# US 10,311,159 B2 · Mining of composite patterns across multiple multidimensional data sources > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,311,159 B2 - Document ID: US10311159B2 - Status: Granted - Kind: B2 - Application number: 14/829,203 - Filed: 2015-08-18 - Published: 2017-02-23 - Granted: 2019-06-04 - Earliest claimed: 2015-08-18 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Alice-Maria Marascu; Themis Palpanas; Olivier Verscheure - Web page: https://patentgrep.com/patent/US10311159B2 ## CPC - G06F 16/26: Visual data mining; Browsing structured data - G06F 16/23: Updating - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An embodiment of the invention includes a processor can identify one or more simple patterns in at least one data stream of the data streams. The simple pattern can include repetition of a data object of the data objects. The processor can also identify one or more multi-patterns in at least one data stream of the data streams, wherein the multi-pattern can include repetition of a data block. The data block can include at least two contiguous data objects that are in the same order in the data block. The processor can identify one or more composite patterns in at least two data streams of the data streams, wherein the composite pattern can include data objects on each of the at least two data streams that repeat together in the same pattern. ## Claims ### Claim 1 A method of identifying patterns in data streams, said method comprising: receiving a plurality of data streams segmented in the same time range from one or more input data sources; identifying with a processor at least one simple pattern in at least one data stream of the plurality of data streams provided by different data sources, each data stream including a linear sequence of data objects, the simple pattern including repetition of a data object in the linear sequence of data objects; identifying with the processor at least one multi-pattern in at least one data stream of the plurality of data streams, the multi-pattern including repetition of a data block, the data block including at least two contiguous data objects that are in the same order in the data block; identifying with the processor at least one composite pattern between a first data stream and a second data stream by identifying at least one first data object and a first data block in the first data stream and at least one second data object and a second data block in the second data stream that repeat together in the same pattern, and analyzing correlations between the first data object and the second data object and the first data block and the second data block based on co-occurrences at the same position within the first and second streams, respectively; deriving with the processor new pattern data at the same position within the same time range based on the analyzing; and identifying and outputting anomalies by mining the new pattern data, wherein all patterns are accessed simultaneously. ### Claim 2 (depends on 1) The method according to claim 1, wherein each simple pattern includes a list of pairs, the list of pairs including: a length of a multi-pattern starting at a position of the simple pattern, and an ID of a next similar simple pattern, wherein the list of pairs is updated when at least one of: a new data object is added, and a data object is discarded, wherein the list of pairs is used to maintain a second list of pairs, the second list of pairs including: a maximum length of a multi-pattern that can be extracted starting from the position of the simple pattern, and a number of similar multi-patterns that exist in the data set and succeeding the simple pattern temporally, and wherein frequent multi-patterns are extracted counting a frequency information from the second list of pairs. ### Claim 3 (depends on 1) The method according to claim 1, wherein the identifying of the at least one composite pattern further includes processing at least one of an additional data object and an additional data block occurs on an additional data stream at the same relative distance from the at least one of the first data object and the first data block and the at least one of the second data object and the second data block. ### Claim 4 (depends on 1) The method according to claim 1, wherein said identifying of the at least one multi-pattern includes identifying a first multi-pattern and a second multi-pattern, wherein a number of data blocks in the first multi-pattern is different from a number of data blocks in the second multi-pattern. ### Claim 5 (depends on 1) The method according to claim 1, wherein said identifying of the at least one multi-pattern includes identifying a first multi-pattern, a second multi-pattern, and at least one additional multi-pattern, wherein a number of data blocks in the first multi-pattern is different from a number of data blocks in the second multi-pattern and a number of data blocks in the at least one additional multi-pattern, and wherein the number of data blocks in the second multi-pattern is different from the number of data blocks in the at least one additional multi-pattern. ### Claim 6 (depends on 1) The method according to claim 1, wherein the processor is in connection with sensors that monitor a geographical area. ### Claim 7 (depends on 6) The method according to claim 6, wherein the one or more input data sources receive data streams related to at least one of bus speeds, bus routes, bicycle availability, and weather conditions. ### Claim 8 (depends on 1) The method according to claim 1, wherein a first data stream includes data comprising blood test results for a patient; a second data stream includes data comprising imaging test results for the patient; and a third data stream includes data comprising monitored parameters for the patient. ### Claim 9 A device for identifying patterns in data streams, said device comprising: processing circuitry configured to receive a plurality of data streams segmented in the same time range from one or more input data sources; identify at least one simple pattern in at least one data stream of the plurality of data streams provided by different data sources, each data stream in the data streams including a linear sequence of data objects, the simple pattern including repetition of a data object of the data objects, identify at least one multi-pattern in at least one data stream of the plurality of data streams, the multi-pattern including repetition of a data block, the data block including at least two contiguous data objects that are in the same order in the data block, identify at least one composite pattern between a first data stream and a second data stream by identifying at least one first data object and a first data block in the first data stream and at least one second data object and a second data block in the second data stream that repeat together in the same pattern, and analyzing correlations between the first data object and the second data object and the first data block and the second data block based on co-occurrences at the same position within the first and second streams, respectively, derive new pattern data at the same position within the same time range based on the analyzing, and identify and outputting anomalies by mining the new pattern data, wherein all patterns are accessed simultaneously. ### Claim 10 (depends on 9) The device according to claim 9, wherein said identifying of the at least one composite pattern further includes identifying at least one additional data object and an additional data block on an additional data stream, wherein, when the at least one first data object and first data block occur on the first data stream, the at least one additional data object and additional data block occur on the additional data stream in the same position relative to the at least one first data object and first data block and the at least one second data object and second data block. ### Claim 11 (depends on 9) The device according to claim 9, wherein said identifying of the at least one multi-pattern includes identifying a first multi-pattern and a second multi-pattern, wherein a number of data blocks in the first multi-pattern is different from a number of data blocks in the second multi-pattern. ### Claim 12 (depends on 9) The device according to claim 9, wherein said identifying of the at least one multi-pattern includes identifying a first multi-pattern, a second multi-pattern, and at least one additional multi-pattern, wherein a number of data blocks in the first multi-pattern is different from a number of data blocks in the second multi-pattern and a number of data blocks in the at least one additional multi-pattern, and wherein the number of data blocks in the second multi-pattern is different from the number of data blocks in the at least one additional multi-pattern. ### Claim 13 A non-transitory computer-readable medium having computer-readable instructions stored thereon which when executed by a computer cause the computer to perform a method for identifying patterns in data streams, the method comprising: receiving a plurality of data streams segmented in the same time range from one or more input data sources; identifying at least one simple pattern in at least one data stream of the plurality of data streams provided by different data sources, each data stream including a linear sequence of data objects, the simple pattern including repetition of a data object in the linear sequence of data objects; identifying at least one multi-pattern in at least one data stream of the plurality of data streams, the multi-pattern including repetition of a data block, the data block including at least two contiguous data objects that are in the same order in the data block; identifying at least one composite pattern between a first data stream and a second data stream by identifying at least one first data object and a first data block in the first data stream and at least one second data object and a second data block in the second data stream that repeat together in the same pattern, and analyzing correlations between the first data object and the second data object and the first data block and the second data block based on co-occurrences at the same position within the first and second streams, respectively; deriving new pattern data at the same position within the same time range based on the analyzing; and identifying and outputting anomalies by mining the new pattern data, wherein all patterns are accessed simultaneously.