+

WO1999063708A2 - Modelisation d'ensembles de donnees et de reseaux - Google Patents

Modelisation d'ensembles de donnees et de reseaux Download PDF

Info

Publication number
WO1999063708A2
WO1999063708A2 PCT/IL1999/000291 IL9900291W WO9963708A2 WO 1999063708 A2 WO1999063708 A2 WO 1999063708A2 IL 9900291 W IL9900291 W IL 9900291W WO 9963708 A2 WO9963708 A2 WO 9963708A2
Authority
WO
WIPO (PCT)
Prior art keywords
nodes
functional
model
node
network
Prior art date
Application number
PCT/IL1999/000291
Other languages
English (en)
Other versions
WO1999063708A3 (fr
Inventor
Yuval Bahrav
Yair Shapira
Original Assignee
Camelot Information Technologies Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Camelot Information Technologies Ltd. filed Critical Camelot Information Technologies Ltd.
Priority to EP99923843A priority Critical patent/EP1084550A2/fr
Priority to AU40570/99A priority patent/AU4057099A/en
Publication of WO1999063708A2 publication Critical patent/WO1999063708A2/fr
Publication of WO1999063708A3 publication Critical patent/WO1999063708A3/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery

Definitions

  • the present invention relates to data sets and networks and in particular to ways of analyzing and configuring large data sets and networks.
  • model is used to detect and locate malfunctions in an information network.
  • the model is used for configuring an information network.
  • the model is applied to optimize the organization of a data base.
  • the model is used to forecast how an information system will perform.
  • An information network comprises a set of network members that interact with each other and undergo changes when they interact. Each network member is characterized by a set of properties and is connected to other network members by various relationships. For example if the information network is an office network, the network members would be people and equipment in the office. A network member of the office that is a printer might be characterized by its printing speed and whether it prints in color or black and white. If the information network is a data base, the network members would be the different data elements in the data set.
  • connections between members of an information network are physical, hierarchical and functional relationships.
  • a cable connecting a computer to a printer is an example of physical connection.
  • One person being a boss to another is an example of a hierarchical connection between two people.
  • An example of a functional connection is a connection between a thermostat and an air conditioner whereby the thermostat turns the air conditioner on or off as a function of temperature that the thermostat senses.
  • the changes that occur in a network member of an information network and/or the work performed by the member are functions of the characteristics and features of the network member and changes that occur in other network members with which it is connected. Changes in a network member might also depend upon a change in an element external to the network that has a connection with the network member.
  • An information network is said to be active when changes are occurring in its network members.
  • a configuration of an information network comprises a structural configuration and a functional configuration.
  • the structural configuration is defined as the set of physical and hierarchical connections between network members.
  • the physical connections, and generally the hierarchical connections, of an information network are relatively static non-dynamic connections.
  • the functional configuration of an information network is the set of all functional connections between network members.
  • the functional configuration may be considered to be a "dynamic configuration" of the information network that describes what network members do and how what one network member does is related to/affected by what other network members do. While the structural configuration of an information network is generally known and relatively easy to define and quantify the functional configuration is often very complex and difficult to define and quantify.
  • a model of an information network that provides a well defined quantifiable definition of a functional connection between network members of the information network and thereby a well defined quantified functional configuration of the network.
  • the functional configuration provided by the model can be used to analyze the information network and/or alert users and/or supervisors of the information network to malfunctions of the network.
  • the functional configuration can be used to continuously and automatically adjust the structural configuration of the information network so as to optimize the performance of the information network or to adapt the information network to changes in the tasks that it performs.
  • Information networks that use a functional configuration for continuous modification and optimization of the structural configuration of the information network may be considered self organizing autodidactic information networks.
  • the updating is performed relatively often, for example, every few seconds, minutes or days. Alternatively or additionally, the updating is performed periodically, such as once a month or a year.
  • a model of an information network that comprises a set of "nodes" that represent the network members of the information network.
  • Each node represents a different one of the network members of the information network and is defined by at least one property that reflects the nature or characteristics of the network member that it represents.
  • the nodes are connected to each other by relationships that mimic the relationships that connect network members of the information network and changes in nodes mimic changes in the members of the information network.
  • the term "nodes in an information network" should be taken to mean nodes in a model of the information network.
  • a measurable definition of a functional connection between nodes is defined.
  • Two nodes are defined as having a functional connection when a change in one of the two nodes is connected to or correlated with a change in the other of the two nodes.
  • Nodes in an information network can be connected by different types of functional connections. For example, for a first task or activity of the information network two nodes might be functionally connected while for a second task or activity the same two nodes might not be functionally connected. In this case the first and second tasks may be considered to define two distinguishable types of functional connections.
  • Functional connections can also have different degrees of strength. For example, for a particular task or activity of an information network a first node might always be functionally connected to a second node but only sometimes connected to a third node. For the particular task or activity, the functional connection between the first and second nodes might be defined as stronger than the functional connection between the first and third nodes. Therefore, in accordance with a preferred embodiment of the present invention, nodes in an information network can be connected by different types of functional connections and functional connections between nodes can have different strengths.
  • the model comprises an activation network.
  • the learning of the model is event driven.
  • a node representing the member is activated.
  • These events may be from outside the modeled network or they may be between members of the modeled network, both are termed herein external, as they are external to the model.
