination of two), the two elements are used to form such a restriction.
Output (shape three IDs per pattern instance {ID,ID,ID}):
  • {1,2,17}, {7,10,16}

pattern_9

Question: I would like to see everything what michal created and was modified later on by him.
Note: This question could not have been created with ‘simple’ pattern, cause with definition (down below) the creation events would be mixed with modification events from different objects. By using generic type we restrict findings on the same type (creation + modification).
Pattern Definition – old one:
  • pattern = {element1, element2}
  • element1: actor=michal + eventType=creation
  • element2: actor=michal + eventType=modification
Pattern Definition – new one:
  • pattern = {element1, element2}
  • element1: actor=michal + eventType=creation + (objectID=x + generic=true)
  • element2: actor=michal + eventType=modification + (objectID=x + generic=true)
Output (shape two IDs per pattern instance {ID,ID}):
  • {1,5}
Note: In this listing all modification events (on the same object) would have been listed if they would occur after each other ({creation_a,modification_a1}, {creation_a,modification_a2}, {creation_b,modification_b1}) and than filtered out by service ({creation_a,modification_a1}, {creation_b,modification_b1}).

Ability to use simple OR

pattern_10

Question: I would like to know whether after the change of a document users michal or jozef took a look on it.
Pattern Definition:
  • pattern = {element1, element2}
  • element1: eventType=modification + (objectID=x + generic=true)
  • element2: (objectID=x + generic=true) + actor=(michal OR jozef) + action=opening
Output (shape two IDs per pattern instance {ID,ID}):
  • Internally evaluated before applying filter (see Note2):
{3,4}, {3,10}
  • KAS service returns:
{3,4}
  Page Info My Prefs Log in
This page (revision-1) last changed on 18:24 25-Mar-2017 by MichalRacek.
 

Referenced by
KP Lab Analytic T...

JSPWiki v2.4.102
[RSS]