WO2020062187A1

WO2020062187A1 - Method, apparatus, computer-readable storage media and computer program for data analysis

Info

Publication number: WO2020062187A1
Application number: PCT/CN2018/108870
Authority: WO
Inventors: Shi Xia Liu; Jie Lu; Daniel Schneegass; Daniela Oelke
Original assignee: Siemens Aktiengesellschaft
Priority date: 2018-09-29
Filing date: 2018-09-29
Publication date: 2020-04-02

Abstract

Method, apparatus, computer-readable storage media and a computer program for data analysis are provided. A method for data analysis com-prises displaying, at least one event pattern related to a same type of event, detecting that one of the at least one event pattern is selected; displaying distribution of the selected event pattern along time. With solutions provided in the method and apparatus, technicians can better understand the content of the messages and various relationships among them.

Description

[Title established by the ISA under Rule 37.2] METHOD, APPARATUS, COMPUTER-READABLE STORAGE MEDIA AND COMPUTER PROGRAM FOR DATA ANALYSIS

The present invention relates to techniques of data analysis, and more particularly to a method, apparatus, computer-readable storage media and a computer program for data analysis.

Data from factories or power plants typically contains sensor data, which is usually temporally changed and event-driven. For example, error messages, which contain time stamps, error sources, status, etc. when a message comes in a specific time period, we call that an event happens in that specific time period. By examining these messages/events thoroughly, technicians can understand the inner workings of the product line and handle happened error in time. As a result, better understanding of these sensor produced data is of theoretical and practical significance for error acquisition and trouble shooting.

However, these messages usually are not easy to understand. And the number of messages is too large for technicians to analyze and take conclusions.

Thus the object of the present disclosure is to provide a method, apparatus, computer-readable storage media and a computer program for data analysis. With solutions provided in this disclosure, technicians can better understand the content of the messages and various relationships among them.

The above objects are achieved by a method for data analysis according to claim 1, an apparatus for data analysis according to claim 8, a computer-readable storage media according to claim 15, a computer program according to claim 16 of the present technique.

Advantageous embodiments of the present technique are provided in dependent claims. Features of independent claims may be combined with features of claims dependent on the respective independent claim, and features of dependent claims can be combined together, unless otherwise indicated.

Usually, sensor produced data is hard to understand. The present disclosure provides a solution of data analysis, in which, relationship between events can be found and displayed intuitively, which helps technicians a lot find what happens to a system.

According to a first aspect of the present disclosure, a method for data analysis is presented, it comprises:

- displaying, at least one event pattern related to a same type of event, wherein the event pattern is a sequence of different types of events;

- detecting, that one of the at least one event pattern is selected;

- displaying, distribution of the selected event pattern along time.

According to a second aspect of the present disclosure, an apparatus for data analysis is presented, it comprises:

- a displayer, configured to displaying at least one event pattern related to a same type of event, wherein the event pattern is a sequence of different types of events;

- a detector, configured to detect that one of the at least one event pattern is selected;

- the displayer, further configured to display distribution of the selected event pattern along time.

According to a third aspect of the present disclosure, a computer-readable storage media is presented, which has stored thereon: instructions executable by one or more processors of a computer system, wherein execution of the instructions causes the computer system to perform the method according to the first aspect of the present disclosure.

According to a fourth aspect of the present disclosure, a computer program is presented, it is being executed by one or more processors of a computer system and performs the method according to the first aspect of the present disclosure.

A solution is provided for data analysis. With the solution, event pattern (s) related to a same type of event can be detected and the distribution of the event pattern (s) along time can also be displayed. With the information of an event pattern, regularity can be found, which makes it easier for a technician to know the inner working of a system. Display of event patterns makes the event showing more intuitive and efficient, and gives useful information.

In an embodiment of the present disclosure, event patterns can be displayed in an order by degree of interest, wherein the more frequent, long, diverse of an event pattern, the higher degree of interest, which makes it easier for a technician to focus on the more important event pattern (s) .

In an embodiment of the present disclosure, when displaying event pattern (s) , beside each displayed event pattern, an indicator indicating probability of the occurrence of the corresponding event pattern will also be displayed, which can give a clue to a technician about frequent occurring event pattern.

