Tensor decomposition has recently been gaining attention in the machine learning community for the analysis of individual traces, such as Electronic Health Records. However, this task becomes significantly more difficult when the data follows complex temporal patterns. This paper introduces the notion of a temporal phenotype as an arrangement of features over time and it proposes SWoTTeD ( S liding W ind o w for T emporal Te nsor D ecomposition), a novel method to discover hidden temporal patterns. SWoTTeD integrates several constraints and regularizations to enhance the interpretability of the extracted phenotypes. We validate our proposal using both synthetic and real-world datasets, and we present an original usecase using data from the Greater Paris University Hospital. The results show that SWoTTeD achieves at least as accurate reconstruction as recent state-of-the-art tensor decomposition models, and extracts temporal phenotypes that are meaningful for clinicians.

International audience

In the field of pattern mining, a negative sequential pattern is specified by means of a sequence consisting of events to occur and of other events, called negative events, to be absent. For instance, containment of the pattern a ¬b c arises with an occurrence of a and a subsequent occurrence of c but no occurrence of b in between. This article is to shed light on the ambiguity of such a seemingly intuitive notation and we identify eight possible semantics for the containment relation between a pattern and a sequence. These semantics are illustrated and formally studied, in particular we propose dominance and equivalence relations between them. Also we prove that support is anti-monotonic for some of these semantics. Some of the results are discussed with the aim of developing algorithms to extract efficiently frequent negative patterns.

Rule learning is a data analysis task consisting of extracting rules to generalize examples. For a data scientist, some generalizations called here admissible generalizations, make more sense. We explore formal properties of admissible generalizations. A formalization for generalization of examples is proposed that allows to express rule admissibility. Some admissible generalizations are captured by topological operators. We examine selecting supersets of examples that induce these operators and we define classes of such choice functions. This formalization is particularly developed in the case of numerical attributes. Classes of such functions are associated with notions of generalization and they are used to comment some behaviours of the CN2 algorithm.

This paper presents a new model to detect and explain customer defection in a grocery retail context. This new model analyzes the evolution of each customer basket content. It therefore provides actionable knowledge for the retailer at an individual scale. In addition, this model is able to identify customers that are likely to defect in the future months.

Satellite images allow the acquisition of large-scale ground vegetation. Images are available along several years with a high acquisition rate. Such data are called satellite image time series (SITS). We present a method to analyse an SITS through the characterisation of the evolution of a vegetation index (NDVI) at two scales: annual and multi-annual. We evaluate our method on SITS of the Senegal from 2001 to 2008 and we compare our method to a clustering of long time series. The results show that our method better discriminates regions in the median zone of Senegal and locates fine interesting areas.

Detection of web attacks is an important issue in current defense-in-depth security framework. In this paper, we propose a novel general framework for adaptive and online detection of web attacks. The general framework can be based on any online clustering methods. A detection model based on the framework is able to learn online and deal with "concept drift" in web audit data streams. Str-DBSCAN that we extended DBSCAN to streaming data as well as StrAP are both used to validate the framework. The detection model based on the framework automatically labels the web audit data and adapts to normal behavior changes while identifies attacks through dynamical clustering of the streaming data. A very large size of real HTTP Log data collected in our institute is used to validate the framework and the model. The preliminary testing results demonstrated its effectiveness.