# Sequential Patterns

last updated 23-Jun-2021

## Introduction to Sequences

We are introducing or adding order to the items.

• There may be items grouped at the same time
• Actual time is not significant except for a partial ordering

Sequence of different transactions by a customer at an online store (includes multiple items at the same time):

Sequence of initiating events causing the nuclear accident at 3-mile Island (each event at a different time):
(http://stellar-one.com/nuclear/staff_reports/summary_SOE_the_initiating_event.htm)

< {clogged resin} {outlet valve closure} {loss of feedwater}
{condenser polisher outlet valve shut} {booster pumps trip}
{main waterpump trips} {main turbine trips} {reactor pressure increases}>

Sequence of books checked out at a library by a patron:

<{Fellowship of the Ring} {The Two Towers} {Return of the King}>

In telecommunications alarm logs,

Inverter_Problem: (Excessive_Line_Current) (Rectifier_Alarm) --> (Fire_Alarm)

In point-of-sale transaction sequences,

Computer Bookstore: (Intro_To_Visual_C) (C++_Primer) --> (Perl_for_dummies,Tcl_Tk)

Athletic Apparel Store: (Shoes) (Racket, Racketball) --> (Sports_Jacket)

## Sequence Data

Patterns that could be picked out: {2} -> {1} and {1,7,8} former as a rule and the latter as a simple association/itemset

## Formal Definition of a Sequence

A sequence is an ordered list of elements: s = < e1 e2 e3 … >

Where each element contains a collection of events (items): ei = {i1, i2, …, ik}

Length of a sequence, |s|, is given by the number of elements in the sequence

A k-sequence is a sequence that contains k events (items)

### Subsequence

A sequence <a1 a2 … an> is contained in another sequence <b1 b2 … bm> (m ≥ n) if there exist integers
i1 < i2 < … < in such that a1 ∈ bi1 , a2∈ bi2, …, an ∈bin

Illustrative Example:
s:  b1 b2 b3 b4 b5
t:      a1 a2      a3

t is a subsequence of s if a1 ∈b2, a2∈ b3, a3∈ b5.

Data sequence

Subsequence

Contain?

< {2,4} {3,5,6} {8} >

< {2} {8} >

Yes

< {1,2} {3,4} >

< {1} {2} >

No

< {2,4} {2,4} {2,5} >

< {2} {4} >

Yes

<{2,4} {2,5}, {4,5}>

< {2} {4} {5} >

No

<{2,4} {2,5}, {4,5}>

< {2} {5} {5} >

Yes

<{2,4} {2,5}, {4,5}>

< {2, 4, 5} >

No

The support of a subsequence(w) is defined as the fraction of data sequences that contain w

A sequential pattern is a frequent subsequence (i.e., a subsequence where support ≥ minsup)

### Finding subsequences

Given:

• a database of sequences
• a user-specified minimum support threshold, minsup

• Find all subsequences with support ≥ minsup

Example

## Generalized Sequential Pattern (GSP)

Step 1:
Make the first pass over the sequence database D to yield all the 1-element frequent sequences

Step 2:
Repeat until no new frequent sequences are found

• Candidate Generation:
• Merge pairs of frequent subsequences found in the (k-1)th pass to generate candidate sequences that contain k items
• Candidate Pruning:
• Prune candidate k-sequences that contain infrequent (k-1)-subsequences
• Support Counting:
• Make a new pass over the sequence database D to find the support for these candidate sequences
• Candidate Elimination:
• Eliminate candidate k-sequences whose actual support is less than minsup

### Candidate Generation

Base case (k=2):

Merging two frequent 1-sequences <{i1}> and <{i2}> will produce the following candidate 2-sequences:
<{i1} {i1}>, <{i1} {i2}>, <{i2} {i2}>, <{i2} {i1}> and <{i1 i2}>.

General case (k>2):

A frequent (k-1)-sequence w1 is merged with another frequent (k-1)-sequence w2 to produce a candidate k-sequence if the subsequence obtained by removing an event from the first element in w1 is the same as the subsequence obtained by removing an event from the last element in w2

• The resulting candidate after merging is given by extending the sequence w1 as follows-
• If the last element of w2 has only one event, append it to w1
• Otherwise add the event from the last element of w2 (which is absent in the last element of w1) to the last element of w1

Examples

• Merging w1=<{1 2 3} {4 6}> and w2 =<{2 3} {4 6} {5}> produces the candidate sequence < {1 2 3} {4 6} {5}> because the last element of w2 has only one event
• Merging w1=<{1} {2 3} {4}> and w2 =<{2 3} {4 5}> produces the candidate sequence < {1} {2 3} {4 5}> because the last element in w2 has more than one event
• Merging w1=<{1 2 3} > and w2 =<{2 3 4} > produces the candidate sequence < {1 2 3 4}> because the last element in w2 has more than one event
• We do not have to merge the sequences w1 =<{1} {2 6} {4}> and w2 =<{1} {2} {4 5}> to produce the candidate < {1} {2 6} {4 5}> because if the latter is a viable candidate, then it can be obtained by merging w1 with < {2 6} {4 5}>

## Timing Constraints

Approach 1:

• Mine sequential patterns without timing constraints
• Postprocess the discovered patterns

Approach 2:

• Modify GSP to directly prune candidates that violate timing constraints

### Apriori Principle for Sequence Data

is undermined with varied max-gap

## Contiguous subsequences

s is a contiguous subsequence of w = <e1>< e2>…< ek>
if any of the following conditions hold:

1. s is obtained from w by deleting an item from either e1 or ek
2. s is obtained from w by deleting an item from any element ei that contains at least 2 items
3. s is a contiguous subsequence of s’ and s’ is a contiguous subsequence of w (recursive definition)

Examples: s = < {1} {2} >

• is a contiguous subsequence of
< {1} {2 3}>, < {1 2} {2} {3}>, and < {3 4} {1 2} {2 3} {4} >
• but is not a contiguous subsequence of
< {1} {3} {2}> and < {2} {1} {3} {2}>

Modified Candidate Pruning

• Without maxgap constraint: A candidate k-sequence is pruned if at least one of its (k-1)-subsequences is infrequent
• With maxgap constraint: A candidate k-sequence is pruned if at least one of its contiguous (k-1)-subsequences is infrequent

## Timing Constraints II

This introduces a window size which is a time difference for an event across elements. Another combining of events option.

## Other formulation

In some domains, we may have only one very long time series

Example:

• monitoring network traffic events for attacks
• monitoring telecommunication alarm signals

Goal is to find frequent sequences of events in the time series. This problem is also known as frequent episode mining.

## General Support Counting Schemes

COBJ -- One occurrence per object

CWIN -- One occurrence per sliding window

CMINWIN -- Number of minimal windows of occurrence (eliminates duplicate counting as in CWIN)

CDIST_O -- Distinct occurrences with possibility of event-timestamp overlap

CDIST -- Distinct occurrences with no event-timestamp overlap allowed.