Skip to main content
Log in

An expressive event-based language for representing user behavior patterns

  • Published:
Journal of Intelligent Information Systems Aims and scope Submit manuscript


In-depth analysis of user interactions with applications in large systems is widely adopted as a means to understand user’s behavior for strategic purposes such as fraud detection, system security, weblog analysis, social networking, and customer relationship management. Overall, the user behavior presents characteristics, relationships, structures, and effects of a sequence of actions in a specific application domain. The interaction of users with applications at the business-level generates events that make the elements of the user behavior. Formal modelling and representation of complex patterns of user actions using expressive languages are critical aspects of behavior analysis. We present a model to describe the behavior elements and their relationships. The model also provides a systematic mechanism for describing and presenting events, sequence of events, and complex behavior patterns. A behavior pattern can be defined as a sequence of typed events that occur during specific time intervals. An event consists of a tuple of attributes whose values represent an observation of the behavior. In this paper, first we define a semantic model of the user behavior to address the issues around the user behavior representation, and then we present syntax and semantics of a generic Behavior Pattern Language (BPL), which enables the analysts to define a variety of complex behavior patterns in a declarative manner. We present the feasibility of the approach through several examples of complex behavior patterns expressed using the proposed language.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5

Similar content being viewed by others


  1. Behavior is an ordered-set of events since every event in the behavior is unique due to its time occurrence.


  • Alvarez, M. (2015). Battling security threats from within your organization. In: Research Report, IBM Security.

  • Angeletou, S., Rowe, M., & Alani, H. (2011). Modelling and analysis of user behaviour in online communities, (pp. 35–50). Berlin Heidelberg: Springer.

    Google Scholar 

  • Anicic, D., Fodor, P., Rudolph, S., Stuhmer, R., Stojanovic, N., & Studer, R. (2010). A rule-based language for complex event processing and reasoning. In Web reasoning and rule systems: Fourth International Conference (pp. 42–57). Berlin Heidelberg: Springer.

  • Arasu, A., Babu, S., & Widom, J. (2006). The cql continuous query language: semantic foundations and query execution. The International Journal on Very Large Data Bases, 15(2), 121–142.

    Article  Google Scholar 

  • Aztiria, A., Augusto, J.C., Basagoiti, R., Izaguirre, A., & Cook, D.J. (2013). Learning frequent behaviors of the users in intelligent environments. IEEE Transactions on Systems. Man and Cybernetics, 43(6), 1265–1278.

    Google Scholar 

  • Barga, R.S., Goldstein, J., Ali, M., & Hong, M. (2007). Consistent streaming through time: A vision for event stream processing. In: 3rd Biennial Conference on Innovative Data Systems Research (CIDR), California.

  • Brenna, L., Demers, A., Gehrke, J., Hong, M., Ossher, J., Panda, B., Riedewald, M., Thatte, M., & White, W. (2007). Cayuga: a high-performance event processing engine. In ACM SIGMOD international conference on Management of data (pp. 1100–1102): ACM.

  • Bry, F., & Eckert, M. (2006). A high-level query language for events. In: IEEE Services Computing Workshops(SCW’06), IEEE.

  • Bui, H.-L. (2009). Survey and comparison of event query languages using practical examples: Ludwig Maximilian University of Munich.

  • Cao, L. (2010). In-depth behavior understanding and use: the behavior informatics approach. Journal of Information Sciences, 180(17), 3067–3085.

    Article  Google Scholar 

  • Cao, L. (2014). Behavior informatics: a new perspective. IEEE Intelligent Systems pp. 62–80.

  • Cugola, G., & Margara, A. (2012). Processing flows of information: From data stream to complex event processing. ACM Computing Surveys (CSUR), 44(3), 1–62.

    Article  Google Scholar 

  • Anicic, D., Rudolph, S., Fodor, P., & Stojanovic, N. (2011). Ep-sparql: A unified language for event processing and stream reasoning. In: in Conference on World Wide Web, Hyderabad.

