+ All Categories
Home > Documents > Modeling and Applications for Temporal Point Processes...

Modeling and Applications for Temporal Point Processes...

Date post: 31-Jul-2020
Category:
Upload: others
View: 1 times
Download: 0 times
Share this document with a friend
81
Modeling and Applications for Temporal Point Processes - Part I Hongteng Xu 1 Infinia ML, Inc. 2 Department of ECE, Duke University August 4, 2019 1 / 54
Transcript
Page 1: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Modeling and Applications for TemporalPoint Processes

- Part I

Hongteng Xu

1Infinia ML, Inc.2Department of ECE, Duke University

August 4, 2019

1 / 54

Page 2: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Outline

I Part I: Basics and typical models for TPPs1. Real-world event sequences2. Temporal point processes and intensity functions3. Classic learning strategies4. Simulation and prediction5. Hawkes processes6. Open source packages

I Part II: Deep networks for temporal point processes

I Part III: Temporal point processes in practice

2 / 54

Page 3: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Event sequences in real world: Earthquakes

Figure 1: The locations and the intensities of the earthquakes from 1900to 2017 [Ogata(1988)].

3 / 54

Page 4: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Event sequences in real world: Social Networks

Figure 2: User behaviors onnets [Farajtabar et al.(2015), Zhao et al.(2015)].

4 / 54

Page 5: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Event sequences in real-world: Patient Flows

Figure 3: The transition behaviors of patients among different careunits [Xu et al.(2016)a].

5 / 54

Page 6: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Event sequences in real world: Conflicts

Figure 4: The Afghan war diary (AWD) in 320weeks [Zammit et al.(2012)].

6 / 54

Page 7: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Event sequence modeling

I Earthquakes

I Social networks

I Patient flow

I Conflicts

I Financial trades

I Taxi transports

I Online shopping

I ...

Asynchronous and interdependent eventsequences: s = {(ti , di , fi )}Ii=1

I Time stamps: ti ∈ [0,T ].

I Entities (event types): di ∈ D = {1, ...,D}.I Optional Marks (features): fi ∈ RD .

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

7 / 54

Page 8: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Event sequence modeling

I Earthquakes

I Social networks

I Patient flow

I Conflicts

I Financial trades

I Taxi transports

I Online shopping

I ...

Asynchronous and interdependent eventsequences: s = {(ti , di , fi )}Ii=1

I Time stamps: ti ∈ [0,T ].

I Entities (event types): di ∈ D = {1, ...,D}.I Optional Marks (features): fi ∈ RD .

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

7 / 54

Page 9: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Event sequence modeling

I Earthquakes

I Social networks

I Patient flow

I Conflicts

I Financial trades

I Taxi transports

I Online shopping

I ...

Asynchronous and interdependent eventsequences: s = {(ti , di , fi )}Ii=1

I Time stamps: ti ∈ [0,T ].

I Entities (event types): di ∈ D = {1, ...,D}.I Optional Marks (features): fi ∈ RD .

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

7 / 54

Page 10: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Event sequence modeling

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

How to describe/represent event sequences quantitatively?

8 / 54

Page 11: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Event sequence modeling

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

How to describe/represent event sequences quantitatively?

8 / 54

Page 12: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Event sequence modeling

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

How to describe/represent event sequences quantitatively?

8 / 54

Page 13: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Event sequence modeling

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

How to describe/represent event sequences quantitatively?

8 / 54

Page 14: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Outline

I Part I: Basics and typical models for TPPs1. Real-world event sequences2. Temporal point processes and intensity functions3. Classic learning strategies4. Simulation and prediction5. Hawkes processes6. Open source packages

I Part II: Deep networks for temporal point processes

I Part III: Temporal point processes in practice

9 / 54

Page 15: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Temporal point processes: Intensity functions

I Event sequence: s = {(ti , di )}Ii=1, di ∈ D = {1, ...,D}.I D-dimensional counting processes: N = {Nd(t)}Dd=1.

Nd(t) is the number of type-d events occurring till time t.

{ Intensity Function

{ Intensity Function

I Intensity function: The expected instantaneous happeningrate of type-d events given historical observations.

λd(t) =E[dNd(t)|Htlast ]

dt, Htlast = {(ti , di )|ti ≤ tlast , di ∈ D}.

10 / 54

Page 16: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Temporal point processes: Intensity functions

I Event sequence: s = {(ti , di )}Ii=1, di ∈ D = {1, ...,D}.I D-dimensional counting processes: N = {Nd(t)}Dd=1.

Nd(t) is the number of type-d events occurring till time t.

{ Intensity Function{ Intensity Function

I Intensity function: The expected instantaneous happeningrate of type-d events given historical observations.

λd(t) =E[dNd(t)|Htlast ]

dt, Htlast = {(ti , di )|ti ≤ tlast , di ∈ D}.

10 / 54

Page 17: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Intensity functions and conditional probabilities

I Intensity function: The expected instantaneous happeningrate of type-u event given the history Htlast .

λd(t) =E[dNd(t)|Htlast ]

dt=

p(t, d |Htlast )

1− F (t|Htlast ).

I p(t, d |Htlast ): the conditional probability density function(pdf) that type-d event happens at time t given history.

I F (t|Htlast ): the conditional probability that there is at leastone event happening in (tlast , t] given history.

11 / 54

Page 18: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Intensity functions and conditional probabilitiesThe overall intensity is

λ(t) =D∑

d=1

λd(t)

=D∑

d=1

p(t, d |Htlast )

1− F (t|Htlast )=

p(t|Htlast )

1− F (t|Htlast )

=

dF (t|Htlast)

dt

1− F (t|Htlast )= − d

dtlog(1− F (t|Htlast )).

(1)

Therefore we have

F (t|Htlast ) = 1− exp(−∫ ttlast

λ(s)ds), (2)

p(t|Htlast ) = λ(t) exp(−∫ ttlast

λ(s)ds), (3)

p(t, d |Htlast ) = λd(t) exp(−∫ ttlast

λ(s)ds), (4)

p(d |t,Htlast ) = λd (t)λ(t) . (5)

12 / 54

Page 19: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Intensity functions and conditional probabilitiesThe overall intensity is

λ(t) =D∑

d=1

λd(t)

=D∑

d=1

p(t, d |Htlast )

1− F (t|Htlast )=

p(t|Htlast )

1− F (t|Htlast )

=

dF (t|Htlast)

dt

1− F (t|Htlast )= − d

dtlog(1− F (t|Htlast )).

(1)

Therefore we have

F (t|Htlast ) = 1− exp(−∫ ttlast

λ(s)ds), (2)

p(t|Htlast ) = λ(t) exp(−∫ ttlast

λ(s)ds), (3)

p(t, d |Htlast ) = λd(t) exp(−∫ ttlast

λ(s)ds), (4)

p(d |t,Htlast ) = λd (t)λ(t) . (5)

12 / 54

Page 20: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Intensity functions and conditional probabilitiesThe overall intensity is

λ(t) =D∑

d=1

λd(t)

=D∑

d=1

p(t, d |Htlast )

1− F (t|Htlast )=

p(t|Htlast )

1− F (t|Htlast )

=

dF (t|Htlast)

dt

1− F (t|Htlast )= − d

dtlog(1− F (t|Htlast )).

