Patent ID: 7509677

Claim:
A method for discovering an event pattern in an event stream, the event stream comprising a plurality of security events, the method comprising: creating a plurality of transactions based on a transaction parameter, wherein each transaction represents a subset of the plurality of security events; generating a transaction tree based on the plurality of transactions, wherein the transaction tree includes one root node and a plurality of non-root nodes, and wherein each non-root node represents a security event; extracting the event pattern from the transaction tree, which comprises: traversing a branch of the transaction tree starting at the root node, wherein the branch extends from the root node through a first non-root node to a second non-root node; observing a drop in support from the first non-root node to the second non-root node, wherein a support of a non-root node represents a number of transactions that include the security event represented by the non-root node; and determining that the event pattern includes the security event represented by the first non-root node and does not include the security event represented by the second non-root node; and storing the event pattern.