  • the activation is propagated to other nodes of the model, based on functional connections between the node and the other nodes. After the activation spreads for a certain period of time and/or after a steady state is reached, the activation of activated nodes is correlated. This correlation may be temporally based.
  • the correlation may be based on a known causative connection between the activations.
  • the function used to test the correlation may be a function of the external event, the node and other properties of the system.
  • the temporal correlation may allow for a delay between the two activations.
  • the delay is a window function.
  • the window function as with many other parameters of correlation, activation and external event treatment, may be a function of properties of the node, including a local memory, properties of neighboring nodes, properties of activated nodes and/or a type and/or properties of external event being analyzed.
  • the window is used to model aspects of delay which may be expected in the real- world, for example, human response time, or mail delivery time.
  • a functional relationship is then preferably updated based on the determined correlations.
  • the updating may be a function of the above defined parameters and/or of any parameter and/or variable of the model.
  • the updating is a function of whether the nodes at which the correlation was detected are both actors in a currently processed and/or related events.
  • the updating may create a functional connection between two nodes which were not previously connected.
  • the update function may update existing connections.
  • the model is "harvested” and/or analyzed by applying one or mode inputs to the activation network and tracing the activation of networks as a result of these inputs.
  • the updating may update any parameter of the activation network, including thresholds, weights, delays, forms of functions, decay and/or parameters of a node.
  • the activation is propagated as a time-varying signal.
  • the threshold is a function of various properties of the node, parameters of functional connections to other nodes (such as weights in a graph representation), type of and properties of one or more external events which are being processed, whether the activation of the node is by external event or by an internal activation.
  • the propagating activation is damped as a function of the distance from the originating activation.
  • the output function of a node is depend on the distance from the event-activated node.
  • two activations are correlated based on the type of event which spawned the activations.
  • only activations caused by a same type and/or a same group of event are correlated.
  • the type of events to correlate are a function of the node for which correlation is being performed and/or is a function of other parameters of the model.
  • the activation of two nodes is correlated responsive to the propagation of activation in the model.
  • nodes which are activated by an external event are preferred for such correlation.
  • only nodes which are activated by an external event are correlated.
  • the weight and/or other parameters of the correlation and/or the updating function are dependent on whether the node become activated as a result of an external event and/or as a result of a propagating activation.
  • two activations may be correlated even if one or both of them are not directly activated by an external event.
  • a node may have different thresholds for propagating an activation and for being activated to an extent that it partakes in a correlation.
  • the activation network is modeled using an architecture similar to that described in U.S. Provisional Patent application No. 60/057,818, titled “Heterogeneous Neural Network", filed September 4, 1997 by Yuval Baharav et al., now PCT application PCT/IL98/00430, the disclosure of which is incorporated herein by reference.
  • each node is represented by one or more neurons. Different types of neurons and/or different parameters may be used for different node types, for example for nodes which represent users and for nodes which represent different types of resources.
  • the hierarchy of node types may be reflected by a hierarchy of neuron types. Rules which relate expected and/or allowed events and nodes are represented by non-learning connections.
  • data analysis neurons may also be provided for generating signals indicative of certain actions, such as certain rules being met.
  • Nj represent the different nodes of an information network, where "i" is an integer index whose value indicates a particular one of the nodes.
  • FC ⁇ FCj ⁇ the set of all different types of functional connections exhibited by the network.
  • Classification of functional relationships can be defined by parameters of many different types, including, a time at which the event occurred, geography, state of the system being modeled and/or the members participating and/or properties of the members which participate in the functional interaction.
  • FCj(Nj,Nk) A functional connection of the type FQ between the "j-th" and "k-th” node can then be represented by FCj(Nj,Nk), where FC jjNj ⁇ ) is assigned a value that represents the strength of the functional connection.
  • FCj, FCiCN Nk 0.
  • the functional configuration of the information network is the set ⁇ FQCN ⁇ N : F ⁇ FC; Nj ⁇ N; N ⁇ N ⁇ of all functional connections FCj(Nj,Nk) that connect nodes in the information network.
  • a particular functional connection between two nodes is activated when a change in one of the nodes is correlated with a change in the other node as a result of the particular functional connection.
  • the earlier change is considered to be a cause of the later change.
  • a level of activation of the activated functional connection is defined as the magnitude of the earlier change times the strength of the functional connection.
  • the activated functional connection is an output from the node in which the earlier change occurred and an input to the node in which the later change occurred.
  • Changes in a node in an information network can depend upon inputs from other nodes, in different ways.
  • a change in a node is a function of inputs from more than one node.
  • the inputs to a node and changes in a node are represented by values of analogue functions.
  • a change in one node might be proportional to a continuous function of inputs from other nodes with which it has functional connections.
  • changes in nodes might be binary, i.e. they can only change from one to the other of two different states.
  • Changes of state in a first node are the result of changes of state in other nodes that are communicated to the first node by functional connections that connect the first node to the other nodes. Changes in a first node resulting from inputs from at least one second node are generally propagated by at least one output from the first node to at least one third node.
  • An output from the first node to the fifth node might depend on change in the first node that is a function of inputs from the second third and fourth nodes.
  • the output to the fifth node is thereby a function, hereinafter referred to as a "transfer function", of the inputs to the first node.
  • the level of activation of the functional connection between the first and fifth node might be zero until the transfer function exceeds a threshold and thereafter be proportional to the value of the transfer function.
