3.1.3. CEP Implementation

We have used CEP concepts to implement the algorithm. CEP enables to react in real time to data stream through a continuous query language [19]. This method processes data as a sequence of events, in which each event models an observation in a specific domain. Atomic events, or only events, are immutable records of something in the real world or a software system. For example, in this study, an event represents a social activity at a specific time. These social events are generated by ubiquitous devices through the processing of context data. In the implementation of the algorithm, we use *Esper* (http: //www.espertech.com/esper/), which is an engine developed for CEP and continuous stream analysis. This mechanism provides an Event Processing Language (EPL) that implements and extends the Structured Query Language (SQL) standard. The processing workflow (Figure 2) consists of the following steps:


**Figure 2.** Processing workflow.

### *3.2. Social Behavior Change Detection*

Another contribution of this study is an approach to recognize social routine changes and abnormal social behaviors. This approach aims to continuously detect information about changes in social habits of the monitored individual, since this information is of vital importance for treatment and monitoring, so enabling to increase the chances of effective interventions performed by mental health professionals.

### 3.2.1. Behavioral Change Detection Strategy

We developed a strategy for detecting social behavior changes by applying the concept of drift identification techniques [45], which allows recognizing socialization flow changes of the monitored individual. Specifically, we explore unsupervised techniques to detect changes in the data stream distribution, since there is no ground truth available in social event streams to monitor performance indicators (e.g., accuracy, sensitivity, specificity, recall). Therefore, we combine the processing of data windows with a similarity metric to verify pattern change of an instant from *t1* to *t2*. It is important to note that the proposed approach detects social behavior changes for each CA, so differentiating common social routine variation from abnormal social habits.

We explored data window processing strategy provided by the Esper engine to partition data flow, so extracting sociability patterns at different time intervals. Therefore, it is possible to detect sociability patterns through current data and, subsequently, compare them with the pattern identified in a future data window to recognize occurrences of social routine changes of the monitored individual. We used the Jaccard similarity coefficient (Equation (4)) to quantify overlaps between intervals of identified sociability patterns (i.e., proportion between intersection and union of the compared patterns).

$$J(A,B) = \frac{A \cap B}{A \cup B} \tag{4}$$

Based on the strategy described above, we developed a solution to detect two types of situations of interest for specialized mental health professionals: abnormal social behaviors and social routine changes. Abnormal social behaviors reflect a low similarity between the current sociability pattern and the individual's social habit on a specific day. When abnormal behaviors occur with substantial frequency, it is necessary to assess whether the individual's sociability routine has changed. Therefore, routine change is recognized when a sociability pattern extracted from a data window at time *t* has low similarity to a pattern identified from the data window *t+n*. The proposed solution maintains the first identified sociability pattern (i.e., a reference pattern) until it finds a new pattern significantly different from the reference pattern, so allowing to identify changes that happen slowly, over a long period.

Figure 3 shows the strategy for detecting abnormal social behaviors. To perform this task, the specialist (e.g., a mental health professional) is required to define the time window size that models an observation of the individual's social behavior in a given context (e.g., Mondays, rainy days, weekends). For example, in Figure 3, an observation could be composed of a one-week data window, so requiring two observations to extract a consistent sociability pattern, i.e., to conceive a predictive model of intervals of the day in which the individual habitually socializes. Therefore, to recognize abnormal behaviors, our proposed solution uses the Jaccard similarity coefficient (Equation (4)) to compare the current sociability pattern with the social behavior of the next observations. Hence, if the similarity between the current pattern and the recognized social habit (i.e., an observation) has value below a threshold defined by the specialist, the solution sends an event to notify interested parties about the identification of abnormal social behavior.

Figure 4 presents the strategy for detecting social routine changes. In this scenario, sociability patterns are extracted through a determined number of observations (e.g., two observations), which represent the current social routine of the monitored individual. In principle, the solution persists in memory the first sociability pattern identified, which is

used as a comparison model with the next patterns to recognize significant social routine changes. Specifically, when the similarity is below the defined threshold, two tasks are triggered to: (i) update the current sociability pattern with the most recent routine and; (ii) notify interested parties by sending a social routine change event.

