## 7 Automated Event Visualization Using Semantic Reasoning
The selected events will be linked as children to the new, parent event with the property folio:hasSubAnomaly. If all child events have the same description or are of the same type (e.g., folio-ext:ShowerAnomaly), the merged event is also assigned that description and/or type, otherwise an additional manual labeling by the user is required. * Deleting (rejecting) event alerts, by clicking the trash bin icon. The user can reject events when they are false alerts. Instead of deleting the event from the database, we mark it as a folio:RejectedAnomaly instead, such that detectors can learn from these negative examples. Please note that we made the design choice of immediately flagging relabeled or merged events as folio:ConfirmedAnomaly as well. We argue that when events are relabeled or merged, their correctness is actually inherently confirmed, given that otherwise (i.e., if an alert was deemed incorrect) the user would delete the alert. Whenever any kind of user interaction updates an event, the dashboard posts the updated event description to the message bus. From here, the update will reach the event detectors and be persisted in a semantic database. Because events are persisted, the dashboard can retrieve historic events if needed, this functionality is shown on the bottom of Figure 3. In the next section, we discuss how the detectors use this user feedback. Figure 3: Options in the event alert list for a user to submit feedback: relabeling (using the pencil icon), merging (selecting multiple events and clicking the merge button) and deleting (using the trash bin icon). ## 9 Improved Event Detection with Captured User Feedback

Using the feedback captured in the dashboard, the performance of event detectors can be improved. For our use case, we employed three additional detectors that incorporate user feedback to automatically detect and label new events. Similar to Section 5, we keep explanations brief and instead refer to dedicated works [4; 17] for further details. ### Matrix Profile-Based Known Pattern Detector

The first feedback-incorporating detector is data-driven and based on the Matrix Profile, similar to the unknown pattern detector described in Section 5. However, where that detector was used to detect unique pattern sequences, this detector is used to detect similarities. Specifically, the detector checks for similarities between previously confirmed events and new incoming data, firing an event when a predefined similarity threshold is reached. Events detected this way will be linked to the original event (i.e., the one they are similar to), and will be assigned the same label. Because the similarity technique in the Matrix Profile can only efficiently compare one series against a single pattern, we need to create one instance per each confirmed event. Though this lead to a much higher number of detector instances, the memory load of each detector is many times smaller as this detector does not require historic data for detections. Since this detector focuses on patterns that have been labeled by the user, it is named the \"known pattern detector\". ### Temporal Rule Mining

Rule mining is most known for association rule mining as part of market basket analysis [28], where rules are mined over products bought by customers to predict which products are often bought together. Association rules consist of two parts, antecedent and consequent, each representing an item set, e.g., a set of products, where the antecedent predicts the consequent. Rule utility is determined by its confidence, the ratio of correct predictions, and its support, the number of times a rule can be applied to a dataset. Temporal rule mining [29] differs only in that it searches for rules in streams of timed events, rather than item sets. As such, rules predict a future event (consequent) after several preceding events (antecedent) have been observed. The second feedback-incorporating component performs temporal rule mining using the algorithm described in [PERSON] et al. [30].