  • a transfer function is an algorithm by which a node processes inputs from a first at least one other node and provides at least one output to a second at least one other node.
  • a node in accordance with a preferred embodiment of the present invention, can comprise more than one transfer function.
  • the transfer functions of nodes in a model of an information network are parts of the structural configuration of the information network.
  • the types and strengths of functional connections, i.e. the FQCNj.Nk) and their values, in an information network are defined as functions of correlations between changes that occur in nodes when the information network is active.
  • a correlation test For each type of functional connection that an information network exhibits and/or that it is desired to investigate, a correlation test is defined.
  • the correlation test for a particular type of functional connection is used to test if changes in different nodes of the information network are correlated with each other.
  • a "correlation event" has occurred between the two nodes.
  • the correlation event is assumed to be the result of the two nodes being connected by the type of functional connection for which the correlation test is defined.
  • the correlation test for a type of functional connection can be a function of many different parameters and features of the information network.
  • the correlation test can depend upon a type of activity of the information network, properties of nodes, types of changes in nodes and time delays between the changes.
  • a correlation test provides a binary response, providing a "yes/no" answer as to whether two changes are correlated or not.
  • the correlation test provides a numerical measure of degree of correlation between changes. In some preferred embodiments of the present invention the numerical measure can assume negative as well as positive values.
  • FCjCNT .Nk can be adjusted in accordance with preferred embodiments of the present invention, in different ways. For example F (N ,Nk) can be increased by a fixed amount every time an FCj correlation event occurs between Nj and can be increased by an amount that decreases with increase in time separation between the correlated changes in Nj and N ⁇ that produced the correlation event.
  • FCj(Nj -N ⁇ ) might also be decreased if the time difference between correlated changes that produce a correlation event is greater than a certain time. Where the correlation test provides a numerical degree of correlation between changes, FCj ⁇ j, ⁇ ) can be adjusted responsive to the value provided by the correlation test.
  • the transfer functions of a node in a network are chosen and adjusted so that that "output" correlation events of the node are correctly related to "input” correlation events, i.e. so that outputs from the node can be substantially accurately predicted from inputs to the node
  • the functions FC j C j, ⁇ ) are designed to decay in time so that if a particular functional connection FCjCNj-Nk between two nodes is not used, i.e. if no correlation events occur, the value of FCjCNj.Nk) approaches zero and the functional connection atrophies. This assures that at any point in time the functional configuration of the information network is current.
  • Different functional connections FCj ⁇ j.Nk) can be designed to decay to zero with different dependencies on time and different time constants. Time is measured in units relevant to the time scales and activities of the information network and advances only when the information network is in use.
  • FC (Nj,N and TF ⁇ (Nj) that are defined and determined for a model of an information network are used to analyze the network and/or alert users of the network to malfunctions of parts of the network.
  • models of information networks in accordance with preferred embodiments of the present invention, can be used to identify bottle-necks in production processes, sources of failures in computer networks and analyze the efficiency with which an organization accomplishes its tasks.
  • TFj(Nj) that are defined for an information network are used to continuously and automatically adjust the structural configuration of the information network so as to optimize the performance of the information network or to adapt the information network to changes in the tasks that it performs. This can be implemented relatively straightforwardly when parts of the structural configuration of the network comprise elements that can be adjusted under computer control. Changes that occur in the functions F CNj.Nk) can be used by a computer to determine how to make adjustments of these elements.
  • FCj(Nj,Nk) in accordance with a preferred embodiment of the present invention, to adjust and modify their own structural configurations in order to optimize performance or adapt to task changes are self organizing autodidactic information networks.
  • a preferred embodiment of the present invention can be used to organize a data set to optimize data retrieval in response to the way users of the data set associate data in the data set. As the form of these associations change the data set can be automatically reorganized.
  • a method of modeling an information system having a structure comprising: detecting activations at at least two nodes of a structural model of the system; correlating the detected activations; and modifying at least one property of a functional relationship in a functional model of the system, responsive to the correlation.
  • said correlating comprises correlating activations at nodes which are activated by an external event, responsive to said nodes being activated by a propagating activation in said model.
  • at least one of said correlated activations is not directly caused by an external event in the system.
  • said property comprises a weight.
  • said functional relationship is a direct relationship between said nodes. Additionally, said functional relationship does not directly relate either one of said nodes.
  • said activations are simultaneous. Alternatively, said activations are temporally overlapping. Alternatively, said activations do not temporally overlap.
  • the method comprises decaying a weight of said functional relationship responsive to a time since a last activation.
  • said model is implemented using a neural network, in which each mode is represented by a neuron.
  • the method comprises modifying a structure of said information system using said modified functional model.
  • modifying a structure comprises optimizing a physical layout of said nodes.
  • modifying a structure comprises optimizing a layout of communication lines between said nodes.
  • modifying a structure comprises periodically harvesting said functional model.
  • modifying a structure comprises continuously harvesting said functional model.
  • said information system is a computer network.
  • at least one of said nodes represents a human being.
  • said information system is a library.
  • said information system is a database.
  • the method comprises providing a permission to a real-world event responsive to said functional model.
  • said information system is a data server and comprising using said functional model for enhancing data access.
  • said information system is a distributed processing system and comprising using said function model for work allocation between elements of said processing system.
  • a method of optimizing a data cache used in conjunction with a system comprising: determining a relation ship between events in said information system and access to data through said cache; and modifying caching behavior of said cache responsive to said determination.