In an embodiment of the present disclosure, events are separated into segments if there is no event within a predefined length of time displaying, and distribution of the chosen event pattern along time can be displayed for each segment. Herein segmentation of events is under assumption that events with the same root-cause are thrown closely together in time at temporal distances not larger than a period of time (such as a minute) . Therefore, we cut the data into segments if there is no message within a minute. We repeat this process until there is no time span larger than one minute in any segment. Thus, we get several segments of messages which we can then mine for frequent patterns. The segmentation helps reduce unneccessary analysis on irrelative events and is basis of event pattern mining.

Optionally, when displaying for each segment distribution of the chosen event pattern along time, a density plot showing distance between two subsequent events for each segment can be displayed, which provides a more intuitive way to show event distribution along time.

In an embodiment of the present disclosure, different types of events can be displayed in different ways in a selected time span. Wherein, firstly names of a field of an event are displayed, then it can be detected that at least one field of an event is selected, next, grouping results by the selected at least one field of the events happened in the selected time span can be displayed, and after at least two groups of events are selected, the selected at least two groups of events along time in the selected time span are displayed, with different displaying ways for the selected at least two groups. A technician choose the way of grouping, select an interested time span and interested types of event, to view the events’distribution and relationship along time.

Optionally, when displaying the selected at least two groups of events along time in the selected time span, a density plot can also be displayed, showing distance between two subsequent events, which provides an intuitive way for event analysis.

The above mentioned attributes and other features and advantages of the present technique and the manner of attaining them will become more apparent and the present technique itself will be better understood by reference to the following description of embodiments of the present technique taken in conjunction with the accompanying drawings, wherein:

FIG 1 Depicts a flowchart displaying an exemplary embodiment of a first method for data analysis of the present disclosure

FIG 2 Depicts a user interface implementing the method shown in FIG 1

FIG 3 Depicts a user interface showing detailed information of an event implementing the method shown in FIG 1

FIG 4 Depicts a procedure of event pattern mining which can be used in the method shown in FIG 1

FIG 5 Depicts a flowchart displaying an exemplary embodiment of a second method for data analysis of the present disclosure

FIG 6 Depicts a user interface implementing the method shown in FIG 5

FIG 7 Depicts a flowchart displaying an exemplary embodiment of a third method for data analysis of the present disclosure

FIG 8 Depicts a user interface implementing the method shown in FIG 7

FIG 9 Depicts a user interface implementing the method shown in FIG 7 according to a use case provided in the present disclosure

FIG 10 Depicts a result after a user clicked a node in a message on the user interface shown in FIG 9

FIG 11 Depicts a user interface implementing the method shown in FIG 5 according to a use case provided in the present disclosure

FIG 12 Depicts detailed information of an event pattern shown on a user interface implementing the method shown in FIG 1 according a use case provided in the present disclosure

FIG 13 Depicts a block diagram displaying a first exemplary embodiment of an apparatus for data analysis of the present disclosure

Reference numerals:

21: a search bar

22: a list of event types

23: a list of frequent event patterns related to the selected event type

24: a events view

25: a data panel

S101: display a search bar 21

S102: detect that at least one keyword is input in the search bar 21

S103: display a list of event types 22 searched out by the at least one keyword

S104: detect that a specific event type is selected

S105: display a list of frequent event patterns related to the selected event type 23

S106: detect that one event pattern is selected

S107: highlight the selected event pattern

S108: display distribution of the selected event pattern along time in event view 24 and data panel 25

S401: sample predefined amount of segments related to a selected event type

S402: find candidates for frequent event patterns on the sampled segments

S403: calculate support of each candidate in the full data set

S404: filter event patterns with low support to get frequent event patterns

61: a events view

62: a list of fields of an event

63: groups of events view

64: groups of events’distribution

S501: display distribution of events along time

S502: detect that a time span is selected

S503: display names of fields of an event

S504: detect that at least one field of an event is selected

S505: display group results by the selected at least one field of the events happened in the selected time span

S506: detect that at least two groups of events are selected

S507: display the selected at least two groups of events along time in the selected time span, with different display ways for the selected at least two groups.

