Patent ID: 7512589
Filing Date: 2009-03-31
Classification: G06N,Y10S

Abstract:
1. A memory containing an instruction set executable by said processor, said instruction set comprising: a tuple store sub-module comprising a first hash table including a plurality of elements, wherein each element of the first hash table comprises one of a plurality of second hash tables; a data store sub-module comprising a value lookup table in communication with the plurality of second hash tables of the tuple store; a threshold store sub-module in communication with the tuple store sub-module, wherein the threshold store sub-module is configured to create tuples in the tuple store sub-module and to access values stored in the data store sub-module; a state variable store sub-module in communication with the tuple store sub-module, wherein the state variable store sub-module is configured to create tuples in the tuple store sub-module and to access values stored in the data store sub-module; wherein the working memory module is configured to maintain only unique data values, which are automatically purged from the working memory module when no longer referenced; a trigger monitor for determining whether to trigger an action associated with an event correlation rule implemented in a correlation system, the trigger monitor further comprises: a selector wherein the selector determines whether a plurality of events occur within a selected within time period, wherein the selected within time period is measured from the occurrence of the first of the plurality of events and comprises a relative time period independent of the actual time at which the events occur; an event detector wherein the event detector determines whether the plurality of events occur within a selected response window, wherein the selected response window is used to evaluate the real-time significance of the events and comprises an absolute time range corresponding to the actual time at which the events occur in the correlation system; wherein if the plurality of events occur within the selected within time period and within the selected response window, said trigger monitor triggers the action associated with the event correlation rule; wherein the data store sub-module comprises a data structure configured to store unique input data values; wherein the data structure is configured to store unique input data values by converting duplicated input values to unique values and removing unused data values from the data store sub-module; wherein the value lookup table comprises a weak hash map which comprises elements associated with lookup keys; wherein each tuple comprises a unique identification value; the working memory module further comprises a plurality of tickets, wherein each ticket in the plurality comprises an identification value which is identical to the unique identification value of one of the tuples; wherein each ticket further comprises a long value time stamp and a reference count; wherein the working memory module is configured to recycle the identification value when the reference count reaches zero; wherein the working memory module is configured to place the tickets in a ticket priority list when the tickets are assigned to the tuples; wherein the working memory module is configured to receive input, and the created tuples represent the input; wherein the working memory module is configured to conserve memory by pre-allocating a set of tickets which correspond to the created tuple, and ceasing to generate new tuples after all of the pre-allocated tickets have been assigned to created tuples.