**Figure 3.** Strategy for detecting abnormal social behavior.

**Figure 4.** Strategy for detecting social routine changes.

### 3.2.2. Expert Knowledge Modeling

As we could see, it is possible to identify the specialist's need to define a similarity threshold between patterns. The specification of the change threshold is subjective, as it depends on the specialist's knowledge, and has an imprecise essence, since a rigid limit may not adequately model the change that has occurred. For example, consider that an specialist has configured the behavior change detection solution with a similarity threshold of 60%. In this scenario, if the similarity between sociability patterns is 59.9%, abnormal social behavior is detected even though it is very close to the specified threshold. Therefore, it is

necessary to define strategies that allow modeling the specialist's knowledge automatically, so enabling to send behavior change alerts with a judgment of the belief degrees.

We implemented expert knowledge modeling through fuzzy logic concepts to consider the imprecise nature of this task. Specifically, we used the open-source library *jFuzzyLogic* (http://jfuzzylogic.sourceforge.net/) [46,47] to develop fuzzy controllers. This library uses Fuzzy Control Language (FCL), which is a domain-specific language to facilitate the development of fuzzy systems. *jFuzzyLogic* enabled the integration of FIS into the proposed solution to allow the specialist to specify linguistic variables, fuzzy sets, and rules.

The motivation for using fuzzy logic in this task is the possibility of representing imprecise and qualitative human knowledge through fuzzy sets instead of using crisp sets [48]. Fuzzy logic allows computational systems to model human reasoning so that output variables can vary from false to true gradually, then making it possible to express partially true or partially false conclusions. Another reason is the notation of defining fuzzy rules through linguistic variables (i.e., natural language) and logical connectors [49], which presents semantics that is easy to understand for users. Therefore, we used fuzzy logic due to its ability to model expert knowledge through fuzzy sets and fuzzy rules and its notation that is easy to understand. Moreover, fuzzy logic has already been used to model situations of interest to mental health professionals [50].

First, the specialist is required to determine three fuzzy sets: sensitivity, similarity, and drift. Sensitivity sets define discrepancy levels between patterns that represent a change, i.e., it models the sensitivity knowledge to detect changes. Similarity sets define correspondence levels between evaluated patterns. Finally, drift sets represent the FIS output (i.e., defuzzifier) responsible for modeling change levels in social behaviors.

After defining fuzzy sets, the next step is to subdivide them to represent specialist's knowledge to assign linguistic terms to the intervals of each set. Therefore, the specialist should use FCL to perform this task. Code 1 shows a configuration example of the sensitivity sets using FCL, while Figure 5 shows their visual representation. The specialist divided the sensitivity input variable into three levels: low, moderate, and high. In this scenario, a certain level of intersection between intervals is observed, so representing a gradual pertinence transition.

> Code 1: Configuration example of the sensitivity sets using FCL.

```
FUZZIFY sensibility
TERM low:= (0, 1) (25, 1) (50, 0);
TERM moderate:= (25, 0) (50,1) (75, 0);
TERM high:= (50, 0) (75, 1) (100, 1);
END_FUZZIFY
```
**Figure 5.** Fuzzy sets to model behavior change detection sensitivity.

The specialist is also required to represent his/her knowledge through FCL to define similarity set partitions and their respective linguistic terms. Code 2 shows a configuration example of the similarity sets using FCL, while Figure 6 shows their visual representation. The specialist subdivided the similarity input variable into three levels: low, moderate, and high. In this scenario, intervals have an intersection level to model uncertainty.

> Code 2: Configuration example of the similarity sets using FCL.

```
FUZZIFY similarity
TERM low:= (0, 1) (40, 1) (60, 0);
TERM moderate:= (50, 0) (60,1) (70, 0);
TERM high:= (60, 0) (75, 1) (100, 1);
END_FUZZIFY
```
**Figure 6.** Fuzzy sets to model the similarity levels between patterns and behaviors.

The third set to be specified is the drift, which is representing the FIS output, i.e., it models the occurrence of social behavior changes of the monitored individual. Code 3 presents a configuration example of the drift sets, while Figure 7 shows their visual representation. The specialist described three linguistic terms: no\_change, moderate\_change, and change. In this example, we used the Center of Gravity (COG) defuzzification method to determine the inference's final value from activated rules. *jFuzzyLogic* supports several fuzzification and defuzzification methods.

