System and method for temporal correlation of observables based on timing ranges associated with observations

An electronic device comprising:

• a memory to store information representing a process template for a selected event, the process template including a series of observation states, the process template comprises at least a first observation state, a second observation state following the first observation state, and a third observation state following the second observation state, wherein the plurality of observables comprise a first observable, a second observable associated with a time period at or after the first observable, a third observable associated with a time period at or after the second observable, and a fourth observable associated with a time period at or after the third observable;
• and
• a processor coupled to the memory, the processor to receive a plurality of observables and to automatically conduct a recursive comparison of time values associated with each of the plurality of observables to timing ranges associated with each observation state to produce a listing that is subsequently used to determine if the plurality of observables are associated with the selected event,
• wherein the recursive comparison performed by the processor includes (i) selecting the second observation state of the process template corresponding to the second observable as an anchor vertex;
• (ii) analyzing the third observable to determine whether the time value of the third observable is within a timing range associated with one of the plurality of observation states corresponding to the third observable taking into account a timing range of the anchor vertex and any intermediary observation states between the one of the plurality of observation states corresponding to the third observable and the anchor vertex;
• (iii) analyzing the fourth observable to determine whether the time value of the fourth observable is within a timing range associated with one of the plurality of observation states corresponding to the fourth observable taking into account the timing range of the anchor vertex and any intermediary observation states between the one of the plurality of observation states corresponding to the fourth observable and the anchor vertex;
• and (iii) analyzing the first observable prior to the second observable to determine whether the time value of the first observable is within a timing range associated with one of the plurality of observation states corresponding to the first observable taking into account a timing range of the anchor vertex and any intermediary observation states between the one of the plurality of observation states corresponding to the first observable and the anchor vertex.

A method comprising:

• storing information representing a process template for a selected event within a memory device, the process template representing a plurality of observation states;
• determining a maximum timing constraint and a minimum timing constraint for each observation state of the process template to establish timing ranges for each observation state;
• receiving a plurality of observables, each observable of the plurality of observables corresponding to at least one of the plurality of observation states and including data representing an activity being monitored and a time value identifying when the activity was observed;
• selecting an observation state corresponding to one of the plurality of observables as an anchor vertex;
• analyzing a first observable of the plurality of observables subsequent in time to the one of the plurality of observables to determine whether a time value of the first observable is within a timing range associated an observation state corresponding to the first observable and restricted by a timing range of both the anchor vertex and any intermediary observation states between the observation state corresponding to the first observable and the anchor vertex;
• and
• analyzing a second observable of the plurality of observables prior in time to the first observable to determine whether a time value of the second observable is within a timing range associated an observation state corresponding to the second observable and restricted by a timing range of both the anchor vertex and any intermediary observation states between the observation state corresponding to the second observable and the anchor vertex.

An electronic device comprising:

• a memory to store information representing one or more process templates for a selected event, each process template represented by a plurality of observation states;
• one or more inputs adapted to receive a plurality of observables, each of the plurality of observables corresponding to at least one of the plurality of observation states of a selected process template of the one or more process templates;
• and
• a hardware logic implemented within the electronic device and adapted to receive the plurality of observables received by the one or more inputs, the hardware logic that controls the operations of:
• (1) selecting an observation state of the selected process template, the observation state corresponding to one of the plurality of observables as an anchor vertex,
• (2) performing temporal correlation operations by analyzing each observable of the plurality of observables other than the one of the plurality of observables associated with the anchor vertex to determine whether a time value of the each observable is within a timing range associated an observation state corresponding to the analyzed observable taking into account a timing range of both the anchor vertex and all intermediary observation states between the observation state corresponding to the analyzed observable and the anchor vertex, and
• (3) performing additional temporal correlation operations of (a) selecting the observation state and (b) analyzing each observable of the plurality of observables in a recursive manner until all of the plurality of observables have been set as an anchor vertex.