What data structures and algorithms are suitable for event stream correlation? Specifically, I am looking at these two use cases:X occurrences within t seconds grouped by some variables (v1,v2). For example, 5 failed login attempts within a minute grouped by service such as SSH or FTP and IP address.Event A is followed by events B and C grouped by some variables (v1,v2) within a time-frame t.In terms of actual implementation, I have found the Simple event Correlatorto be approximately what I am looking for, but it's a big blob of perl...
Data structures and algorithms for event correlation
algorithms;security;data structures