81: a search bar

82: a graph view

83: a events view

84: a data panel

S701: display a search bar 81

S702: detect that a field of an event and at least one keyword is input in the search bar 81

S703: display a result of a SentenTree 82 which meets the search criteria

S704: detect that a specific node of the SentenTree is selected S705: display distribution of events related to the selected node 83

S706: display details of events related to the selected node 84

1301: displayer

1302: detector

Hereinafter, above-mentioned and other features of the present technique are described in details. Various embodiments are described with reference to the drawing, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purpose of explanation, numerous specific details are set forth in order to provide a thorough understanding of one or more embodiments. It may be noted that the illustrated embodiments are intended to explain, and not to limit the invention. It may be evident that such embodiments may be practiced without these specific details.

The present technique has been described hereinafter in details by referring to FIG 1 to 12.

Referring to FIG 1 to 3, a first method of data analysis will be described. With the method, event patterns and their distributions along time are displayed. Technicians can find relationships of different types of events in an event pattern and do further investigation based on it.

Referring to FIG 4 and 5, a second method of data analysis will be described. With the method, relationship between events can be found, which give clues for trouble shooting and other maintenance activities.

Referring to FIG 6 and 7, a third method of data analysis will be described. With the method, a message structure related to an interested key word is displayed. Frequent words are displayed in a sequential order. Technicians can not only know the frequent words, but also relationship between words in a message.

Referring to FIG 8 to 11, a use case will be introduced, which take the solutions mentioned above.

FIG 1 shows a method for data analysis. With the method, event patterns and their distributions along time are displayed. FIG 2 shows a Message Frequent Pattern Explorer implemented by the method. The method can comprise following steps:

- S101: display a search bar 21 (shown in FIG 2)

With the search bar 21, users can search for a event type they are interested in. A keyword for an event type can be input into the search bar 21, then a list of event types 22 related to the input keyword will be displayed.

- S102: detect that at least one keyword is input in the search bar 21.

- S103: display a list of event types 22 searched out by the at least one keyword.

Optionally, referring to the FIG 2, the message number (Msg_nr) corresponding to the event type (such as 10010951, 10001543, etc. ) and main contents of a message are listed. A circle with three lines which presents a unique event type can also be listed to indicate an event type.

Then, a user can select a specific event type, related frequent patterns including the selected event type 23 will be generated and listed.

- S104: detect that a specific event type is selected.

Referring to FIG 2, the event type with msg_nr “10001543” is selected.

- S105: display a list of frequent event patterns related to the selected event type 23.

Referring to FIG 2, each line in the list of event pattern 23 is an event type. The procedure to get frequent event patterns will be explained later referring FIG 4.

Optionally, the list of at least one event pattern 23 is displayed in an order by degree of interest, wherein the more frequent, long, diverse of an event pattern, the higher degree of interest. the degree of interest can be defined according to importance of a sequence.

First we can use an a priori interest function to define the general importance of a sequence s. We assume that a frequent, long and diverse sequence is much more important than others. Therefore the interest function can be expressed as:

DOI _naive (s) =α·support (s) +β·length (s) +γ·diversity (s)

Intuitively, support (s) is the support of a sequence s (which will be introduced later) , length (s) is the length of the sequence. diversity (s) is the number of the different element in sequence s, can be expressed as:

diversity (s) =| {e|e∈s} |

α, β, γ are the control parameters for each terms.

However, support (s) ∈ [0, 1] and length (s) , diversity (s) ≥1. The dimensions for each term in the

definition of DOI are different from each other. It’s hard to define the value of the control parameters. Therefore, we optimized the interest function which each terms are normalized:

DOI (s) =α·support (s) +β·length _n (s) +γ·diversity _n (s)

As for the support has been normalized, length _n (s) and diversity _n (s) is defined as:

As defined, each term are normalized. We can set α, β, γ to 1 as initial.

Optionally, beside each displayed event pattern, a support, as an indicator indicating probability of the occurrence of the corresponding event pattern can also be displayed.

Referring to FIG 2, the number on the right of an event pattern is the support, a measure like the confidence coefficient for an event pattern. For example, the pattern

consists of three different event types, namely

and

and the support of it is 91.61%. For each event type, we first hash-map an entity’s ID to a 32-bit number, and then compute the degrees of the three lines from different portions of the hashed number. As the scalability of the color hues is very limited and such visual encoding are more scalable, we leverage it to distinguish different event types.

- S106: detect that one event pattern is selected.

- S107: highlight the selected event pattern.

In this step, When a user selects a specific event pattern, the event pattern will be highlighted (referring to FIG 2, the first line of event pattern is highlighted) and optionally different colors will be arranged to each different event types.

Referring to FIG 2, different color hues can also be arranged to different event types. This will help users to recognize the same or different events more intuitively. Here event type included in the selected event pattern are marked as bold, and other event types not included in the selected event pattern are displayed in regular style.

- S108: display distribution of the selected event pattern along time in events view 24 and data panel 25

In events view 24, distribution of the selected event pattern along time is shown. Each node in the time line represents a temporal interval spanning from the start of the snippet that the selected event pattern was found in to its end.

Considering that events are time series of data. So here optionally, events are cut into several segments. It is assumed that events with a same root-cause usually come closely together in time at temporal distances not larger than a predefined length of time. Taking one minute as an example, this process is going on repeatedly until there is no time span larger than one minute in any segment. Thus, we get several segments of events which we can then mine for frequent event patterns.

In data panel 25, segments in which the selected event pattern is found are listed. Each line corresponds to a segment. For each segment, distribution of the chosen event pattern along time can also be displayed. Wherein, events are separated into segments.

Optionally, for each segment, a density plot can also be displayed for showing distance between two adj acent events.

In S106, once detecting a event pattern is selected, the steps S108 and S109 will be processed immediately. That means the events view 24 and data panel 25 will be updated synchronously. 100 detailed segments are loaded (referring to FIG 4 and related description) , listed on the Data Panel 25. Each time a user clicks “Load More” button, 25 more segments will be loaded and the list on the data panel 25 will be updated. Optionally, a cache function can be implemented, which caches segments to be loaded to ensure the stability of processing and prevent sudden changes.

Optionally, the circles corresponding to different event types included in the selected event pattern are in different colors, which are marked as bold in FIG 2; and circles corresponding to event types not included in the selected are in black, which are marked in regular style in FIG 2. To be noted that for the same event type in the selected event pattern in the list of frequent event patterns 23, they should be in the same color in the data panel 25.

- S109: display detailed information of an event type when a hovering over the event type is detected.

In this step, interactions are implemented. When a user hovers a specific event type, detailed information of the event type will be displayed referring to FIG 3. This step is also applicable for following second method and third method, to have details of an event be displayed.

A method of data analysis which can display information on event pattern is introduced. In the following description, a procedure of event pattern mining which can be used in this method will be introduced referring to FIG 4. The procedure can include following steps:

- S401: sample predefined amount of segments related to a selected event type.

To speed up the process, currently only 100 segments including the selected event will be used to mine candidates for frequent event patterns.

-S402: find candidates for frequent event patterns on the sampled segments.

In this step, candidates are searched in the full data set.

- S403: calculate support of each candidate in the full data set.

In this step, GSP (Generalized Sequential Pattern) algorithm can be used to calculate support. GPS is an algorithm used for sequence pattern mining. The main idea of the algorithm is that if one sequence is frequent, all the subsequences are frequent.

Therefore, the frequent k-sequences are used to generate the candidate (k+1) -sequences. This process will be repeated until no more frequent sequences are discovered (see following Algorithm) . The pseudocode for the algorithm is given below for a datasetT, and a support threshold of ∈. L _k is the frequent k-sequence set, and C _k is the candidate frequent k-sequence set.