(1)

Therefore we have

F (t|Htlast ) = 1− exp(−∫ ttlast

λ(s)ds), (2)

p(t|Htlast ) = λ(t) exp(−∫ ttlast

λ(s)ds), (3)

p(t, d |Htlast ) = λd(t) exp(−∫ ttlast

λ(s)ds), (4)

p(d |t,Htlast ) = λd (t)λ(t) . (5)

12 / 54

Page 21: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Intensity functions and conditional probabilitiesThe overall intensity is

λ(t) =D∑

d=1

λd(t)

=D∑

d=1

p(t, d |Htlast )

1− F (t|Htlast )=

p(t|Htlast )

1− F (t|Htlast )

=

dF (t|Htlast)

dt

1− F (t|Htlast )= − d

dtlog(1− F (t|Htlast )).

(1)

Therefore we have

F (t|Htlast ) = 1− exp(−∫ ttlast

λ(s)ds), (2)

p(t|Htlast ) = λ(t) exp(−∫ ttlast

λ(s)ds), (3)

p(t, d |Htlast ) = λd(t) exp(−∫ ttlast

λ(s)ds), (4)

p(d |t,Htlast ) = λd (t)λ(t) . (5)

12 / 54

Page 22: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Intensity functions and conditional probabilitiesThe overall intensity is

λ(t) =D∑

d=1

λd(t)

=D∑

d=1

p(t, d |Htlast )

1− F (t|Htlast )=

p(t|Htlast )

1− F (t|Htlast )

=

dF (t|Htlast)

dt

1− F (t|Htlast )= − d

dtlog(1− F (t|Htlast )).

(1)

Therefore we have

F (t|Htlast ) = 1− exp(−∫ ttlast

λ(s)ds), (2)

p(t|Htlast ) = λ(t) exp(−∫ ttlast

λ(s)ds), (3)

p(t, d |Htlast ) = λd(t) exp(−∫ ttlast

λ(s)ds), (4)

p(d |t,Htlast ) = λd (t)λ(t) . (5)

12 / 54

Page 23: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Outline

I Part I: Basics and typical models for TPPs1. Real-world event sequences2. Temporal point processes and intensity functions3. Classic learning strategies4. Simulation and prediction5. Hawkes processes6. Open source packages

I Part II: Deep networks for temporal point processes

I Part III: Temporal point processes in practice

13 / 54

Page 24: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Learning TPPs

I The key of learning a temporal point process {Nd}Dd=1 isparametrizing and estimating its intensity functions, i .e.,{λd(t; θ)}Dd=1.

I Given a TPP model {λd(t; θ)}Dd=1, the common learningstrategies include:

I Maximum likelihood estimation.I Least-square estimation.I Discriminative learning.

I The convergence of MLE and that of LS are guaranteed.They can achieve unbiased estimation of intensity function.

I Recently, the reinforcement learning of temporal pointprocesses is considered in [Li et al.(2018)].

14 / 54

Page 25: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Learning TPPs

I The key of learning a temporal point process {Nd}Dd=1 isparametrizing and estimating its intensity functions, i .e.,{λd(t; θ)}Dd=1.

I Given a TPP model {λd(t; θ)}Dd=1, the common learningstrategies include:

I Maximum likelihood estimation.I Least-square estimation.I Discriminative learning.

I The convergence of MLE and that of LS are guaranteed.They can achieve unbiased estimation of intensity function.

I Recently, the reinforcement learning of temporal pointprocesses is considered in [Li et al.(2018)].

14 / 54

Page 26: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Learning TPPs

I The key of learning a temporal point process {Nd}Dd=1 isparametrizing and estimating its intensity functions, i .e.,{λd(t; θ)}Dd=1.

I Given a TPP model {λd(t; θ)}Dd=1, the common learningstrategies include:

I Maximum likelihood estimation.I Least-square estimation.I Discriminative learning.

I The convergence of MLE and that of LS are guaranteed.They can achieve unbiased estimation of intensity function.

I Recently, the reinforcement learning of temporal pointprocesses is considered in [Li et al.(2018)].

14 / 54

Page 27: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Learning TPPs: MLEGiven an event sequence, i .e., s = {(ti , ui )}Ii=1, we can write thelikelihood function as

L(s; {λd}Dd=1) =In∏i=1

p(ti , di |Hti−1)× (1− F (T |HtI ))

Eqs.(2,4)=

I∏i=1

λdi (ti ) exp

(−∫ ti

ti−1

λ(s)ds

)× exp

(−∫ T

tI

λ(s)ds

)

=I∏

i=1

λdi (ti )× exp

(−∫ T

0λ(s)ds

).

(6)

Accordingly, given a set of event sequences S = {sn}Nn=1, we canlearn the TPP model {λd(t)}Dd=1 by maximum likelihoodestimation (MLE) [Zhou et al.(2013), Xu et al.(2016)]:

min{λd}Dd=1

−∑s∈S

log L(s; {λd}Dd=1) + αR({λd}Dd=1), (7)

15 / 54

Page 28: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Learning TPPs: MLEGiven an event sequence, i .e., s = {(ti , ui )}Ii=1, we can write thelikelihood function as

L(s; {λd}Dd=1) =In∏i=1

p(ti , di |Hti−1)× (1− F (T |HtI ))

Eqs.(2,4)=

I∏i=1

λdi (ti ) exp

(−∫ ti

ti−1

λ(s)ds

)× exp

(−∫ T

tI

λ(s)ds

)

=I∏

i=1

λdi (ti )× exp

(−∫ T

0λ(s)ds

).

(6)

Accordingly, given a set of event sequences S = {sn}Nn=1, we canlearn the TPP model {λd(t)}Dd=1 by maximum likelihoodestimation (MLE) [Zhou et al.(2013), Xu et al.(2016)]:

min{λd}Dd=1

−∑s∈S

log L(s; {λd}Dd=1) + αR({λd}Dd=1), (7)

15 / 54

Page 29: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Learning TPPs: Least-Square (LS) Estimation

The idea of least-square estimation is very straightforward —fitting the observed counting processes via the integral of intensityfunctions [Wang et al.(2016)]:

min{λd}Dd=1

I∑i=1

D∑d=1

[Nd(ti )−

∫ ti

0λd(s)ds

]2. (8)

Because the variance V[Nd(t)−∫ t

0 λd(s)ds] ∼ O(t2), the workin [Xu et al.(2017)b] further modifies the objective function as

min{λd}Dd=1

I∑i=1

D∑d=1

1

t2i

[Nd(ti )−

∫ ti

0λd(s)ds

]2. (9)

16 / 54

Page 30: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Learning TPPs: Least-Square (LS) Estimation

The idea of least-square estimation is very straightforward —fitting the observed counting processes via the integral of intensityfunctions [Wang et al.(2016)]:

min{λd}Dd=1

I∑i=1

D∑d=1

[Nd(ti )−

∫ ti

0λd(s)ds

]2. (8)

Because the variance V[Nd(t)−∫ t

0 λd(s)ds] ∼ O(t2), the workin [Xu et al.(2017)b] further modifies the objective function as

min{λd}Dd=1

I∑i=1

D∑d=1

1

t2i

[Nd(ti )−

∫ ti

0λd(s)ds

]2. (9)

16 / 54

Page 31: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Learning TPPs: Least-Square (LS) EstimationOr, we can define a contrast function [Bacry et al.(2017)a]:

C ({λd}) =D∑

d=1

∫ T

0λ2d(s)ds − 2

∫ T

0λd(s)dNd(s), (10)

and learn the TPP by minizing the expectation of the contrastfunction (fitting the empirical intensity function directly under L2

error) [Bacry et al.(2017)a, Eichler et al.(2017)]:

arg min{λd}Dd=1

E[C ({λd})]

= arg min{λd}Dd=1

D∑d=1

E[(λd(t)− λd(t))2],(11)

The empirical intensity function is the differential of discretizedcounting process:

λd(t) =Nd(t + ∆t)− Nd(t)

∆t, (12)

17 / 54

Page 32: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Learning TPPs: Discriminative Learning

Sometimes, the data are insufficient to estimate likelihood and themain task is predict event types given timestamps, we can considerthe discriminative learning of TPPs — maximizing the conditionalprobability p(d |t,Htlast ) given observations.

max{λd}Dd=1

I∑i=1

log p(di |ti ,Hti−1)

= max{λd}Dd=1

I∑i=1

logλdi (ti )

λ(ti )

(13)

When λd(t) = exp(fd(t)), where fd(t) is an arbitrary function(e.g ., a neural network), Eq. (13) corresponds to a softmaxregression problem [Xu et al.(2016)a].

18 / 54

Page 33: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Learning TPPs: Discriminative Learning

Sometimes, the data are insufficient to estimate likelihood and themain task is predict event types given timestamps, we can considerthe discriminative learning of TPPs — maximizing the conditionalprobability p(d |t,Htlast ) given observations.

max{λd}Dd=1

I∑i=1

log p(di |ti ,Hti−1)

= max{λd}Dd=1

I∑i=1

logλdi (ti )

λ(ti )

(13)

When λd(t) = exp(fd(t)), where fd(t) is an arbitrary function(e.g ., a neural network), Eq. (13) corresponds to a softmaxregression problem [Xu et al.(2016)a].

18 / 54

Page 34: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Gradient-based learning

I All the learning strategies above are rely on gradient-basedlearning.

I For some typical TPP models like Hawkes processes, the MLEcan be achieved by an EM algorithm, which corresponds toprojected gradient descent, and the LS estimation have closedform solutions.

I When the observed event sequences are independent, we canapply min-batch optimization.

I When the intensity function at time t is mainly influenced bythe historical events in [t −∆t, t), which is common inpractice, we can apply a sliding window to each sequence, anddefine min-batch on the corresponding sub-sequences.

19 / 54

Page 35: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Gradient-based learning

I All the learning strategies above are rely on gradient-basedlearning.

I For some typical TPP models like Hawkes processes, the MLEcan be achieved by an EM algorithm, which corresponds toprojected gradient descent, and the LS estimation have closedform solutions.

I When the observed event sequences are independent, we canapply min-batch optimization.

I When the intensity function at time t is mainly influenced bythe historical events in [t −∆t, t), which is common inpractice, we can apply a sliding window to each sequence, anddefine min-batch on the corresponding sub-sequences.

19 / 54

Page 36: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Outline

I Part I: Basics and typical models for TPPs1. Real-world event sequences2. Temporal point processes and intensity functions3. Classic learning strategies4. Simulation and prediction5. Hawkes processes6. Open source packages

I Part II: Deep networks for temporal point processes

I Part III: Temporal point processes in practice

20 / 54

Page 37: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation of TPPs: Ogata’s modified thinning algorithm

I Given a predefined or pre-trained TPP {λd}Dd=1, we cansimulate new sequences and predict future behaviors.

I At time t, we need to find out where to place the next pointti > t and which type di ∈ D it is.

I Ogata’s modified thinning algorithm [Ogata(1981)] hasbeen widely used to simulate sequences.

I The basic idea is

1. Simulate a homogeneous Poisson process on some interval[t, t + L(t)] for some chosen distance function L(t). Theintensity of the Poisson process satisfiesm(t) ≥ sups∈[t,t+L(t)] λ(s).

2. Thin out the points that are too many according to the real

λ(t), e.g ., keep a point at ti with probability λ(ti )m(t) .

21 / 54

Page 38: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation of TPPs: Ogata’s modified thinning algorithm

I Given a predefined or pre-trained TPP {λd}Dd=1, we cansimulate new sequences and predict future behaviors.

I At time t, we need to find out where to place the next pointti > t and which type di ∈ D it is.

I Ogata’s modified thinning algorithm [Ogata(1981)] hasbeen widely used to simulate sequences.

I The basic idea is

1. Simulate a homogeneous Poisson process on some interval[t, t + L(t)] for some chosen distance function L(t). Theintensity of the Poisson process satisfiesm(t) ≥ sups∈[t,t+L(t)] λ(s).

2. Thin out the points that are too many according to the real

λ(t), e.g ., keep a point at ti with probability λ(ti )m(t) .

21 / 54

Page 39: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation of TPPs: Ogata’s modified thinning algorithm

Given a TPP model {λd}Dd=1, we can simulate an event sequencein [0,T ] using the following steps:

1. Set t = 0, i = 0

2. Repeat till t > T :I Compute L(t) and a constant intensity m(t) in [t, t + L(t)].I Simulate a Poisson process: ∆t ∼ exp(m(t)), u ∼ Unif[0, 1].

I If ∆t < L(t) and t + ∆t < T and u ≤ λ(t + ∆t)

m(t)︸ ︷︷ ︸thinning criterion

:

i = i + 1,ti = t + ∆t. (a new time stamp)

di ∼ [λ1(ti )λ(ti )

, ..., λD (ti )λ(ti )

]. (a new event type)I t = t + min({L(t),∆t}).

3. Output s = {(ti , di )}Ii=1.

22 / 54

Page 40: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation of TPPs: Ogata’s modified thinning algorithm

Given a TPP model {λd}Dd=1, we can simulate an event sequencein [0,T ] using the following steps:

1. Set t = 0, i = 0

2. Repeat till t > T :I Compute L(t) and a constant intensity m(t) in [t, t + L(t)].I Simulate a Poisson process: ∆t ∼ exp(m(t)), u ∼ Unif[0, 1].

I If ∆t < L(t) and t + ∆t < T and u ≤ λ(t + ∆t)

m(t)︸ ︷︷ ︸thinning criterion

:

i = i + 1,ti = t + ∆t. (a new time stamp)

di ∼ [λ1(ti )λ(ti )

, ..., λD (ti )λ(ti )

]. (a new event type)I t = t + min({L(t),∆t}).

3. Output s = {(ti , di )}Ii=1.

22 / 54

Page 41: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation of TPPs: Prediction

Given a TPP model {λd}Dd=1 and its observations in [0,T ], we canmake predictions for the events in the future, (T ,T + ∆t].

I If ∆t is very small, we can make instantaneous predictions onthe probability of type-d event:

p(d |T + ∆t,HT ) =λd(T + ∆t)

λ(T + ∆t). (14)

I If ∆t is large, we can make long-term predictions on theexpected number of type-d events in (T ,T + ∆t] bysimulation:

1

K

K∑k=1

(N(k)d (T + ∆t)− Nd(T )). (15)

23 / 54

Page 42: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation of TPPs: Prediction

Given a TPP model {λd}Dd=1 and its observations in [0,T ], we canmake predictions for the events in the future, (T ,T + ∆t].

I If ∆t is very small, we can make instantaneous predictions onthe probability of type-d event:

p(d |T + ∆t,HT ) =λd(T + ∆t)

λ(T + ∆t). (14)

I If ∆t is large, we can make long-term predictions on theexpected number of type-d events in (T ,T + ∆t] bysimulation:

1

K

K∑k=1

(N(k)d (T + ∆t)− Nd(T )). (15)

23 / 54

Page 43: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Outline

I Part I: Basics and typical models for TPPs1. Real-world event sequences2. Temporal point processes and intensity functions3. Classic learning strategies4. Simulation and prediction5. Hawkes processes6. Open source packages

I Part II: Deep networks for temporal point processes

I Part III: Temporal point processes in practice

24 / 54

Page 44: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Hawkes process

Homogeneous Poisson process:

λd(t) = µd (16)

Simple, but memoryless...

Hawkes process: model the self- and mutually-triggering patternshidden in event sequences explicitly [Hawkes(1971), Liniger(2009)].

25 / 54

Page 45: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Hawkes processThe intensity functions of a D-dimensional Hawkes process,denoted as HP(µ,Φ), are

λd(t) = µd︸︷︷︸exogenous

+∑D

v=1

∫ t

0φdv (t, s)dNv (s)︸ ︷︷ ︸

endogenous triggering

= µd +∑

ti<tφddi (t, ti )

(17)

I µ = [µd ] ≥ 0: exogenous fluctuation of the system.

I∑

ti<t φddi (t, ti ): endogenous triggering term caused thesystem’s history.

I Φ = [φdv (t, s) ≥ 0], s ≤ t: impact functions, representingthe influence of type-v event at time s on type-d event attime t.

I φdd(t, s): self-triggering pattern.I φdv (t, s), d 6= v : mutually-triggering pattern.

26 / 54

Page 46: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Hawkes process: parametrization strategies

I We often assume that the impact functions are shift-invariant:φdv (t, s) = φdv (t − s).

I The widely-used impact functions include:

1. Exponential impact function [Zhou et al.(2013)]:

φdv (t) = adv exp(−wt). (18)

2. Basis representation [Xu et al.(2016)]:

φdv (t) =M∑

m=1

amdvκm(t). (19)

I Accordingly, the parameters of Hawkes process include theexogenous fluctuations µ = [µd ] and the parameters of theimpact functions A = [amdv ].

27 / 54

Page 47: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Hawkes process

Hawkes process is important because

I Connections with real-world scenarios.

I Well-studied stationary properties.

I Explicit representation of Granger causality.

I High efficiency on learning.

I High efficiency on simulation.

I Superposition properties and robustness to data sparsity.

28 / 54

Page 48: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Connections with real-world scenarios

(a) Earthquakes (b) Social networks

(c) Patient flow (d) Conflicts

Figure 5: Illustrations of event sequences modeled by Hawkes processes.

29 / 54

Page 49: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Explicit representation of Granger causalityThe impact functions not only decides the stationary of Hawkesprocesses but also provide us with an explicit representation ofGranger causality graph of event types [Xu et al.(2016)].

Scene Entities Sequences Task

Patient admission Diseases Patients’ admissions Disease networkJob hopping Companies Employee’s job history Company network

Social network Users Users’ interactions User network

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

Prob 4:More applications

(a) Observations (b) Hawkes process (c) Granger causality

Figure 6: Learning Granger causality graph based on Hawkes processes.

Theorem (Eichler et al. 2015)

For stationary Hawkes processes, v → u /∈ Eif and only if φuv (t, s) ≡ 0

30 / 54

Page 50: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Explicit representation of Granger causalityThe impact functions not only decides the stationary of Hawkesprocesses but also provide us with an explicit representation ofGranger causality graph of event types [Xu et al.(2016)].

Scene Entities Sequences Task

Patient admission Diseases Patients’ admissions Disease networkJob hopping Companies Employee’s job history Company network

Social network Users Users’ interactions User network

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

Prob 4:More applications

(a) Observations (b) Hawkes process

(c) Granger causality

Figure 6: Learning Granger causality graph based on Hawkes processes.

Theorem (Eichler et al. 2015)

For stationary Hawkes processes, v → u /∈ Eif and only if φuv (t, s) ≡ 0

30 / 54

Page 51: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Explicit representation of Granger causalityThe impact functions not only decides the stationary of Hawkesprocesses but also provide us with an explicit representation ofGranger causality graph of event types [Xu et al.(2016)].

Scene Entities Sequences Task

Patient admission Diseases Patients’ admissions Disease networkJob hopping Companies Employee’s job history Company network

Social network Users Users’ interactions User network

time

dim. 1

dim. 2

dim. 3

asynchronous and interdependent data

red arrows indicate dependency

Fig. 1. Asynchronously and interdependently generated high dimensional event data are fundamentally different from i.i.d. and time-seriesdata. First, observations for each dimension can be collected at different time points; Second, there can be temporal dependence as wellas cross-dimensional dependence. In contrast, the dimensions of i.i.d. and time-series data are sampled at the same time point, and in thefigure, different marks indicate potentially different values or features of an observation.

for large networks.Our contributions. In this paper, we present a novel

online change-point detection framework tailored to multi-dimensional intertwined event data streams over networks(or conceptual networks) tackling the above challenges. Weformulate the problem by leveraging the mathematical frame-work of sequential hypothesis testing and point processesmodeling, where before the change the event stream followsone point process, and after the change the event streambecomes a different point process. Our goal is to detect suchchanges as quickly as possible after the occurrences. Wederive generalized likelihood ratio statistics, and present anefficient EM-like algorithm to compute the statistic onlinewith streaming data. The EM-like algorithm is parameter-freeand can be implemented in a distributed fashion and, hence,it is suitable for large networks.

Specifically, our contributions include the following:(i) We present a new sequential hypothesis test and like-

lihood ratio approach for detecting changes for the eventdata streams over networks. We will either use the Poissonprocess as the null distribution to detect the appearanceof temporal independence, or use the Hawkes process asthe null distribution to detect the possible alteration of thedependency structure. For (inhomogeneous) Poisson process,time intervals between events are assumed to be indepen-dent and exponentially distributed. For Hawkes process, theoccurrence intensity of events depends on the events thathave occurred, which implies that the time intervals betweenevents would be correlated. Therefore, Hawkes process canbe thought of as a special autoregressive process in time,and multivariate Hawkes process also provides a flexiblemodel to capture cross-dimension dependency in additionto temporal dependency. Our model explicitly captures theinformation diffusion (and dependencies) both over networksand time, and allows us to aggregate information for weaksignal detection. Our proposed detection framework is quitegeneral and can be easily adapted to other point processes.

In contrast, existing work on change-point detection forpoint processes has also been focused on a single streamrather than the multidimensional case with networks. Thesework including detecting change in the intensity of a Poissonprocess [9]–[11] and the coefficient of continuous diffusionprocess [12]; detecting change using the self-exciting Hawkesprocesses include trend detection in social networks [13];

detecting for Poisson processes using a score statistic [14].(ii) We present an efficient expectation-maximization (EM)

like algorithm for updating the likelihood-ratio detectionstatistic online. The algorithm can be implemented in adistributed fashion due to is structure: only neighboring nodesneed to exchange information for the E-step and M-step.

(iii) We also present accurate theoretical approximation tothe false-alarm-rate (formally the average-run-length or ARL)of the detection algorithm, via the recently developed change-of-measure approach to handle highly correlated statistics.Our theoretical approximation can be used to determine thethreshold in the algorithm accurately.

(iv) Finally, we demonstrate the performance gain of ouralgorithm over two baseline algorithms (which ignore thetemporal correlation and correlation between nodes), usingsynthetic experiments and real-world data. These two baselinealgorithms representing the current approaches for processingevent stream data. We also show that our algorithm is verysensitive to true changes, and the theoretical false-alarm-ratesare very accurate compared to the experimental results.

Related work. Recently, there has been a surge of in-terests in using multidimensional point processes for mod-eling dynamic event data over networks. However, most ofthese works focus on modeling and inference of the pointprocesses over networks. Related works include modelingand learning bursty dynamics [5]; shaping social activityby incentivization [15]; learning information diffusion net-works [4]; inferring causality [16]; learning mutually excitingprocesses for viral diffusion [17]; learning triggering kernelsfor multi-dimensional Hawkes processes [18]; in networkswhere each dimension is a Poisson process [19]; learninglatent network structure for general counting processes [20];tracking parameters of dynamic point process networks [21];and estimating point process models for the co-evolutionof network structure an information diffusion [22], just toname a few. These existing works provide a wealth of toolsthrough which we can, to some extent, keep track of thenetwork dynamics if the model parameters can be sequentiallyupdated. However, only given the values of the up-to-datemodel parameters, especially in high dimensional networks,it is still not clear how to perform change detection based onthese models in a principled fashion.

Classical statistical sequential analysis (see, e.g., [23],[24]), where one monitors i.i.d. univariate and low-

2

Prob 1: Learn triggering pattern (or called Granger causality) among events

Prob 2: Learn clusters of event sequences

Prob 3: Predict future events

Prob 3:Predict future events

Prob 4:More applications

(a) Observations (b) Hawkes process (c) Granger causality

Figure 6: Learning Granger causality graph based on Hawkes processes.

Theorem (Eichler et al. 2015)

For stationary Hawkes processes, v → u /∈ Eif and only if φuv (t, s) ≡ 0

30 / 54

Page 52: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Explicit representation of Granger causality

Theorem ([Eichler et al.(2017)])

For a Hawkes process, v → d /∈ E if and only if φdv (t) ≡ 0

(a) Hawkes process (b) G(D, E)

Figure 7: The sparsity of impact functions indicates G (D, E).

Take MLE as an example [Zhou et al.(2013), Xu et al.(2016)]:

φdv = adv exp(−wt) : minµ,A≥0−∑

s∈S log L(s;µ,A) + α‖A‖1,

φdv =∑

m amdvκm(t) : minµ,A≥0−∑

s∈S log L(s;µ,A) + α‖A‖1,2,

31 / 54

Page 53: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Explicit representation of Granger causality

Theorem ([Eichler et al.(2017)])

For a Hawkes process, v → d /∈ E if and only if φdv (t) ≡ 0

(a) Hawkes process (b) G(D, E)

Figure 7: The sparsity of impact functions indicates G (D, E).

Take MLE as an example [Zhou et al.(2013), Xu et al.(2016)]:

φdv = adv exp(−wt) : minµ,A≥0−∑

s∈S log L(s;µ,A) + α‖A‖1,

φdv =∑

m amdvκm(t) : minµ,A≥0−∑

s∈S log L(s;µ,A) + α‖A‖1,2,

31 / 54

Page 54: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Explicit representation of Granger causality

?11

0 2 4 60

0.050.1

Real MLE MLE-SGLP

?12

0 2 4 60

0.050.1

?13

0 2 4 60

0.050.1

?14

0 2 4 60

0.050.1

?15

0 2 4 60

0.050.1

?21

0 2 4 60

0.050.1

?22

0 2 4 60

0.050.1

?23

0 2 4 60

0.050.1

?24

0 2 4 60

0.050.1

?25

0 2 4 60

0.050.1

?31

0 2 4 60

0.050.1

?32

0 2 4 60

0.050.1

?33

0 2 4 60

0.050.1

?34

0 2 4 60

0.050.1

?35

0 2 4 60

0.050.1

?41

0 2 4 60

0.050.1

?42

0 2 4 60

0.050.1

?43

0 2 4 60

0.050.1

?44

0 2 4 60

0.050.1

?45

0 2 4 60

0.050.1

?51

0 2 4 60

0.050.1

?52

0 2 4 60

0.050.1

?53

0 2 4 60

0.050.1

?54

0 2 4 60

0.050.1

?55

0 2 4 60

0.050.1

Figure 8: The regularizer imposes sparsity on impact functions.

32 / 54

Page 55: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Explicit representation of Granger causality

?11

0 2 4 60

0.050.1

Real MLE MLE-SGLP

?12

0 2 4 60

0.050.1

?13

0 2 4 60

0.050.1

?14

0 2 4 60

0.050.1

?15

0 2 4 60

0.050.1

?21

0 2 4 60

0.050.1

?22

0 2 4 60

0.050.1

?23

0 2 4 60

0.050.1

?24

0 2 4 60

0.050.1

?25

0 2 4 60

0.050.1

?31

0 2 4 60

0.050.1

?32

0 2 4 60

0.050.1

?33

0 2 4 60

0.050.1

?34

0 2 4 60

0.050.1

?35

0 2 4 60

0.050.1

?41

0 2 4 60

0.050.1

?42

0 2 4 60

0.050.1

?43

0 2 4 60

0.050.1

?44

0 2 4 60

0.050.1

?45

0 2 4 60

0.050.1

?51

0 2 4 60

0.050.1

?52

0 2 4 60

0.050.1

?53

0 2 4 60

0.050.1

?54

0 2 4 60

0.050.1

?55

0 2 4 60

0.050.1

Figure 9: The learning of Granger causality graph is robust to modelmisspecficiation.

33 / 54

Page 56: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

High efficiency on learning

I For the Hawkes processes with φdv (t) =∑M

m=1 amdvκm(t), if

{κm(t)}Mm=1 are predefined. Both MLE and LS correspond toconvex optimization.

I If {κm(t)}Mm=1 are fast-decay functions, e.g ., exponentialfunctions, we can truncate the history of each event and applySGD on the batch of events.

I It is easy to impose structures on the impact functions, addingregularizers to the optimization problems.

I It is easy to take side information (features of events) intoaccount, further parametrizing exogenous intensity and impactfunctions.

34 / 54

Page 57: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation: Acceleration of Ogata’s thinning methodFor some specific Hawkes processes, we can accelerate theirsimulations with the help of the recursive representation ofintensity functions.

λd(t) = µd +∑

ti<taddi exp(−w(t − ti )) (20)

If nothing happens in (t, t + ∆t]:

λd(t + ∆t) = µd +∑

ti<t+∆taddi exp(−w(t + ∆t − ti ))

= µd + exp(−w∆t)∑

ti<taddi exp(−w(t − ti ))

= µd + exp(−w∆t)(λd(t)− µd)

If there is one event (t ′, d ′) happening in (t, t + ∆t]:

λd(t + ∆t) = µd +∑

ti<t+∆taddi exp(−w(t + ∆t − ti ))

= µd + exp(−w∆t)(λd(t)− µd + add ′ exp(−w(t − t ′)))

35 / 54

Page 58: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation: Acceleration of Ogata’s thinning methodFor some specific Hawkes processes, we can accelerate theirsimulations with the help of the recursive representation ofintensity functions.

λd(t) = µd +∑

ti<taddi exp(−w(t − ti )) (20)

If nothing happens in (t, t + ∆t]:

λd(t + ∆t) = µd +∑

ti<t+∆taddi exp(−w(t + ∆t − ti ))

= µd + exp(−w∆t)∑

ti<taddi exp(−w(t − ti ))

= µd + exp(−w∆t)(λd(t)− µd)

If there is one event (t ′, d ′) happening in (t, t + ∆t]:

λd(t + ∆t) = µd +∑

ti<t+∆taddi exp(−w(t + ∆t − ti ))

= µd + exp(−w∆t)(λd(t)− µd + add ′ exp(−w(t − t ′)))

35 / 54

Page 59: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation: Acceleration of Ogata’s method

Recall Ogata’s simulation method:

1. Set t = 0, i = 0

2. Repeat till t > T :

I(((((((((((hhhhhhhhhhhCompute L(t) and m(t).

I Simulate a Poisson process: ∆t ∼ exp(λ(t)), u ∼ Unif[0, 1].I If ∆t < L(t) and t + ∆t < T and u ≤ λ(t+∆t)

λ(t) :i = i + 1,ti = t + ∆t. (a new time stamp)

di ∼ [λ1(ti )λ(ti )

, ..., λD (ti )λ(ti )

]. (a new event type)I t = t + ∆t.

3. Output s = {(ti , di )}Ii=1.

For the Hawkes processes with exponential impact functions,the intensity always decays when nothing happens. Therefore,we have

I L(t) can be ∞, and m(t) = sups∈[t,t+L(t)] λ(t) = λ(t).

36 / 54

Page 60: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation: Acceleration of Ogata’s method

Recall Ogata’s simulation method:

1. Set t = 0, i = 0

2. Repeat till t > T :

I(((((((((((hhhhhhhhhhhCompute L(t) and m(t).

I Simulate a Poisson process: ∆t ∼ exp(λ(t)), u ∼ Unif[0, 1].I If ∆t < L(t) and t + ∆t < T and u ≤ λ(t+∆t)

λ(t) :i = i + 1,ti = t + ∆t. (a new time stamp)

di ∼ [λ1(ti )λ(ti )

, ..., λD (ti )λ(ti )

]. (a new event type)I t = t + ∆t.

3. Output s = {(ti , di )}Ii=1.

For the Hawkes processes with exponential impact functions,the intensity always decays when nothing happens. Therefore,we have

I L(t) can be ∞, and m(t) = sups∈[t,t+L(t)] λ(t) = λ(t).

36 / 54

Page 61: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation: Hawkes process and branch process

Furthermore, Hawkes process can be viewed as a branchprocess [Møller et al.(2006), Farajtabar et al.(2014)], whoseintensity functions can be represented as the superposition ofPoisson processes’ intensity functions.

Exogenous Poisson process

Endogenous Poisson process

Generation 0

Generation 1

Generation 2

Generation 3

ϕ□◯ ϕ◯△ ϕ◯◯

ϕ△□ ϕ□◯ ϕ◯◯

ϕ□◯ϕ△□

Endogenous Poisson process

Endogenous Poisson process

Figure 10: Hawkes process and branch process.

37 / 54

Page 62: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation based on branch clustering method

For the Hawkes process with λd(t) = µd +∑

ti<t φdd ′(t − ti ):

1. Simulate S0 = {(t0i , d

0i )}I0i=1 via a D-dimensional

homogeneous Poisson process Poisson({µd}Dd=1) in [0,T ].

2. Set S = S0.

3. For the k-th generation, k = 1, ...,K :I Set Sk = ∅.I For (tk−1

i , dk−1i ) ∈ Sk−1:

I Simulate a sequence s via a D-dimensional inhomogeneousPoisson process Poisson({φ

ddk−1i

(t)}Dd=1) in [tk−1i ,T ].

I Sk = Sk ∪ s.

I S = S ∪ Sk .

4. Output S.

38 / 54

Page 63: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation based on branch clustering method

For the Hawkes process with λd(t) = µd +∑

ti<t φdd ′(t − ti ):

1. Simulate S0 = {(t0i , d

0i )}I0i=1 via a D-dimensional

homogeneous Poisson process Poisson({µd}Dd=1) in [0,T ].

2. Set S = S0.

3. For the k-th generation, k = 1, ...,K :I Set Sk = ∅.I For (tk−1

i , dk−1i ) ∈ Sk−1:

I Simulate a sequence s via a D-dimensional inhomogeneousPoisson process Poisson({φ

ddk−1i

(t)}Dd=1) in [tk−1i ,T ].

I Sk = Sk ∪ s.

I S = S ∪ Sk .

4. Output S.

38 / 54

Page 64: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Simulation: Comparisons

50 100 150 200Length of time window

-2

-1.5

-1

-0.5

0

0.5

1

log

Run

time

(sec

)

FastThinningThinningBranch clustering

Figure 11: Comparisons for different simulation methods on runtime.

39 / 54

Page 65: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Superposition property and its benefitsGiven Nk(t) ∼ HP(µk ,Φ), k = 1, ...,K , how to Φ = [φdv (t)]?

I Multi-source+MHP: Treat observed sequences as independentsamples and learn {HP(µk ,Φ)}Kk=1 accordingly.

Theorem (Superposition property [Xu et al.(2017)b])For K independent Hawkes processes, i .e., Nk(t) ∼ HP(µk ,Φ),k = 1, ...,K , their superposition is still a Hawkes process, whereN(t) =

∑Kk=1 N

k(t) and N(t) ∼ HP(∑K

k=1 µk ,Φ).

I Superposition+HP: Superpose observed sequences and learn asingle HP(µ,Φ).

}Superposition

HP(μ1, Φ)

HP(μ2, Φ)

HP(μ3, Φ)

HP(∑i

μi, Φ)

Figure 12: Learning superposed Hawkes processes.

40 / 54

Page 66: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Superposition property and its benefitsGiven Nk(t) ∼ HP(µk ,Φ), k = 1, ...,K , how to Φ = [φdv (t)]?

I Multi-source+MHP: Treat observed sequences as independentsamples and learn {HP(µk ,Φ)}Kk=1 accordingly.

Theorem (Superposition property [Xu et al.(2017)b])For K independent Hawkes processes, i .e., Nk(t) ∼ HP(µk ,Φ),k = 1, ...,K , their superposition is still a Hawkes process, whereN(t) =

∑Kk=1 N

k(t) and N(t) ∼ HP(∑K

k=1 µk ,Φ).

I Superposition+HP: Superpose observed sequences and learn asingle HP(µ,Φ).

}Superposition

HP(μ1, Φ)

HP(μ2, Φ)

HP(μ3, Φ)

HP(∑i

μi, Φ)

Figure 12: Learning superposed Hawkes processes.

40 / 54

Page 67: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Superposition property and its benefitsGiven Nk(t) ∼ HP(µk ,Φ), k = 1, ...,K , how to Φ = [φdv (t)]?

I Multi-source+MHP: Treat observed sequences as independentsamples and learn {HP(µk ,Φ)}Kk=1 accordingly.

Theorem (Superposition property [Xu et al.(2017)b])For K independent Hawkes processes, i .e., Nk(t) ∼ HP(µk ,Φ),k = 1, ...,K , their superposition is still a Hawkes process, whereN(t) =

∑Kk=1 N

k(t) and N(t) ∼ HP(∑K

k=1 µk ,Φ).

I Superposition+HP: Superpose observed sequences and learn asingle HP(µ,Φ).

}Superposition

HP(μ1, Φ)

HP(μ2, Φ)

HP(μ3, Φ)

HP(∑i

μi, Φ)

Figure 12: Learning superposed Hawkes processes.

40 / 54

Page 68: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Superposition property and its benefits

1. Multi-source+MHP: Treat observed sequences as independentsamples and learn {HP(µk ,Φ)}Kk=1 accordingly.

2. Superposition+HP: Superpose observed sequences and learn asingle HP(µ,Φ).

Theorem ([Xu et al.(2017)b])For K D-dimensional Hawkes processes with φdv (t) =

∑m amdvκm(t),

i .e., HP(µk ,A), k = 1, ...,K , suppose that

I Each observed sequence has I events;

I The parameters are bounded as ‖µk‖22 ≤ Bµ and ‖A‖2

F ≤ BA;

I The upper bound of ‖∑K

k=1 µk‖2

2 is denoted as BΣµ.

The bound on the excess risk of Superposition+HP is tighter if

BΣµ ≤KBµ + D(K + D)Bµ log(

1 +KI

D(K + D)

)− D(1 + D)Bµ log

(1 +

KI

D(1 + D)

).

(21)

41 / 54

Page 69: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Typical Cases

For Nk(t) ∼ HP(µk ,Φ), k = 1, ...,K

Lemma (Typical Infeasible Condition)

If µ1 = µ2 = ... = µK , the Multi-source+MHP strategy has atighter bound of excess risk.

Lemma (Typical Feasible Condition)

If 〈µk ,µk ′〉 = 0 for all k 6= k ′, the Superposition+HP strategyhas a tighter bound of excess risk.

42 / 54

Page 70: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Benefits from superposed Hawkes processes

1 2 30

0.2

0.4

0.6

0.8

1

1.2

1.4

Rel

ativ

e er

ror

Single source + HPMulti-source + HPMulti-source + MHPSuperposition + HP

1 2 30

0.5

1

1.5

Rel

ativ

e er

ror

Single source + HPMulti-source + HPMulti-source + MHPSuperposition + HP

1 2 30

0.2

0.4

0.6

0.8

Rel

ativ

e er

ror

Single source + HPMulti-source + HPMulti-source + MHPSuperposition + HP

K = 2 K = 2 K = 2K = 5 K = 5 K = 5K =10 K =10 K =10

(a) Least-Square

1 2 30

0.2

0.4

0.6

0.8

1

1.2

1.4

Rel

ativ

e er

ror

Single source + HPMulti-source + HPMulti-source + MHPSuperposition + HP

1 2 30

0.5

1

1.5

Rel

ativ

e er

ror

Single source + HPMulti-source + HPMulti-source + MHPSuperposition + HP

1 2 30

0.5

1

1.5

Rel

ativ

e er

ror

Single source + HPMulti-source + HPMulti-source + MHPSuperposition + HP

K = 2 K = 5 K =10

(b) MLE

Figure 13: Comparisons based on LS and MLE, respectively.

Using superposition-based learning strategy, we can enhance therobustness to the problem of data insufficiency.

43 / 54

Page 71: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Outline

I Part I: Basics and typical models for TPPs1. Real-world event sequences2. Temporal point processes and intensity functions3. Classic learning strategies4. Simulation and prediction5. Hawkes processes6. Open source packages

I Part II: Deep networks for temporal point processes

I Part III: Temporal point processes in practice

44 / 54

Page 72: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Open source packages

Some toolboxes have been developed for TPPs.

I Tick [Bacry et al.(2017)b]https://x-datainitiative.github.io/tick/index.html

I THAP [Xu and Zha(2017)b]https://github.com/HongtengXu/Hawkes-Process-Toolkit

I PoPPy [Xu (2018)]https://github.com/HongtengXu/PoPPy

45 / 54

Page 73: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Tick

A machine learning library for Python 3.

I The core functions are implemented by C language.

I Linear models, point processes, survival analysis.

I Integrate some classic Hawkes process models.

I Implement many optimization solvers

I Support multi-CPU computation

46 / 54

Page 74: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

THAPTHAP: A MATLAB Toolboxes for HAwkes Processes and itsvariants.