  • Fernández, M. (2014). Programming Languages and Operational Semantics, A Concise Overview: Springer-Verlag London.

  • Fox, A., & Patterson, D. (2013). Engineering software as a service: an agile approach using cloud computing. Strawberry Canyon: LLC.

    Google Scholar 

  • Grieskamp, W., & Kicillof, N. (2006). A schema language for coordinating construction and composition of partial behavior descriptions. In: SCESM’06, Shanghai.

  • Kirou, A., Ruszczycki, B., Walser, M., & Johnson, N. (2008). Computational modeling of collective human behavior: The example of financial markets, (pp. 33–41). Berlin Heidelberg: Springer.

    Google Scholar 

  • Li, G., & Jacobsen, A. (2005). Composite subscriptions incontent-based publish/subscribe systems. In Middleware 2005: The series Lecture Notes in Computer Science (pp. 249–269). New York: Springer.

  • Luckham, D. (2012). Event processing for business: Organizing the Real-Time enterprise. New Jersey: Wiley.

    Book  Google Scholar 

  • Pietzuch, P.R., Shand, B., & Bacon, J. (2004). Composite event detection as a generic middleware extension. IEEE Network Journal, 18(1), 44–55.

    Article  Google Scholar 

  • Plotkin, G. (1981). A structural approach to operational semantics Technical Report. Denmark: Aarhus University.

    Google Scholar 

  • Priya, R.V., & Vadivel, A. (2012). User behaviour pattern mining from weblog. International Journal of Data Warehousing and Mining, 8(2), 1–22.

    Article  Google Scholar 

  • Python (2015). The python programming language website

  • Rieke, R., Zhdanova, M., Repp, J., Giot, R., & Gaber, C. (2013). Fraud detection in mobile payments utilizing process behavior analysis. In IEEE International Conference on Availability, Reliability and Security (pp. 946–953): IEEE.

  • Rozsnyai, S., Schiefer, J., & Roth, H. (2009). Sari-sql: Event query language for event analysis. In: IEEE Conference on Commerce and Enterprise Computing, IEEE.

  • Sandell, N.F., Savell, R., Twardowski, D., & Cybenko, G. (2009). Hbml: A language for quantitative behavioral modeling in the human terrain. In Social Computing and Behavioral Modeling (pp. 180–189): Springer.

  • Stolfo, S., Bellovin, S., Hershkop, S., Keromytis, A., Sinclair, S., & Smith, S. (2008). Insider attack and cybersecurity: Beyond the hacker. New York: Springer.

    Book  Google Scholar 

  • Thomas, D., Fowler, C., & Hunt, A. (2013). Programming Ruby 1.9 and 2.0, The Pragmatic Programmers: LLC.

  • Wang, C., & Cao, L. (2012). Modeling and analysis of social activity process. Behavior computing: modeling, analysis, mining and decision, (pp. 21–35). New York: Springer.

    Google Scholar 

  • Wooldridge, M. (2000). Reasoning about rational agents. Cambridge: MIT Press.

    MATH  Google Scholar 

  • Yarmand, M., Sartipi, K., & Down, D. (2013). Behavior-based access control for distributed healthcare systems. Journal of Computer Security pp 1–39.

  • Zarri, G.P. (2012). Behaviour representation and management making use of the narrative knowledge representation language, Behavior Computing (pp. 37–56). London: Springer.

    Chapter  Google Scholar 

  • Zerkouk, M., Mhamed, A., & Messabih, B. (2013). User behavior and capability based access control model and architecture. In: Springer Science and Business Media, Springer Science and Business Media, pp. 291–299.

Download references

Author information

Authors and Affiliations


Corresponding author

Correspondence to Hassan Sharghi.

Appendix A: The syntax of BPL

Appendix A: The syntax of BPL

figure i

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Sharghi, H., Sartipi, K. An expressive event-based language for representing user behavior patterns. J Intell Inf Syst 49, 435–459 (2017).

Download citation

  • Received:

  • Revised:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: