CT-NOR: Representing and Reasoning About Events in Continuous Time

We present a generative model for repre- senting and reasoning about the relation- ships among events in continuous time. We apply the model to the domain of net- worked and distributed computing environ- ments where we fit the parameters of the model from timestamp observations, and then use hypothesis testing to discover de- pendencies between the events and changes in behavior for monitoring and diagnosis. After introducing the model, we present an EM algorithm for fitting the parame- ters and then present the hypothesis test- ing approach for both dependence discovery and change-point detection. We validate the approach for both tasks using real data from a trace of network events at Microsoft Research Cambridge. Finally, we formal- ize the relationship between the proposed model and the noisy-or gate for cases when time can be discretized.