  • determining a relationship comprises determining a functional model using a method as described above.
  • said data cache comprises a file server.
  • said data cache comprises a WWW site server.
  • said data cache comprises a disk cache.
  • modifying caching behavior comprises selecting from a set of caching behaviors.
  • modifying caching behavior comprises setting parameters for existing caching rules.
  • modifying caching behavior comprises trading off between different classes of events in said system.
  • at least one of said classes of events represents a particular user of the system.
  • the method comprises reorganizing data in a data store cached by said cache.
  • FIG. 1A - 1C show schematically a structural configuration and two functional configurations of an office organization that are used to analyze the office organization in accordance with a preferred embodiment of the present invention.
  • a modeling method in accordance with a preferred embodiment of the invention may be used for functional analysis of organizations, for example, for consulting purposes. Alternatively or additionally, the method may be used for identification of hidden centers of power and/or origins of failures. Alternatively or additionally, the modeling method may be used to model complex systems containing many elements, such as a traffic situation. Alternatively or additionally, the method may be used for identifying bottle-necks in a production process. In a preferred embodiment of the invention, the models may be used to compare the behavior of a system to a model of the system to detect sudden changes from the norm, in one example, a sudden flurry of long-distance telephone calls may indicate a security problem with an employee.
  • the model is used for automatically generating rules, preferably based on the output of the model for a group of input sets.
  • a model in accordance with a preferred embodiment of the invention is used to analyze the response of a modeled system to a scenario, for example, a war.
  • a model in accordance with some preferred embodiments of the invention has a very high level of detail.
  • the behavior of the modeled system under unexpected conditions may be more exactly modeled.
  • a model in accordance with some preferred embodiments of the invention can model each and every member of a system, down to a low level, such a car in a country-wide traffic simulation.
  • a model is designed analytically, with various simplifying assumptions. In preferred embodiments of the invention, few or no simplifying assumptions are made, at least with respect to the scale of the modeling.
  • a simple information network that is a sales office comprising salesmen and secretaries who communicate by e-mail can be used to illustrate definitions and functions used to model an information network in accordance with a preferred embodiment of the present invention.
  • the salesmen and secretaries would be represented by nodes and a node would undergo a change every time "it" sent an e-mail message or read an e-mail message.
  • a functional connection FC 0 (Nj,Nk , representing "communication by email”.
  • FCo ⁇ j.N For two nodes exhibiting intense communication by e-mail FCo ⁇ j.N would be relatively large while for two nodes exhibiting little e-mail communication FC 0 (Nj,Nk) ou ld be relatively small.
  • a correlation function that would test for correlated "communication" changes in nodes would have no trouble telling which nodes were connected by an "e-mail send” or an "e-mail read” since each e-mail transmission would be identified by an address of a sender and receiver.
  • the correlation function might return a numerical value for each correlated send and read, that decreases as the delay between the correlated send and read increases. For any delay greater than a certain amount, the correlation function might return a negative constant. Assume that for each correlated send and read for nodes Nj and Nj the value returned by the correlation function is added to FCoCNj.Nk) and that between correlation events FCoOT-Nk) decays exponentially with a time constant of a day.
  • the best salesman can be identified with the node that has more and stronger connections to other nodes than any other node.
  • the best salesman's node would be a center for a cluster of communicating nodes.
  • the more efficient, or better-looking, secretaries might be identifiable by nodes having numerous and strong connections to other nodes.
  • the secretaries might delay as long as possible any responses to e-mail from a particularly ill-tempered salesman.
  • the ill-tempered salesman's node might be identifiable by the large number of negative connections.
  • the best salesman has periodic bouts of depression that last a few days.
  • the bouts of depression could probably be detected by an across the board decrease in the values of FCoC Nk) for communication connections between his node and other nodes.
  • the sales office has a sales manager and a comptroller (represented by nodes). Assume that the sales manager handles very large sales that often carry a high risk of financial loss. As a result the sales manager works with a team of three "field salesmen" whose responsibilities are to gather financial and market information on each potential high risk sale.
  • Company policy is that a decision to tender a sales proposal for a high risk sale requires the high risk sale receives a positive recommendation from the comptroller and from at least two field salesmen. From experience one of the three field salesmen is exceptionally capable and historically his recommendations have been very reliable. As a result, the sales manager takes a positive decision to submit a high risk sales proposal on the recommendation of this one field salesman alone and the comptroller as long as a second field salesman does not give a negative recommendation on the high risk sale.
  • FC ⁇ (Nj,Nk)
  • FCotTSfj.Nk a "high risk e-mail" functional connection FC ⁇ (Nj,Nk)
  • Figs. 1A-1C show graphical representations of a structural configuration and two possible functional representations of an information network that is a small sales office for a printing business, in accordance with a preferred embodiment of the present invention.
  • the office has a sales manager, a secretary and a graphic artist.
  • the sales manager is in charge of running the office and is boss to the secretary and graphic artist.
  • the secretary is assigned responsibility for editing and printing sales proposals and letters composed by the sales manager and the graphic artist is in charge of preparing graphics that accompany sales proposals.
  • the boss, secretary and graphic artist are connected by a LAN and additionally, the boss is connected by intercom to both the secretary and the graphic artist.
  • the secretary's computer is connected to a black and white printer on which proposals and letters are printed.
  • the graphic artist's computer is connected to a color printer on which graphics projects are printed.
  • Fig. 1A shows a graphical representation of a structural configuration 20 of the sales office, in accordance with a preferred embodiment of the present invention.
  • the sales manager, secretary, graphic and printers are interacting network members of the information network and are represented by nodes in model 20.
  • Circular nodes labeled respectively SM, SE and GA represent the sales manager, secretary and graphic artist.
