Event Sequences

Events Happen at Moments

A server crash does not happen "during minute 14." It happens at one exact moment.

The same is true for a user login, a purchase, or a card transaction. Each one has a precise timestamp.

A regular time series usually groups this activity into fixed bins, such as counts per minute or revenue per hour.

That grouping is handy for dashboards. But it quietly throws away the exact when.

What Binning Hides

Binning summarizes events. Summaries lose detail.

Three things disappear inside a bin: the exact gaps between events, bursts of activity packed into one bin, and periods of silence.

Notice how the tight burst and the long silence on the top axis become ordinary bar heights once grouped into equal bins.

Two bins with the same count can look identical on a chart while hiding very different timing underneath.

When you debug production, that hidden timing is often where the story is.

The Bin Size Trap

Binning also forces a decision you may not want to make: how wide should each bin be?

If bins are too wide, rapid patterns get averaged away. A burst of logins becomes one ordinary-looking number.

If bins are too narrow, most bins are empty and the series turns noisy.

There is no perfect width. Each choice trades one problem for another.

Points on a Continuous Axis

A temporal point process (TPP) skips the bins entirely.

It treats a sequence as points on a continuous time axis: $$t_1 < t_2 < \dots < t_n$$. Each point is the exact moment one event occurred.

The basic unit of data becomes a timestamped event, not a value sampled on a grid.

Coming from deep learning, think of the timestamps themselves as the input, with their uneven spacing kept intact.

Events Can Carry Marks

A timestamp says when. A mark says what.

Marks are extra information attached to each event. Common ones are the event type (crash, login, purchase), a user or device ID, and a transaction amount.

Marks are optional. A sequence of pure timestamps is still a valid TPP input.

With marks, one stream can mix many kinds of events while keeping each one's exact time.

Gaps Become the Signal

Once events are points, the inter-event times, the gaps between consecutive events, become central quantities to model.

This maps directly onto production questions.

Forecasting user activity or transactions asks: when will the next event occur, and what kind will it be?

Anomaly detection asks: given the history so far, is this event unusually timed? Or is a long absence of events itself unusual?

Thinking in Events

Every TPP model, from classical processes to neural ones, starts from this same idea: events are points in continuous time.

When you meet a new signal at work, ask whether it is really a stream of moments.

Crashes, logins, purchases, and transactions usually are. Keep their exact timestamps and marks before you reach for bins.

Then you can ask when the next one comes, and whether its timing is strange.

In a temporal point process, the basic unit of data is _____

• a timestamped, optionally marked event
• an event count per fixed time bin

Answer: a timestamped, optionally marked event

A temporal point process treats each event as a point on a continuous time axis, ordered as t1 < t2 < ... < tn. A count per minute is a binned aggregate, which is the conventional time-series view a TPP avoids.

In a card-transaction log modeled as a TPP, each event's _____ records exactly when it happened, its _____ stores extra data such as the amount, and the _____ is the gap since the previous transaction.

Answer: In a card-transaction log modeled as a TPP, each event's timestamp records exactly when it happened, its mark stores extra data such as the amount, and the inter-event time is the gap since the previous transaction.

The timestamp places an event on the continuous time axis. The mark carries extra information such as the event type, a device ID, or an amount. Inter-event times are the gaps between consecutive events, and they are central quantities a TPP models.

You count server logins per hour. Within one hour, 50 logins arrive in a 2-minute burst, and the hour before has none. What does this hourly view lose that a TPP keeps?

• The exact gaps between logins and the burst within the hour
• The total number of logins that occurred in each hour
• The ability to plot login activity on a dashboard
• The regular sampling interval needed for model training

Answer: The exact gaps between logins and the burst within the hour

Binning averages away detail inside each bin. Here it hides the exact gaps, the burst inside the hour, and the precise length of the silence. A TPP keeps every exact timestamp, so these patterns stay visible. Hourly counts can still show a total and a dashboard trend, and a TPP does not require fixed sampling.