**Figure 7.** Output fuzzy sets defined to assess behavior change.

Code 3: Configuration example of the drift sets using FCL.

```
DEFUZZIFY drift
TERM no_change:= (0, 1) (50, 1) (65, 0);
TERM moderate_chabge:= (50, 0) (65, 1) (80, 0);
TERM change:= (65, 0) (80, 1) (100,1);
METHOD: COG;
ENDDEFUZZIFY
```
Next, the specialist is required to specify fuzzy rules that guide the solution's decision. These fuzzy rules have the primary structure <condition> *AND* <condition> *THEN* <consequence>. The specified fuzzy rules form the knowledge used by the FIS to determine the final value of the behavior change inference. Therefore, based on fuzzy sets presented above, the fuzzy rules contained in Code 4 can be specified using FCL.

> Code 4: Fuzzy rules for behavior change.

```
RULEBLOCK No1
     RULE 1 : IF sensibility IS low AND similarity IS low THEN drift IS change
     ;
  RULE 2 : IF sensibility IS low AND similarity IS moderate THEN drift IS
    no_change;
  RULE 3 : IF sensibility IS low AND similarity IS high THEN drift IS
    no_change;
     RULE 4 : IF sensibility IS moderate AND similarity IS low THEN drift IS
     change;
  RULE 5 : IF sensibility IS moderate AND similarity IS moderate THEN drift
     IS
  moderate_change;
  RULE 6 : IF sensibility IS moderate AND similarity IS high THEN drift IS
    no_change;
     RULE 7 : IF sensibility IS high AND similarity IS low THEN drift IS
     change;
  RULE 8 : IF sensibility IS high AND similarity IS moderate THEN drift IS
     change;
  RULE 9 : IF sensibility IS high AND similarity IS high THEN drift IS
    no_change;
END_RULEBLOCK
```
At the end of the expert knowledge modeling process, the solution can detect social behavior changes considering uncertainty in this task. Specifically, the solution sends a JSON object that contains information such as date, context, similarity index, and the pertinence degree to each interval of the fuzzy output set. Code 5 presents an example of social behavior change notification considering the expert knowledge modeled in the previous cases. In this example, the output variable (i.e., defuzzification value) is ≈74.86, which is ≈65% contained in the interval that represents change and ≈34% in the partition that reflects moderate change.

> Code 5: Notification of social behavior change.

```
"date": "Sun 1, 2020, 9:17:48 PM",
"context":"Sunday",
"similarity":56.00000000000001,
"defuzzification value":74.86688093051647,
"change":0.6577920620344315,
"no_change":0.0,
"moderate_change":0.3422079379655685,
"message":"Social routine change detected"
```
### *3.3. Application Programming Interface*

{

}

The solution designed by this study provides an API to its users, which allows them to quickly implement strategies for detecting sociability patterns and configuring the recognition of behavioral changes. Development of this API used the Builder design pattern (Constructor) [51], which enables separation of the construction of a complex object from its representation, so dividing this process into parts (i.e., steps). We mitigate the complexity inherent in the creation and instantiation of the EPLs and solution configuration using this design pattern.

Next, the user specifies the RootTopic attribute (setRootTopic) with the value "com/lsdi/sociability". The solution uses this attribute to publish new sociability patterns and behavior change notifications in MQTT broker, allowing interested client applications to subscribe to this topic to receive updates. Finally, the user set true value to the parameters AbnormalBehavior and ChangeBehavior (setAbnormalBehavior and setChangeBehavior) for the solution to activate the detection of abnormal behaviors and social routine changes.

Code 6 presents an example of use of the designed API. Specifically, the developer create an object called *SociabilityPattern*, which configures and enables the entire solution operation. In this example, the developer initializes the constructor with two parameters: "MONDAY\_" and 50.0, so representing the CA considered and the sensitivity level to detect behavior changes, respectively. Next, the developer specifies the *RootTopic* attribute (setRootTopic) with the value "com/lsdi/sociability". The solution uses this attribute to publish new sociability patterns and behavior change notifications in an MQTT broker [52], so allowing interested client applications to subscribe to this topic to receive updates. Finally, the developer set true value to the parameters *AbnormalBehavior* and *ChangeBehavior* (setAbnormalBehavior and setChangeBehavior) for the solution to activate detection of abnormal behaviors and social routine changes.

> Code 6: Application Programming Interface (API) usage example.

```
SociabilityPattern sociabilityPattern = new SociabilityPattern
             .Builder("MONDAY_", 50.0)
             .setRootTopic("com/ lsdi/sociability")
             .setAbnormalBehavior( true )
             .setChangeBehavior( true )
             .build();
```