  • Square nodes labeled respectively BW and CP represent the black and white printer and the color printer.
  • Wavy lines 22 between appropriate nodes represent the physical LAN connections and the connections between the printers and the computers.
  • the intercom connection between the sales manager and the secretary and graphic artist are represented by broken wavy lines 24 between node SM and nodes SE and GA respectively.
  • graphics communications and editing communications define two types of functional connections, "FCG(NJ,N " and "FCE(Nj,Nk:)" respectively, between office personnel and/or equipment. Every time a graphics e-mail or an editing e-mail is sent by a first one of the office personnel to a second one of the office personnel, and the second one of the office personnel reads the e- mail, a "graphics” or “editing” correlation event respectively occurs between the sender and reader. Similarly, a graphics or editing communication between one of the office personnel and a printer that starts the printer printing results in a graphics or editing event respectively. For simplicity, and clarity of presentation, time dependence of a correlation event on delay between sending and reading of an e-mail is ignored.
  • Figs IB and 1C show graphically two possible functional configurations 30 and 40 respectively, for the sales office for functional connections FCG(NJ,N] ) and FCECNJ.NJ J ).
  • a graphics or editing correlation event occurs between two nodes a solid "graphics" line 26 or a dashed “editing" line 28 respectively is drawn between the nodes and that the number of lines between nodes is constantly being normalized to time in hours.
  • the number of graphics lines 26 and the number of editing lines 28 between two nodes in Figs IB and 1C represents the average number of graphics communications and editing e-mail events occurring per hour between the nodes.
  • the addition of a line between nodes for every e-mail event corresponds to adding a constant quantity to FC( (Nj,Nk;) and every time a correlation event of their respective types occurs.
  • Functional configuration 30 shown in Fig IB is what might be expected if the sales office is running properly.
  • Graphics lines 26 show that all graphics communications "moves" between the sales manager and the graphic artist and color printer.
  • Editing lines 28 show that nearly all editing communications move between the sales manager, the secretary and the printer.
  • the secretary is a bit on the slow side and the graphic artist is bright and fast. As a result the sales manager prefers communicating with the graphic artist and very often asks the graphic artist to do the secretary's work of editing and printing letters and sales proposals.
  • the graphic artist prints a letter or a sales proposal the graphic artist usually does this on the secretary's printer that is much faster than the graphic artist's color printer. Because the graphic artist often performs the editing and printing tasks the graphic work suffers and sales proposals requiring graphic work often do not get out on time.
  • Functional configuration 40 makes the difference between the two office situations obvious. The shape of the functional configuration has changed noticeably. Functional configuration 40 is sharply skewed with respect to substantially symmetric functional configuration 30. Editing lines connect nodes SM and GA and nodes GA and BW. The secretary and graphics who communicated with each other in the "previous" office don't talk to each other at all. There are no graphics or editing lines between nodes GA and SE.
  • Another example illustrates how a preferred embodiment of the present invention can be applied to provide a self organizing data base.
  • keywords and groups of keywords used in searching for documents and groups of keywords used in defining documents are nodes in a model of the library.
  • the structural configuration of the library comprises the way the keyword nodes and document nodes are located or stored with respect to each other in the library memory, i.e. the relationships between the addresses of keyword nodes and document nodes in the computer memory housing the library data base.
  • a correlation event occurs between a keyword node and a document node if, after querying the library with the keyword represented by the keyword node, a user accesses or downloads the document represented by the document node.
  • a correlation event occurs between the document node and a second document node if a reference in the first document causes the user to reference the document represented by the second document node.
  • the correlation events between keyword nodes and document nodes are registered by appropriately defined functions FCj ⁇ .Nk). For nodes representing keywords and documents that are frequently and repeatedly referenced together FCj Nj.Nk) will be large.
  • FCj(Nj,Nk) are periodically automatically reviewed. Following each review the library memory is automatically reorganized so that key word nodes and document nodes for which
  • FCj(Nj,Nk) is large are rapidly associated together and located when the library is searched for information that the documents contain.
  • Such a library is a self organizing data base that learns from experience which data items are related, how strongly they are related, and then groups related data items "close” to each other in memory.
  • the library memory will be organized into clusters of related keywords and documents that might for example be located in the same or nearby blocks of memory in the library or might be members of a linked data set.
  • the clusters of related data items of course reflect the way users of the data base associate items in the data base. If the users should change the way they associate data items in the library, the library will recognize the change because the values of the functions FCjfTSTj.Nk), in accordance with a preferred embodiment of the present invention, will change in response to the new way data items are associated. The library will then reorganize itself into a new pattern of clusters to reflect the new values of the functions F Nj.Nk). The library can learn and adapt itself to change.
  • the changes in the model are applied to the real-world library database, at the end of every day. Alternatively or additionally, these changes are applied at the end of every search and/or data entry. In a preferred embodiment of the invention, searches performed by a faculty member will have a significantly greater effect on modifying functional connections in the model than will those of a student.
  • Another example illustrates the use of a preferred embodiment of the present invention as a prognostic or forecasting tool in a medical application, in which the invention is used to determine relationships between symptoms and measured physiological parameters.
  • apnea a sleep disturbance phenomenon
  • Apnea involves instances of breathing cessation that cause a sufferer to wake up numerous times during a night and not only leaves a person tired but can result in serious damage to the body and even death.
  • a patient might be fitted with sensors that measure different parameters of his body functions while he sleeps. For example, he might be fitted with sensors that track body temperature, blood pressure, heart rate, respiratory rate, rapid eye motion and brain waves, and a pickup microphone to register the sounds of his snoring.
  • Each sensor is represented by a node.