In the original algorithm, the support is defined as:

s= (e ₁, e ₂, e ₃, ... e _n) is a candidate sequence, and e _i is the ith element. σ (s) is the number of occurrences of the sequence s. N is the number of the data in T. This method could find the sequences that appear many times. However, in the message data, some event types appear only a few times. The rare sequences also contain patterns, but they are dominated by others. Therefore, we leverage another definition of the support:

σ (e _i) is the number of event sequences which contain the element e _i in the whole dataset. In the method, the rare sequences can be discovered and will not be dominated by the other high-frequency ones.

- S404: filter event patterns with low support to get frequent event patterns.

Candidates that turn out to be infrequent /have low support (i.e. were only frequent among the random samples but not when examining the full data set) are filtered out.

Optionally, candidates with support lower than 50%will be considered as low support.

The first method of data analysis and its event pattern mining procedure are introduced above. Now referring to FIG 5 and 6, a second method of data analysis will be introduced. With this method, relationship between events can be displayed intuitively.

Referring to FIG 5 and FIG 6, the second method for data analysis includes following steps:

- S501: display distribution of events along time.

Distribution of events along time is displayed on a events view 61 on top of the view in FIG 6. A time selector can be used for selection of a time span.

- S502: detect that a time span is selected

A user can select a time span he is interested in and explore detailed information.

- S503: display names of fields of an event

- S504: detect that at least one field of an event is selected

In the middle left of FIG 6, a list of fields of an event is displayed for a user to select. A user can select at least one field they are interested in and events will be grouped by the selected field (s) . Optionally, if no field of an event is selected, all the events will be grouped together.

- S505: display group results by the selected at least one field of the events happened in the selected time span.

In the middle right of FIG 6, grouped results are displayed in a groups of events view 63. Each trans lucent circle encodes an event, it is called “a node” . The time span is associated with the time span that the user selects. If the time span is very long, nodes will be aggregated together, so each node will become a large one. If the time span is short, the node will become small to encode the density of the events, which helps the user to view the interval clearly as the space is sufficient.

- S506: detect that at least two groups of events are selected.

If a user is interested in some specific events, he can select them by tickling the check boxes in the front of each line of event in the groups of events view 63. Once being tickled, the translucent circles in the selected line will be colored, and different colors for different event type (in FIG 6 and FIG 11, they are marked as filled with different pattern) . Optionally, only one group of events can be selected, to view the distribution of this group of events along time.

- S507: display the selected at least two groups of events along time in the selected time span, with different display ways for the selected at least two groups.

Also detailed information of the selected event types will be displayed on the groups of events’distribution 64 on the bottom of FIG 6. Time density plots are used to show the temporal distance between two subsequent events. The higher the curve is between two events, the closer in time they are.

The first and second methods for data analysis introduced above provides a intuitively way for technicians to know the relationships between events, even if some of the relationships are very complicated. In the following description, a third method for data analysis will be introduced, which can help technicians to read content of complicated events, providing sufficient transparency to the technicians to take useful conclusions.

Referring to FIG 7 and 8, the third method for data analysis includes following steps:

- S701: display a search bar 81.

- S702: detect that a field of an event and at least one keyword is input in the search bar 81.

- S703: display a result of a SentenTree 82 which meets the search criteria.

SentenTree can be used to show a frequent pattern of events’text content. SentenTree is a visual technique, it seeks balance between the most frequent words and preserving the main structure of the message, which allows a user to have a high-level overview of contents of events. The result of the SentenTree is displayed in a graph view 82 in the center of FIG 8.

- S704: detect that a specific node of the SentenTree is selected.

When a user select a node of the SentenTree (as shown in FIG 8, “trip” is selected) , distribution of events whose contents include “trip” along time will be displayed on a events view 83 (S705) and details of these events will also be displayed on a data panel 84 (S706) .

- S705: display distribution of events related to the selected node 83.

- S706: display details of events related to the selected node 84.

Three methods are introduced in the above description, with which following requirements can be met:

1) A technical can explore contents of an event from input keywords, which he is familiar with (the third method) .

2) Distribution of events can be displayed (the first, second and third methods) .

3) Details of an event can be displayed once the event is selected (the first, second and third method) .

4) Generating frequent event patterns and displaying them (the first method) .