Data

Format Conversion

Preprocessing

Simulation

Thinning methods

Branch clustering

Analysis

Granger causality

Clustering structure

Help

Function reference

Handbook of the tool

Model

Parametric Hawkes

Nonparametric Hawkes

Variants of Hawkes

Basis representation

Ordinary differential equation

Time series-based method

Mixture of Hawkes

Time-varying Hawkes

Visualization

Data statistics

Intensity plot

Impact function plot

Granger causality

Clustering structure

Learning result plot

THAP: A toolkit of Hawkes processes

Model-based methods

Feature-based methods

Maximum likelihood

Cumulants estimation

Version informationPrediction result plot

Figure 14: The architecture of THAP.

47 / 54

Page 75: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

THAP: Functions and Applications

0 10 20 30 40 50Event-occurrence time (129 events total)

0

1

2

3

4

5

Inte

nsity

, 6(t)

0 10 20 30 40 50Event-occurrence time (85 events total)

0

1

2

3

4

Inte

nsity

, 6(t)

(a) Data, intensity

50 100 150 200Length of time window

-2

-1.5

-1

-0.5

0

0.5

1

log

Run

time

(sec

)

FastThinningThinningBranch clustering

(b) Runtime

0 5 10 15 20Time interval between events

0

0.05

0.1

0.15

0.2

?

RealMLELS

(c) Impact func.

10 20 30 40 50The number of training sequences

0.25

0.3

0.35

0.4

0.45

0.5

0.55

Rel

ativ

e es

timat

ion

erro

r

Learning based on different simulators

FastThinningThinningBranching

(d) Errors

(e) Log-likelihood

2 4 6 8 10 12

2

4

6

8

10

1210

20

30

40

50

60OthersDramaMovieNewsShowMusic

SportsMinistryRecord

KidsScienceFinance

Law

O D Mo N Sh Mu Sp Mi R K Sc F L

(f) Causality (g) Infectivity (h) Clustering

Figure 15: Visualization of typical functions achieved by THAP

48 / 54

Page 76: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

PoPPy

PoPPy: A Point Process PyTorch Toolbox

I It is an extension of THAP.

I Rich Functionality: data operations, learning, prediction,simulation, visualization, ...

I High Flexibility: modular design of model, multiple lossfunctions, regularizers, support numerical and categoricalfeatures, ...

I High Scalability: support GPU computations

49 / 54

Page 77: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

PoPPy: Flexible model design

Intensity function:

λd(t) = gλ

(µ(d , fd , fs) +

∑ti<t

φ(t, ti , d , di , fd , fdi )

)

= gλ

(µ(d , fd , fs) +

∑ti<t

M∑m=1

am(d , di , fd , fdi )κm(t − ti )

).

(22)

Exogenous Intensity and Endogenous Impact:

µ(d , fd , fs) =

gµ(µd),

gµ(w>d fs),

gµ(f >d Wfs),

NN(d , fd , fs).

am(d , di , fd , fdi ) =

ga(addim),

ga(u>d ,mvdi ,m),

ga(w>d ,mfdi ),ga(f >d Wmfdi ),NN(d , di , fd , fdi ).

50 / 54

Page 78: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

PoPPy: Flexible model design

(a) Exponential (b) Rayleigh kernel (c) Gaussian kernel

(d) Powerlaw kernel (e) Gate kernel (f) Multi-Gaussian

Figure 16: Examples of decay kernels and their integration values.

51 / 54

Page 79: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

PoPPy: Flexible data operations

+

+

=

=

….

Stitching (random or feature-based)

Superposing (random or feature-based)

Aggregating

Batch Sampling

Figure 17: Typical data operations.

52 / 54

Page 80: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

Summary

I Temporal point processes have been widely used to describethe dynamic mechanisms hidden in real-world event sequences.

I The key of TPPs is modeling their intensity functions.

I The learning and the simulation of TPPs are flexible andtheoretically-supportive.

I Hawkes processes are powerful to model the self- andmutually-triggering patterns among different event types,which have many useful properties for practical applications.

53 / 54

Page 81: Modeling and Applications for Temporal Point Processes ...thinklab.sjtu.edu.cn/paper/KDD2019_tpp_tutorial-PartI.pdf · statistic online. The algorithm can be implemented in a distributed

ReferencesEmmanuel Bacry, Martin Bompaire, Stephane Gaıffas, and Soren Poulsen.tick: a python library for statistical learning, with an emphasis on time-dependent modeling. arXiv:1707.03003, 2017.

Bacry, Emmanuel, and Jean-Francois Muzy.First-and second-order statistics characterization of Hawkes processes and non-parametric estimation. IEEE TIT, 2016.

Michael Eichler, Rainer Dahlhaus, and Johannes Dueck.Graphical modeling for multivariate hawkes processes with nonparametric link functions. Time Series Analysis, 2017.

Alan Hawkes.Point spectra of some mutually exciting point processes. Journal of the Royal Statistical Society. Series B, 1971.

Liniger, Thomas Josef.Multivariate Hawkes processes, 2009.

Ogata, Yosihiko.Statistical models for earthquake occurrences and residual analysis for point processes. In JASA, 1988.

Yosihiko Ogata.On lewis’ simulation method for point processes. IEEE Transactions on Information Theory, 1981.

Hongteng Xu and Hongyuan Zha.THAP: a Matlab toolkit for learning with Hawkes processes. arXiv:1708.09252, 2017.

Hongteng Xu.PoPPy: A Point Process Toolbox Based on PyTorch. arXiv:1810.10122, 2018.

Hongteng Xu, Dixin Luo, and Hongyuan Zha.Learning hawkes processes from short doubly-censored event sequences. ICML, 2017.

Hongteng Xu, Farajtabar, Mehrdad, and Hongyuan Zha.Learning Granger causality for Hawkes processes. ICML, 2016.

Farajtabar, Mehrdad, et al.Shaping social activity by incentivizing users. NIPS, 2014.

Farajtabar, Mehrdad, et al.Back to the past: Source identification in diffusion networks from partially observed cascades. AISTATS, 2015.

Ke Zhou, Hongyuan Zha, and Le Song.Learning Social Infectivity in Sparse Low-rank Networks Using Multi-dimensional Hawkes Processes. In AISTATS, 2013.

Zhao, Qingyuan, et al.Seismic: A self-exciting point process model for predicting tweet popularity. KDD, 2015.

Xu, Hongteng and Wu, Weichang and Nemati, Shamim and Zha, Hongyuan.Patient flow prediction via discriminative learning of mutually-correcting processes TKDE, 2016.

Hongteng Xu, Dixin Luo, Xu Chen, and Lawrence Carin.Benefits from superposed Hawkes processes AISTATS, 2018.

Wang, Yichen, et al.Isotonic hawkes processes. ICML, 2016.

Møller, Jesper and Rasmussen, Jakob GApproximate simulation of Hawkes processes. Methodology and Computing in Applied Probability, 2006.

Li, Shuang, et al.Learning temporal point processes via reinforcement learning. NIPS, 2018.

Zammit-Mangion, Andrew, et al.Point process modelling of the Afghan War Diary. PNAS, 2012.

54 / 54


Recommended