  • Functional connections FCjCNj.Nk) between nodes are established as a result of correlations between changes in measurements of the various sensors. For example, it might be found that periods of rapid eye motion precede by a certain period of time a sudden rise in blood pressure or heart rate and that this is then followed by an arrhythmia event and a sudden small dip in blood pressure. These and other events might correlate with the onset and severity of an apnea event as monitored by snoring sounds that the patient makes.
  • a model is made of communication networks, for example, telephone networks and/or computer networks.
  • communication networks for example, telephone networks and/or computer networks.
  • external events include news events, vacation schedules, television schedules and other happenings which affect a daily schedule of many people.
  • the nodes of the network may represent countries, cities, local interchanges, streets and even individual subscribers.
  • the above modeling method is used for optimizing the location of files on a disk.
  • a "mega application" is loaded in the Windows95 operating system
  • a large plurality of DLL files are loaded.
  • these files are not located in a physically near location, so their loading takes a long time.
  • the above described modeling method is used to analyze which DLLs are loaded at the same time and/or in response to loading the same programs. Thereafter, the physical and/or logical location of these files may be changed to reflect the way a particular user uses his machine.
  • the above modeling method is used for optimizing data retrieval, for example in caches and data servers.
  • the above modeling method and/or other, known, modeling methods are used to determine relationships between data requests and events accepted by a system which generates these requests.
  • events are correlated with sequences of disk blocks being read.
  • the request for a particular WWW page from a server, by a particular user is correlated with other page requests by the user, to determine expected pages to be read.
  • a file server may read ahead and/or send ahead files which, based on a modeling of the outside system, appear to be likely to be read.
  • the decision whether to read data into a cache and/or what "grade" to assign data in a cache may be related to external event and/or to sequences of block reads. These considerations may be applied both to read caches and to write caches.
  • a particular event may be related to a set of relationships between blocks.
  • an address look ahead cache (which retrieves instructions which may be required in future machine cycles), can be optimized for a particular program and/or instance of a program execution.
  • the above modeling method is used to determine relationships between conditional branchings and events. This data may be used to generate a more optimal cache-rule table, which table is downloaded to the cache.
  • a simulation of the program may be used instead of a real-life execution.
  • the modeling may be used for selecting a particular cache rule set, from a set of available rules.
  • the relationships may be associated with a particular user, IP address, program, source WWW site, time of date and/or other parameters of the event. It is noted that a plurality of users may be accessing a cache (e.g., of a WWW server, file server, disk, CPU) at the same time. Various tradeoffs may be used, for example based on available cache space or based on the expected cache requirements. In a system including several caches the caches may optionally communicate and/or otherwise be synchronized with respect to their caching behavior. In another example, the above modeling method is used for planning work schedules and/or dividing-up work between actors, based on a modeled relationship of delaying and interaction between actors.
  • sub-processes may be distributed between processors based on an expected (from a model) amount of communication between particular sub-processes.
  • the above modeling method is used to provide a security system for a computer system and/or network.
  • a network may be described as a set of users and a set of resources (e.g., files, database items, communication ports and network devices). Each resource and each user are represented by one or more nodes. Events occurring in the network are audited and used as training inputs.
  • the system adapts to these events by changing the weight, delay function and/or other parameters (as described above) of the neurons and/or their connections.
  • the model can learn to reflect the functional relations in the system.
  • the learning is event driven.
  • the learning is sampling driven, for example by periodically sampling events.
  • the learning is statistical, by taking in to account only some of the events in the system.
  • the connection between the node representing the user and the node representing the resource is changed according to a correlation function.
  • the correlation function may be temporally and/or node properties based.
  • a non-active connection may decrease with time according to the system's decay parameter.
  • the system After an initial training period, the system reaches a quasi-steady state, in which the reflection (of the system by the model) suffices.
  • the reflection is a densely inter-linked database, on which a clustering method may be applied on, to obtain usage profiles.
  • a clustering algorithm can yield a normal usage profile, from which the un-likelihood of an action (A user tries to access a resource in a certain mode and parameters) can be derived. These norm profiles are preferably stored in a second database.
  • An action is executed in the network permission is requested from the system.
  • the system derives the un-likelihood of this action, and compares it to pre-defined thresholds, thus taking the response decision.
  • the thresholds are defined according to the security level assigned to the resource. Threshold decision is preferably determined by a tradeoff between the twin dangers of misuse and false alarms.
  • the permission is granted n a case-by case basis
  • the security system can generate estimates of unlikelihood based on a pattern of actions by a particular user and/or programs executed, written and/or spawned by the user.
  • the model is simultaneously utilized in two manners, a first manner in which the model learns the system activity so that it can be harvested and a second manner in which the model mimics the system activity and generates a signal if an unlikely event occurs.
  • Each action can also serve as an additional event, learned by the system.
  • the adaptation process is preferably designed in such a way that the latest events have more influence than old ones. In this way the system tracks trends.
  • the "forgetting factor" is preferably set automatically, according to the network stationarity time-constant.
  • Both a computer system (which includes a plurality of "user" programs and a plurality of resources on a single computer and a computer network in which the resources and/or the users are more distributed, can be modeled using the above method, in a particular example, the above method is used to monitor a LAN system for detecting hacking in from an outside computer or by a disgruntled worker on the same LAN.
  • the above system can detect computer virus-like behavior by detecting undesirable (which can be trained into the system), disallowed and/or unlikely activities by a particular program or a set of programs.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer And Data Communications (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