5) Showing details of events in a specific frequent pattern (the first method) .

Following are 3 use cases in which the above methods can be applied to.

Use case 1 Understanding the messages about Control/GGIO8

Use case 1 is an application of the above third method.

FIG 9 shows the result after a user selects the text03 as the field and selects the node “ggio8” . It can be seen that the events related to the “control/ggio8” include some error information ( “trip” , “fail” , “alarm” ) and some status information ( “in” , “phase” , “load shedding” ) .

Referring to FIG 10, after the user selects the node “shedding” , it can be seen that “load shedding” for the “control/ggio8” has many stages. Some of the messages occur when some stages are selected.

Use case 2 Understanding the messages relationship

Use case 2 is an application of the above second method.

FIG 6 shows the result generated. First, it can be found that distribution of the whole data is aperiodic (from a events view 61) , sometimes there are a large number of events which happened together, and sometimes there are only a few events occurring during a long period of time.

Then “state” , “msg_nr” and “text03” are selected as the target fields to group the events (here, the field “text03” is selected, but is not displayed on current user interface. If the scroll bar on the right is scrolled down, the field can be seen as tickled) . It can be seen from groups of events’distribution 64, that distribution of the first type of events and the second type of events are very similar, and so as the fourth and fifth ones.

Then the fourth type of events and the fifth type of events can be examined first. After these two event types are selected, it can be seen that there is always a fifth type of event right after a fourth type of event (referring to groups of events’distribution 64 on bottom of FIG 6) . It can be seen that there is a strong correlation between these two event types.

Referring to FIG 11, when the first event type and the second event type are selected, it can be seen from the groups of events’distribution 64, that although distribution between these two event types are very similar, the sequential order between them is irregular.

Use case 3 Understanding the frequent pattern

Use case 3 is an application of the above first method.

Referring to FIG 2, after a user selects the event type “10001543” from the list of event types 22, the frequent patterns related to the event type “10001543” are listed in a list of frequent event patterns related to the selected event type 23. It can be seen that, the support of the event pattern on the first line is 92.28%, and the support of the event pattern on the second line is 49.94%.

In addition, after exploring the detailed information for each event type (referring to FIG 12) , it can be found that the four event types are all about the transformer. However, the event type “10001282” only occurs with the event type “10001549” , “10001543” and “10001547” in a half time. The users find the relationship of these four event types to support further investigation.

FIG 13 depicts a block diagram displaying a first exemplary embodiment of an apparatus for data analysis of the present disclosure, which comprises:

- a displayer 1201, configured to displaying at least one event pattern related to a same type of event, wherein the event pattern is a sequence of different types of events;

- a detector 1202, configured to detect that one of the at least one event pattern is selected;

- the displayer 1201, further configured to display distribution of the selected event pattern along time.

Optionally, the displayer 1201 is further configured to display the at least one event pattern in an order by degree of interest, wherein the more frequent, long, diverse of an event pattern, the higher degree of interest.

Optionally, the displayer 1201 is further configured to display beside each displayed event pattern, an indicator indicating probability of the occurrence of the corresponding event pattern.

Optionally, the displayer 1201 is further configured to display, for each segment, distribution of the chosen event pattern along time, wherein events are separated into segments if there is no event within a predefined length of time.

Optionally, the displayer 1201 is further configured to display for each segment, a density plot showing distance between two subsequent events.

Optionally, the displayer 1201 is further configured to display names of a field of an event; the detector 1202 is further configured to detect that at least one field of an event is selected; the displayer 1201 is further configured to display grouping results by the selected at least one field, of events; the detector 1202 is further configured to detect that at least two groups of events are selected; the displayer 1201 is further configured to display the selected at least two groups of events along time in the selected time span, with different displaying ways for the selected at least two groups.

Optionally, the displayer 1201 is further configured to display a density plot showing distance between two subsequent events.

A computer-readable storage media is also provided in the present disclosure, having stored thereon:

- instructions executable by one or more processors of a computer system, wherein execution of the instructions causes the computer system to perform the method presented in this disclosure.

A computer program is also provided in the present diclosure, which is being executed by one or more processors of a computer system and performs the method presented in this disclosure.

