1. An Introduction to Event Detection
Andrea Ceroni
Web Science Course
Sommersemester 2017
Partially borrowed from KDD ’09 tutorial:

4. epidemics

5. What is an Event? There is not a strict definition
Something that happens at a particular time and place [Allan et al., 1998]
A specific occurrence involving participants
A change of state of a monitored quantity/measure
Event “template”: who did what to whom when and where
Event Detection methods aim at filling (a sub set of) this information
Who, When, Where are basic and very common dimensions in IR
Who vs. Whom and What require a deeper text analysis (often with NLP)

6. Sources of Event Detection
News Articles
Long text
Trustworthy (usually)
Relatively low-frequency input
Twitter
Short text
Prone to rumors and spam
Opinionated
Streaming and high-frequency input
Wikipedia
Entity- and event-centric content
Hyperlinked text and structured information
Neutral
Prone to edit war
Domain specific datasets: medical, military, financial

7. Types of Event Detection
Offline Event Detection
Retrospective
Data set covers entire timeline
Vs.
Online Event Detection
Streaming
Often real time (but not required)
Document-based
Event Detection
Events = groups of documents
Clustering
Event hierarchies
Vs.
Entity-based
Event Detection
Events = groups of “entities”
Burst Detection
Complex entity relationships

8. Univariate Temporal Methods
Simplest approaches to Event Detection
Frequently applied as part of more complex methods
Consider temporal profiles of a single quantity
e.g. # of Tweets or articles mentioning a given hashtag/entity

9. Univariate Temporal Methods25 20 15 10 5 2 4 6 8 10 12 14 16 18 20
Time
• Easy case: when does an “event” happen?
• How can we detect this with an algorithm?

10. Univariate Temporal Methods25 20 15 10 5 2 4 6 8 10 12 14 16 18 20
Time
General framework:
1. Learn model to predict expected signal value
2. Measure difference between actual and expected
3. Compute alarm value

11. Univariate Temporal Methods
Methods we will consider
Control Chart
Moving Average
Exponentially Weighted Moving Average
Regression

12. Control Chart
In this case the avg and std is not updated when new data in acquired.

13. Control Chart Example: primary-doctor visits in Norfolk
In the moment the blue line exceeds the upper limit, we should get a fairly big alarm
upper control limit

14. Control Chart Example (long term)
Not very sensitive to seasonal fluctuations (e.g. more doctor visits in winter): a lot of false alerts

15. Control Chart Pros Cons Very simple
It can raise many false alerts due to seasonal/local effects
It is not sensitive to small shifts

16. Moving Average
Much more sensitive to the recent history.

17. Moving Average Pros Cons
Fits to recent history – performs better on seasonal trends
Cons
Drawbacks if recent history is anomalous (e.g. due to outbreaks or events)
It captures the seasonal trends (according to the upper control limit). Problems if the recent history contains events, due e.g. to outbreaks: the moving average is driven by this.

18. Exponentially Weighted Moving Average (EWMA)
A variation of the Moving Average
Let 𝑍 𝑖 be the monitored EWMA statistic:

19. Regression Data often consists of trends, e.g.
Seasonal effects
Days-of-week effects
Holiday effects
Regression (e.g. linear) can be used to explicitly model these trends

20. Regression
Regression example to model seasonal effects and Monday effects:
Regression learns the 𝜷 parameters from data to minimize the residual sum of squares
b0 is the offset.
Hours of daylight: sinusoidal formula, more hours of daylight -> extra amount to the prediction

21. Regression Example of regression It better models seasonal effects
It models the seasonal effects

22. Univariate Temporal Methods
Other methods not considered in this lecture
Box-Jenkings models (e.g. ARMA, ARIMA)
Wavelets
Change-points detection
Kalman Filter
Hidden Markov Models

23. Other Highlights Multimodal Event Detection Spatial Event Detection
New Story Detection
Event Extraction

24. Multimodal Event Detection
Each data point (at some time point) is a vector
E.g. patient records from an Emergency Department
How are patient records from 6/1/09
Classical example from healthcare data. People is showing up in an emergency room and you get descriptive data from them. No longer a scalar value. How to write an algorithm able to detect differences between the two groups of patients?
Multimodal change-point detection vs Multimodal event detection: the latter also aims at identifying the subgroup that changed the most.
different from patient records from 6/2/09?

25. Spatial Event Detection
We have spatial time series data from a large number of spatial locations.
From these locations we collect one or more data streams, e.g.: number of emergency departments visits (different types of departments), number of medications and medicines boughts (different types), search queries, number of people missing from work, etc.
OTC = over the counter
We have a set of data records (observations), each one having time-stamp and location. Each count represents the number of observations with given attributes in a given area and time interval.
We assume that an event will result in anomalously high counts for some subsets of data streams for the affected special region and time interval.

26. New Story Detection
Detect the first story discussing a new event from a stream of text
Applications: intelligence, outbreak detection, finance, etc.
Possible methods: KNN, KNN+time, Single-pass Clustering, …
Time
First Stories
Not First Stories
= Topic 1
= Topic 2
KNN: On-line processing of each incoming story. Compute similarity to all previous stories (e.g. with Cosine similarity, Language model, Prominent terms, Extracted entities). If similarity is below threshold: new story. If similarity is above threshold for previous document d: assign to topic of d. Optimal threshold can be chosen based on historical data (Threshold is not topic specific!)
SINGLE-PASS CLUSTERING: Assign each incoming document to one of a set of topic clusters. A topic cluster is represented by its centroid (vector average of members). For incoming story compute similarity s with centroid. As before: s>θ: add document to corresponding cluster, s<θ: first story!
KNN+TIME: Only consider documents in a (short) time window. Compute similarity in a time weighted fashion. m: number of documents in window, d_i: ith document in window. Time weighting significantly increases performance.

27. Event Extraction
Extract event mentions from text (one document can contain many events)
Each event template has a set of possible arguments that can be filled
Common terminology
event trigger: the word which most clearly expresses an event occurrence (often verbs)
event arguments: the “elements” involved in an event (participants, time, places)
event mention: a phrase within which an event is described (arguments + triggers)
ACE = Automatic Content Extraction

28. Evaluation of Event Detection
Datasets
Standard datasets of events and related documents (e.g. TREC, TDT)
Bigger ground truths of only events (e.g. GDELT, Wikipedia Current Events)
Web searches are often used to manually assess precision
Precision
When assessed via Web Searches, it might be overestimated due to unimportant events covered in the web
When assessed with respect to datasets, it might be underestimated due to true events not covered in the dataset
Recall
Impossible to be computed in an absolute way
Only the relative recall given a dataset/ground truth can be computed
Topics and seeds of event detection should match the ones present in the considered dataset/ground truth