Discovering Event Queries from Traces: Laying Foundations for Subsequence-Queries with Wildcards and Gap-Size Constraints

Abstract

We introduce subsequence-queries with wildcards and gap-size constraints (swg-queries, for short) as a tool for querying event traces. An swg-query q is given by a string s over an alphabet of variables and types, a global window size w , and a tuple c = (( c − 1 , c +1 ) , ( c − 2 , c +2 ) , . . . , ( c −| s |− 1 , c + | s |− 1 )) of local gap-size constraints over N × ( N ∪ {∞} ). The query q matches in a trace t (i. e., a sequence of types) if the variables can uniformly be substituted by types such that the resulting string occurs in t as a subsequence that spans an area of length at most w , and the i th gap of the subsequence (i. e., the distance between the i th and ( i +1) th position of the subsequence) has length at least c − i and at most c + i . We formalise and investigate the task of discovering an swg-query that describes best the traces from a given sample S of traces, and we present an algorithm solving this task. As a central component, our algorithm repeatedly solves the matching problem (i. e., deciding whether a given query q matches in a given trace t ), which is an NP-complete problem (in combined complexity). Hence, the matching problem is of special interest in the context of query discovery, and we therefore subject it to a detailed (parameterised) complexity analysis to identify tractable subclasses, which lead to tractable subclasses of the discovery problem as well. We complement this by a reduction proving Proof sketch. A natural brute-force approach is as follows: Upon input of an swg-query q = ( s, w, c ) and a trace t , we enumerate all mappings π : repvars ( q ) → types ( t ), and for each such mapping, we construct a regular expression R π that describes all traces t ′ for which there exists a substitution µ : vars ( q ) ∪ Γ → Γ such that µ is an extension of π and µ ( s ) ≼ e t ′ for some embedding e that satisfies w and c . Then, we only have to check for each of these mappings π , if the regular expression R π matches in t . Another approach is to enumerate all embeddings e : [ | s | ] → [ | t | ] that satisfy w and c and check for each such embedding e whether µ ( s ) ≼ e t for some substitution µ (which can be done in time O( | s | ), since µ must satisfy µ ( s ) = t [ e (1)] t [ e (2)] . . . t [ e ( | s | )]). From these two algorithms and the obvious dependencies between the parameters, we can directly conclude the statements of the theorem.