While the present technique has been described in detail with reference to certain embodiments, it should be appreciated that the present technique is not limited to those precise embodiments. Rather, in view of the present disclosure which describes exemplary modes for practicing the invention, many modifications and variations would present themselves, to those skilled in the art without departing from the scope and spirit of this invention. The scope of the invention is, therefore, indicated by the following claims rather than by the foregoing description. All changes, modifications, and variations coming within the meaning and range of equivalency of the claims are to be considered within their scope.

Claims

A method for data analysis, comprising:

- displaying, at least one event pattern related to a same type of event, wherein the event pattern is a sequence of different types of events;

- detecting, that one of the at least one event pattern is selected;

- displaying, distribution of the selected event pattern along time.
the method according to the claim 1, wherein the step of displaying, at least one event pattern including a same type of event, comprises:

- displaying the at least one event pattern in an order by degree of interest, wherein the more frequent, long, diverse of an event pattern, the higher degree of interest.
the method according to the claim 1 or 2, wherein the step of displaying, at least one event pattern including a same type of event, comprises:

- displaying, beside each displayed event pattern, an indicator indicating probability of the occurrence of the corresponding event pattern.
the method according to any of claims 1 to 3, wherein the step of displaying, distribution of the chosen event pattern along time, comprises:

- displaying, for each segment, distribution of the chosen event pattern along time, wherein events are separated into segments if there is no event within a predefined length of time.
the method according to the claim 4, wherein the step of displaying, for each segment, distribution of the chosen event pattern along time, comprises:

- displaying, for each segment, a density plot showing distance between two subsequent events.
the method according to any of claims 1 to 5, further comprises:

- displaying, names of a field of an event;

- detecting, that at least one field of an event is selected;

- displaying, grouping results by the selected at least one field of the events happened in the selected time span;

- detecting, that at least two groups of events are selected;

- displaying, the selected at least two groups of events along time in the selected time span, with different displaying ways for the selected at least two groups.
the method according to the claim 6, wherein the step of displaying, the selected at least two groups of events along time in the selected time span, comprises:

- displaying a density plot showing distance between two subsequent events.
An apparatus (120) for data analysis, comprising:

- a displayer (1201) , configured to displaying at least one event pattern related to a same type of event, wherein the event pattern is a sequence of different types of events;

- a detector (1202) , configured to detect that one of the at least one event pattern is selected;

- the displayer (1201) , further configured to display distribution of the selected event pattern along time.
the apparatus according to the claim 8, wherein the displayer (1201) is further configured to display the at least one event pattern in an order by degree of interest, wherein the more frequent, long, diverse of an event pattern, the higher degree of interest.
the apparatus according to the claim 8 or 9, wherein the displayer (1201) is further configured to display bes ide each displayed event pattern, an indicator indicating probability of the occurrence of the corresponding event pattern.
the apparatus according to any of claims 8 to 10, wherein the displayer (1201) is further configured to display, for each segment, distribution of the chosen event pattern along time, wherein events are separated into segments if there is no event within a predefined length of time.
the apparatus according to the claim 11, wherein the displayer (1201) is further configured to display for each segment, a density plot showing distance between two subsequent events.
the apparatus according to any of claims 8 to 11, wherein,

- the displayer (1201) is further configured to display names of a field of an event;

- the detector (1202) is further configured to detect that at least one field of an event is selected;

- the displayer (1201) is further configured to display grouping results by the selected at least one field of events;

- the detector (1202) is further configured to detect that at least two groups of events are selected;

- the displayer (1201) is further configured to display the selected at least two groups of events along time in the selected time span, with different displaying ways for the selected at least two groups.
the apparatus according to the claim 13, wherein the displayer (1201) is further configured to display a density plot showing distance between two subsequent events.
A computer-readable storage media having stored thereon:

- instructions executable by one or more processors of a computer system, wherein execution of the instructions causes the computer system to perform the method according to any one of the claims 1 to 7.
A computer program, which is being executed by one or more processors of a computer system and performs the method according to one of the claims 1 to 7.