Procédé de modélisation d'un réseau d'informations, qui comprend la détection d'une activation au niveau de deux noeuds d'un modèle du réseau, la mise en corrélation des activations détectées et la modification d'au moins une propriété d'une relation fonctionnelle dans le modèle du réseau, répondant à la corrélation. De préférence, ledit modèle comporte un réseau d'activation.
PCT/IL1999/000291 1998-06-01 1999-06-01 Modelisation d'ensembles de donnees et de reseaux WO1999063708A2 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP99923843A EP1084550A2 (fr) 1998-06-01 1999-06-01 Modelisation d'ensembles de donnees et de reseaux
AU40570/99A AU4057099A (en) 1998-06-01 1999-06-01 Modeling data sets and networks

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
IL12470698A IL124706A0 (en) 1998-06-01 1998-06-01 Modeling data sets and networks
IL124706 1998-06-01

Publications (2)

Publication Number Publication Date
WO1999063708A2 true WO1999063708A2 (fr) 1999-12-09
WO1999063708A3 WO1999063708A3 (fr) 2000-06-29

Family

ID=11071573

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/IL1999/000291 WO1999063708A2 (fr) 1998-06-01 1999-06-01 Modelisation d'ensembles de donnees et de reseaux

Country Status (4)

Country Link
EP (1) EP1084550A2 (fr)
AU (1) AU4057099A (fr)
IL (1) IL124706A0 (fr)
WO (1) WO1999063708A2 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2001044956A1 (fr) * 1999-12-15 2001-06-21 Rensselaer Polytechnic Institute Gestion et commande de reseau par simulation collaborative en ligne
US11182380B2 (en) 2017-06-30 2021-11-23 Nchain Licensing Ag Flow control for probabilistic relay in a blockchain network

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB9106317D0 (en) * 1991-03-25 1991-05-08 Nat Res Dev Material having a passage therethrough

