Abstract
In-depth analysis of user interactions with applications in large systems is widely adopted as a means to understand user’s behavior for strategic purposes such as fraud detection, system security, weblog analysis, social networking, and customer relationship management. Overall, the user behavior presents characteristics, relationships, structures, and effects of a sequence of actions in a specific application domain. The interaction of users with applications at the business-level generates events that make the elements of the user behavior. Formal modelling and representation of complex patterns of user actions using expressive languages are critical aspects of behavior analysis. We present a model to describe the behavior elements and their relationships. The model also provides a systematic mechanism for describing and presenting events, sequence of events, and complex behavior patterns. A behavior pattern can be defined as a sequence of typed events that occur during specific time intervals. An event consists of a tuple of attributes whose values represent an observation of the behavior. In this paper, first we define a semantic model of the user behavior to address the issues around the user behavior representation, and then we present syntax and semantics of a generic Behavior Pattern Language (BPL), which enables the analysts to define a variety of complex behavior patterns in a declarative manner. We present the feasibility of the approach through several examples of complex behavior patterns expressed using the proposed language.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
Notes
Behavior is an ordered-set of events since every event in the behavior is unique due to its time occurrence.
References
Alvarez, M. (2015). Battling security threats from within your organization. In: Research Report, IBM Security.
Angeletou, S., Rowe, M., & Alani, H. (2011). Modelling and analysis of user behaviour in online communities, (pp. 35–50). Berlin Heidelberg: Springer.
Anicic, D., Fodor, P., Rudolph, S., Stuhmer, R., Stojanovic, N., & Studer, R. (2010). A rule-based language for complex event processing and reasoning. In Web reasoning and rule systems: Fourth International Conference (pp. 42–57). Berlin Heidelberg: Springer.
Arasu, A., Babu, S., & Widom, J. (2006). The cql continuous query language: semantic foundations and query execution. The International Journal on Very Large Data Bases, 15(2), 121–142.
Aztiria, A., Augusto, J.C., Basagoiti, R., Izaguirre, A., & Cook, D.J. (2013). Learning frequent behaviors of the users in intelligent environments. IEEE Transactions on Systems. Man and Cybernetics, 43(6), 1265–1278.
Barga, R.S., Goldstein, J., Ali, M., & Hong, M. (2007). Consistent streaming through time: A vision for event stream processing. In: 3rd Biennial Conference on Innovative Data Systems Research (CIDR), California.
Brenna, L., Demers, A., Gehrke, J., Hong, M., Ossher, J., Panda, B., Riedewald, M., Thatte, M., & White, W. (2007). Cayuga: a high-performance event processing engine. In ACM SIGMOD international conference on Management of data (pp. 1100–1102): ACM.
Bry, F., & Eckert, M. (2006). A high-level query language for events. In: IEEE Services Computing Workshops(SCW’06), IEEE.
Bui, H.-L. (2009). Survey and comparison of event query languages using practical examples: Ludwig Maximilian University of Munich.
Cao, L. (2010). In-depth behavior understanding and use: the behavior informatics approach. Journal of Information Sciences, 180(17), 3067–3085.
Cao, L. (2014). Behavior informatics: a new perspective. IEEE Intelligent Systems pp. 62–80.
Cugola, G., & Margara, A. (2012). Processing flows of information: From data stream to complex event processing. ACM Computing Surveys (CSUR), 44(3), 1–62.
Anicic, D., Rudolph, S., Fodor, P., & Stojanovic, N. (2011). Ep-sparql: A unified language for event processing and stream reasoning. In: in Conference on World Wide Web, Hyderabad.
Fernández, M. (2014). Programming Languages and Operational Semantics, A Concise Overview: Springer-Verlag London.
Fox, A., & Patterson, D. (2013). Engineering software as a service: an agile approach using cloud computing. Strawberry Canyon: LLC.
Grieskamp, W., & Kicillof, N. (2006). A schema language for coordinating construction and composition of partial behavior descriptions. In: SCESM’06, Shanghai.
Kirou, A., Ruszczycki, B., Walser, M., & Johnson, N. (2008). Computational modeling of collective human behavior: The example of financial markets, (pp. 33–41). Berlin Heidelberg: Springer.
Li, G., & Jacobsen, A. (2005). Composite subscriptions incontent-based publish/subscribe systems. In Middleware 2005: The series Lecture Notes in Computer Science (pp. 249–269). New York: Springer.
Luckham, D. (2012). Event processing for business: Organizing the Real-Time enterprise. New Jersey: Wiley.
Pietzuch, P.R., Shand, B., & Bacon, J. (2004). Composite event detection as a generic middleware extension. IEEE Network Journal, 18(1), 44–55.
Plotkin, G. (1981). A structural approach to operational semantics Technical Report. Denmark: Aarhus University.
Priya, R.V., & Vadivel, A. (2012). User behaviour pattern mining from weblog. International Journal of Data Warehousing and Mining, 8(2), 1–22.
Python (2015). The python programming language website https://www.python.org/.
Rieke, R., Zhdanova, M., Repp, J., Giot, R., & Gaber, C. (2013). Fraud detection in mobile payments utilizing process behavior analysis. In IEEE International Conference on Availability, Reliability and Security (pp. 946–953): IEEE.
Rozsnyai, S., Schiefer, J., & Roth, H. (2009). Sari-sql: Event query language for event analysis. In: IEEE Conference on Commerce and Enterprise Computing, IEEE.
Sandell, N.F., Savell, R., Twardowski, D., & Cybenko, G. (2009). Hbml: A language for quantitative behavioral modeling in the human terrain. In Social Computing and Behavioral Modeling (pp. 180–189): Springer.
Stolfo, S., Bellovin, S., Hershkop, S., Keromytis, A., Sinclair, S., & Smith, S. (2008). Insider attack and cybersecurity: Beyond the hacker. New York: Springer.
Thomas, D., Fowler, C., & Hunt, A. (2013). Programming Ruby 1.9 and 2.0, The Pragmatic Programmers: LLC.
Wang, C., & Cao, L. (2012). Modeling and analysis of social activity process. Behavior computing: modeling, analysis, mining and decision, (pp. 21–35). New York: Springer.
Wooldridge, M. (2000). Reasoning about rational agents. Cambridge: MIT Press.
Yarmand, M., Sartipi, K., & Down, D. (2013). Behavior-based access control for distributed healthcare systems. Journal of Computer Security pp 1–39.
Zarri, G.P. (2012). Behaviour representation and management making use of the narrative knowledge representation language, Behavior Computing (pp. 37–56). London: Springer.
Zerkouk, M., Mhamed, A., & Messabih, B. (2013). User behavior and capability based access control model and architecture. In: Springer Science and Business Media, Springer Science and Business Media, pp. 291–299.
Author information
Authors and Affiliations
Corresponding author
Appendix A: The syntax of BPL
Appendix A: The syntax of BPL
Rights and permissions
About this article
Cite this article
Sharghi, H., Sartipi, K. An expressive event-based language for representing user behavior patterns. J Intell Inf Syst 49, 435–459 (2017). https://doi.org/10.1007/s10844-017-0456-5
Received:
Revised:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s10844-017-0456-5