We present a generative model for representing and reasoning about the relationships among events in continuous time. We apply the model to the domain of networked and distributed computing environments where we fit the parameters of the model from timestamp observations, and then use hypothesis testing to discover dependencies between the events and changes in behavior for monitoring and diagnosis. After introducing the model, we present an EM algorithm for fitting the parameters and then present the hypothesis testing approach for both dependence discovery and change-point detection. We validate the approach for both tasks using real data from a trace of network events at Microsoft Research Cambridge. Finally, we formalize the relationship between the proposed model and the noisy-or gate for cases when time can be discretized.

Recently, Kutin and Niyogi investigated several notions of algorithmic stability-a property of a learning map conceptually similar to continuity-showing that training stability is sufficient for consistency of empirical risk minimization (ERM) while distribution-free CV-stability is necessary and sufficient for having finite VC-dimension. This paper concerns a phase transition in the training stability of ERM, conjectured by the same authors. Kutin and Niyogi proved that ERM on finite hypothesis spaces containing a unique risk minimizer has training stability that scales exponentially with sample size, and conjectured that the existence of multiple risk minimizers prevents even super-quadratic convergence. We prove this result for the strictly weaker notion of CV-stability, positively resolving the conjecture.

We present a probabilistic model of events in continuous time in which each event triggers a Poisson process of successor events. The ensemble of observed events is thereby modeled as a superposition of Poisson processes. Efficient inference is feasible under this model with an EM algorithm. Moreover, the EM algorithm can be implemented as a distributed algorithm, permitting the model to be applied to very large datasets. We apply these techniques to the modeling of Twitter messages and the revision history of Wikipedia.

For many applications, the data of interest can be best thought of as events—entities that occur at a particular moment in time, have features and may in turn trigger the occurrence of other events. This thesis presents techniques for modeling the temporal dynamics of events by making each event induce an inhomogeneous Poisson process of others following it. The collection of all events observed is taken to be a draw from the superposition of the induced Poisson processes, as well as a baseline process for some of the initial triggers. The magnitude and shape of the induced Poisson processes controls the number, timing and features of the triggered events. We provide techniques for parameterizing these processes and present efficient, scalable techniques for inference. The framework is then applied to three different domains that demonstrate the power of the approach. First, we consider the problem of identifying dependencies in a computer network through passive observation and provide a technique based on hypothesis testing for accurately discovering interactions between machines. Then, we look at the relationships between Twitter messages about stocks, using the application as a test-bed to experiment with different parameterizations of induced processes. Finally, we apply these tools to build a model of the revision history of Wikipedia, identifying how the community propagates edits from a page to its neighbors and demonstrating the scalability of our approach to very large datasets.

In a modern enterprise network of any scale, dependencies between hosts, protocols and network services are surprisingly complex, typically undocumented, and rarely static. Even though network management and troubleshooting rely on this information, automated discovery and monitoring of these dependencies remains an unsolved problem. The approach we follow in the Constellation project [1] attempts to close this gap by pro-actively inferring a network-wide map of these complex relationships using a combination of machine learning techniques and statistical hypothesis testing. Constellation learns explicit local models of time dependencies between the different services on a given host using little more than the timings of packet transmission and reception. It then applies a recursive algorithm to combine local dependencies and build a graph where nodes represent servers/desktops and edges represent the corresponding service that cause the dependency between the nodes. In this abstract we focus on the probabilistic model that enables the learning of the local dependencies between the services at a given host (i.e., server or desktop computer).1 The dependency discovery process comprises two steps. First we learn from the observed data a probability model of the interactions between inputs and outputs, and then we use statistical hypothesis testing to determine whether each dependence is statistically significant. Let a channel be a grouping of communication packets (events for our purposes) belonging to the same service and peer (i.e., that can be logically grouped). Our generative probabilistic model considers a single output channel on a given host and simultaneously analyzes all of this host’s input channels to determine which channel(s) best explain the actual observed occurrence of the output packets. We use ol to denote the time of an output event. Then the probability that packet k in input channel j generated output packet l is distributed as a Poisson process with intensity p j) k (ol) = ∗John is now with Dickinson College, PA. Work done while a Researcher with Microsoft Research. Aleks is with the University of California, Berkeley, CA. Work done while an intern with Microsoft Research. 1Dependence is used here in the statistical sense to mean that by knowing the inputs we can better predict the outputs. w( j) fθ (ol − i j) k ). The parameter w( j) represents the average number of output events that we expect each input event on channel j to be responsible for, and fθ is the distribution of the delay between an input and the output events caused by it. This function will take as its argument the delay between the time of the output ol and the time of the input i j) k . Note that this makes intuitive sense: the probability that a given input packet caused a given output packet depends on both the expected number of packets it generates and the “distance” in time between them. The function fθ (∆t) provides us with the opportunity of encoding prior information regarding the expected shape of the delay between the input and the output channels. To build the joint probability model of the output packets we recall that given a set of independent Poisson processes (denoted as PP) we can use the sum of their intensities and write {ok} ∼ PP(∑ j ∑k p j) k (·)) as the probability of the set of n outputs {ok}, 1 ≤ k ≤ n. Intuitively, given this independence between input channels, the model considers the packets in the output channel to be caused by the presence of any (a disjunction) of input packets in the input channels (with some uncertainty). We call this model Continuous Time NoisyOr (CT-NOR). Its formal relationship to the NoisyOr gate in graphical models is explored in [3]. We are now ready to write the likelihood function, namely, the probability of observing a set {ol} of outputs, given a set of inputs i on all the channels j. Let λ = ∑ j ∑k w( j)

Bayes Nets simplify probabilistic models, making it easy to work with these models. Unfortunately, sometimes people devise models that are too complicated to allow calculation of exact probabilities, so they instead use approximate inference, such as Markov Chain Monte Carlo (MCMC). However, MCMC can fail if the Bayes Net has zero-probability states that “disconnect” the state space. In this paper, we attempt to modify MCMC to handle such nets robustly while not losing sight of efficiency.

State-of-the-art pronoun interpretation systems rely predominantly on morphosyntactic contextual features. While the use of deep knowledge and inference to improve these models would appear technically infeasible, previous work has suggested that predicate-argument statistics mined from naturally-occurring data could provide a useful approximation to such knowledge. We test this idea in several system configurations, and conclude from our results and subsequent error analysis that such statistics offer little or no predictive information above that provided by morphosyntax.

In a modern enterprise network of scale, dependencies between hosts and network services are surprisingly complex, typically undocumented, and rarely static. Even though network management and troubleshooting rely on this information, automated discovery and monitoring of these dependencies remains an unsolved problem. In the system we describe in this paper computers on the network cooperate to make this information available to all users of the network. Constellation uses machine learning techniques to infer a network-wide map of the complex relationships between hosts and services using little more than the timings of packet transmission and reception. Statistical hypothesis testing on the resulting models provides a guaranteed confidence level for the accuracy of the result. The system is demonstrated against a substantial packet trace from an enterprise network.