Episode mining device, method and non-transitory computer readable medium of the same

An episode mining method used in an episode mining device that comprises a sensor configured to sense a plurality of real-time operation parameters from an operation device, a storage memory that stores a plurality of historical candidate episodes and a plurality of computer executable instructions and a processor electrically coupled to the storage unit and the sensor, wherein the processor executes the instructions to execute the episode mining method, the episode mining method comprises:

• generating at least one incremental candidate pattern in every incremental time period, wherein the incremental candidate pattern is an incremental episode comprising a set of events of the real-time operation parameters and having an incremental occurrence frequency larger than an incremental threshold;
• generating at least one batch candidate pattern in every batch time period, wherein the batch candidate pattern is a batch episode comprising a set of events of the real-time operation parameters within the batch time period and having a batch occurrence frequency larger than a batch threshold;
• determining at least one newly-add candidate episode from the incremental candidate pattern and the batch candidate pattern having an occurrence frequency larger than a determine threshold;
• and
• generating at least one detection rule based on the newly-add candidate episode,
• wherein the incremental occurrence frequency is a ratio of occurrence times of the incremental episode relative to the occurrence times of all historical episodes within the incremental time period,
• wherein the batch occurrence frequency is a ratio of occurrence times of the batch episode relative to the occurrence times of the historical candidate episodes comprising the same set of events,
• wherein the incremental time period is less than the batch time period,
• wherein when the incremental candidate pattern is the batch candidate pattern, determining the incremental candidate pattern as the newly-add candidate episode,
• wherein when the incremental candidate pattern is not the batch candidate pattern, the occurrence frequency is calculated as ((Δs×|ΔD|)/(|D|+|ΔD|)), wherein the number of the historical candidate episodes is D, all the episodes within the incremental time period is ΔD, and an occurrence possibility of the incremental candidate pattern is ΔS,
• wherein when the batch candidate pattern is not the incremental candidate pattern, the occurrence frequency is calculated as ((s×|D|)/(|D|+|ΔD|)), wherein an occurrence possibility of the batch candidate pattern is s.

A non-transitory computer readable medium that stores a computer program comprising a plurality of computer readable instructions to execute a episode mining method used in an episode mining device, the episode mining device comprises a sensor configured to sense a plurality of real-time operation parameters from an operation device, a storage memory that stores a plurality of historical candidate episodes and a plurality of computer executable instructions and a processor electrically coupled to the storage memory and the sensor, wherein the processor executes the instructions to execute the episode mining method, the episode mining method comprises:

• generating at least one incremental candidate pattern in every incremental time period, wherein the incremental candidate pattern is an incremental episode comprising a set of events of the real-time operation parameters and having an incremental occurrence frequency larger than an incremental threshold;
• generating at least one batch candidate pattern in every batch time period, wherein the batch candidate pattern is a batch episode comprising a set of events of the real-time operation parameters within the batch time period and having a batch occurrence frequency larger than a batch threshold;
• determining at least one newly-add candidate episode from the incremental candidate pattern and the batch candidate pattern having an occurrence frequency larger than a determine threshold;
• and
• generating at least one detection rule based on the newly-add candidate episode,
• wherein the incremental occurrence frequency is a ratio of occurrence times of the incremental episode relative to the occurrence times of all historical episodes within the incremental time period,
• wherein the batch occurrence frequency is a ratio of occurrence times of the batch episode relative to the occurrence times of the historical candidate episodes comprising the same set of events,
• wherein the incremental time period is less than the batch time period,
• wherein when the incremental candidate pattern is the batch candidate pattern, determining the incremental candidate pattern as the newly-add candidate episode,
• wherein when the incremental candidate pattern is not the batch candidate pattern, the occurrence frequency is calculated as ((Δs×|ΔD|)/(|D|+|ΔD|)), wherein the number of the historical candidate episodes is D, all the episodes within the incremental time period is ΔD, and an occurrence possibility of the incremental candidate pattern is ΔS,
• wherein when the batch candidate pattern is not the incremental candidate pattern, the occurrence frequency is calculated as ((s×|D|)/(|D|+|ΔD|)), wherein an occurrence possibility of the batch candidate pattern is s.