Through the expansion of large-scale service systems and the exponential growth of data generated by complex IT infrastructure components, gaining a comprehensive overview of the different levels of service within an IT system has become increasingly challenging. In particular, this brought to the fore the question from a large commercial bank of how IT monitoring data streams generated by their complex IT infrastructure can be associated with one another.

In more detail, the data from the monitoring stream consists (among other things) of a message and a time stamp. Moreover, the monitoring data stream of this bank consists of two natures of information. These natures are either automatically generated warnings in the form of events or unplanned outages, referred to as incidents. The events and incidents are referred to as arrivals. As a first requirement to obtain better granularity, both event and incident messages with similar semantics should be grouped together. To this extent, the message component from each arrival is transformed into a numerical vector, the dimension of the obtained vector is reduced, and the collection of vectors is clustered. Once the individual arrival from the IT monitoring data stream is attached to a cluster based on their message component, the arrival is assigned a mark. This mark consists of a combination of the assigned cluster, the nature, and three different levels of service from the IT architecture on which the arrival occurred.

From a mathematical point of view, we can now view the monitoring data stream from different levels of service as a marked point process. Our primary focus centers on a specific category of marked point processes, known as marked Hawkes processes. Given the marked Hawkes process, we assume that each arrival from the IT monitoring data stream results in an instantaneous increase in the probability of some other arrivals in the near future. From here, we estimate the excitation matrix, representing the instantaneous increases among all assigned marks. Once the estimated excitation matrix is obtained, we decompose it into the different levels of service as defined within the mark. In particular, the decomposition has been performed through means of hierarchical linear models. Finally, the decomposition resulted in a comprehensive overview of the excitation behavior in large-scale service systems. This overview can directly be incorporated into the field of Software Architecture in order to uncover associations within complex IT infrastructures.

In today’s complex, modern world, where more data and knowledge is available then ever before, consensus over approaches in statistics is far away. To understand what this means for forensic statistics, both the frequentist and Bayesian approach are considered in quantifying evidence. Classical frequentist approaches are elaborated according to an example of knife data, where both univariate and multivariate approaches are applied. As an alternative to the previous methods, the likelihood ratio is introduced. To arrive at a unified framework for calculating likelihood ratios, the European Union funded a project to calculate likelihood ratios using a software package with a user friendly interface called SAILR. Calculating the likelihood ratio is mostly done by using feature based models. A feature based model used by SAILR will be elaborated according to a glass comparison example. When the feature based model is illustrated, an extension on the model will be given using a non-parametric function. The discussed models will be elaborated and applied on test data from and international drugs comparison project using SAILR. As an alternative to feature based models, a score based model is introduced and compared to the previous drugs comparison results of the feature based model.