The monitoring of event frequencies can be used to recognize behavioral anomalies, to identify trends, and to deduce or discard hypotheses about the underlying system. For example, the performance of a web server may be monitored based on the ratio of the total count of requests from the least and most active clients. Exact frequency monitoring, however, can be prohibitively expensive; in the above example it would require as many counters as there are clients. In this paper, we propose the efficient probabilistic monitoring of common frequency properties, including the mode (i.e., the most common event) and the median of an event sequence. We define a logic to express composite frequency properties as a combination of atomic frequency properties. Our main contribution is an algorithm that, under suitable probabilistic assumptions, can be used to monitor these important frequency properties with four counters, independent of the number of different events. Our algorithm samples longer and longer subwords of an infinite event sequence. We prove the almost-sure convergence of our algorithm by generalizing ergodic theory from increasing-length prefixes to increasing-length subwords of an infinite sequence. A similar algorithm could be used to learn a connected Markov chain of a given structure from observing its outputs, to arbitrary precision, for a given confidence.

中文翻译：

---

监控事件频率

事件频率的监控可用于识别行为异常、识别趋势以及推断或丢弃有关底层系统的假设。例如，可以基于来自最少和最活跃的客户端的请求总数的比率来监控 Web 服务器的性能。然而，精确的频率监测可能非常昂贵；在上面的例子中，它需要与客户端一样多的计数器。在本文中，我们提出了对常见频率属性的有效概率监测，包括模式（即最常见的事件）和事件序列的中值。我们定义了一个逻辑来将复合频率属性表示为原子频率属性的组合。我们的主要贡献是一种算法，在合适的概率假设下，可用于通过四个计数器监控这些重要的频率属性，与不同事件的数量无关。我们的算法对无限事件序列中越来越长的子字进行采样。我们通过将遍历理论从增加长度的前缀推广到无限序列的增加长度的子字来证明我们的算法几乎肯定收敛。对于给定的置信度，可以使用类似的算法从观察其输出到任意精度来学习给定结构的连接马尔可夫链。我们通过将遍历理论从增加长度的前缀推广到无限序列的增加长度的子字来证明我们的算法几乎肯定收敛。对于给定的置信度，可以使用类似的算法从观察其输出到任意精度来学习给定结构的连接马尔可夫链。我们通过将遍历理论从增加长度的前缀推广到无限序列的增加长度的子字来证明我们的算法几乎肯定收敛。对于给定的置信度，可以使用类似的算法从观察其输出到任意精度来学习给定结构的连接马尔可夫链。