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5216591A (en) * 1990-02-06 1993-06-01 Sprint International Communications Corp. Method for efficient distributed data communications network backbone node location
US5598532A (en) * 1993-10-21 1997-01-28 Optimal Networks Method and apparatus for optimizing computer networks
US5809282A (en) * 1995-06-07 1998-09-15 Grc International, Inc. Automated network simulation and optimization system
US5848243A (en) * 1995-11-13 1998-12-08 Sun Microsystems, Inc. Network topology management system through a database of managed network resources including logical topolgies
AU7558196A (en) * 1995-11-16 1997-06-19 Nicholas Dawes Method of determining the topology of a network of objects
US5761502A (en) * 1995-12-29 1998-06-02 Mci Corporation System and method for managing a telecommunications network by associating and correlating network events

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2001044956A1 (fr) * 1999-12-15 2001-06-21 Rensselaer Polytechnic Institute Gestion et commande de reseau par simulation collaborative en ligne
US11182380B2 (en) 2017-06-30 2021-11-23 Nchain Licensing Ag Flow control for probabilistic relay in a blockchain network
US11341123B2 (en) 2017-06-30 2022-05-24 Nchain Licensing Ag Probabilistic relay for efficient propagation in a blockchain network
US11609902B2 (en) 2017-06-30 2023-03-21 Nchain Licensing Ag Flow control for probabilistic relay in a blockchain network
US11886426B2 (en) 2017-06-30 2024-01-30 Nchain Licensing Ag Probabilistic relay for efficient propagation in a blockchain network
US12007984B2 (en) 2017-06-30 2024-06-11 Nchain Licensing Ag Flow control for probabilistic relay in a blockchain network
US12265523B2 (en) 2017-06-30 2025-04-01 Nchain Licensing Ag Probabilistic relay for efficient propagation in a blockchain network

Also Published As

Publication number Publication date
AU4057099A (en) 1999-12-20
IL124706A0 (en) 1999-01-26
WO1999063708A3 (fr) 2000-06-29
EP1084550A2 (fr) 2001-03-21

Similar Documents

Publication Publication Date Title
US11436530B2 (en) Classifying user behavior as anomalous
US11836578B2 (en) Utilizing machine learning models to process resource usage data and to determine anomalous usage of resources
US11190562B2 (en) Generic event stream processing for machine learning
Das et al. Creating meaningful data from web logs for improving the impressiveness of a website by using path analysis method
CN109740037A (zh) 多源、异构流态大数据分布式在线实时处理方法及系统
US7437703B2 (en) Enterprise multi-agent software system with services able to call multiple engines and scheduling capability
US11062240B2 (en) Determining optimal workforce types to fulfill occupational roles in an organization based on occupational attributes
US12277127B2 (en) Task and process mining by robotic process automations across a computing environment
CN118133274A (zh) 一种基于大数据的信息安全管理及监控方法及系统
US20240073216A1 (en) System and method for determination of common or unique access items in identity management artificial intelligence systems
KR20210098914A (ko) 데이터 분석 방법
US11488110B2 (en) Targeting delivery of recruiting messages
Bezrukavnikov et al. A neophyte with automl: Evaluating the promises of automatic machine learning tools
Lee et al. An adaptive website system to improve efficiency with web mining techniques
WO2023154538A1 (fr) Système et procédé de réduction de dégradation de performance de système due à un excès de trafic
Banica et al. Empowering IT operations through artificial intelligence–a new business perspective
EP1084550A2 (fr) Modelisation d'ensembles de donnees et de reseaux
US11983747B2 (en) Using machine learning to identify hidden software issues
US11893401B1 (en) Real-time event status via an enhanced graphical user interface
Tickle et al. PAS3-HSID: A dynamic bio-inspired approach for real-time hot spot identification in data streams
KR102259945B1 (ko) 인공지능 기반의 예측을 활용하는 a/b 테스팅 시스템 및 방법
Oberhofer et al. Machine Learning Applied to the Clerical Task Management Problem in Master Data Management Systems
Abdel Raouf et al. A predictive replication for multi‐tenant databases using deep learning
McClean et al. Using phase-type models to monitor and predict process target compliance
US20040230409A1 (en) Method for performing social computation

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A2

Designated state(s): AE AL AM AT AU AZ BA BB BG BR BY CA CH CN CU CZ DE DK EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MD MG MK MN MW MX NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT UA UG US UZ VN YU ZA ZW

AL Designated countries for regional patents

Kind code of ref document: A2

Designated state(s): GH GM KE LS MW SD SL SZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
DFPE Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101)
AK Designated states

Kind code of ref document: A3

Designated state(s): AE AL AM AT AU AZ BA BB BG BR BY CA CH CN CU CZ DE DK EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MD MG MK MN MW MX NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT UA UG US UZ VN YU ZA ZW

AL Designated countries for regional patents

Kind code of ref document: A3

Designated state(s): GH GM KE LS MW SD SL SZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG

WWE Wipo information: entry into national phase

Ref document number: 1999923843

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 09701525

Country of ref document: US

WWP Wipo information: published in national office

Ref document number: 1999923843

Country of ref document: EP

REG Reference to national code

Ref country code: DE

Ref legal event code: 8642

WWW Wipo information: withdrawn in national office

Ref document number: 1999923843

Country of ref document: EP

点击 这是indexloc提供的php浏览器服务，不要输入任何密码和下载