Event2Vec: Event-Centric Embedding Methods

• Event2Vec is a family of techniques that embeds events—defined variably across domains—into low-dimensional vector spaces to capture context, structure, and dynamics.
• Different branches employ autoencoders, temporally regularized factorization, and additive recurrent models to transform diverse event data from networks, neuromorphic vision, to cyber telemetry.
• These methods enable actionable insights in tasks like link prediction, rapid inference in sensor data, and temporal tracking of evolving event semantics.

Event2Vec is an overloaded research term used for several event-centered representation-learning programs in which events, event types, or event-defined semantic units are embedded into vector spaces for downstream analysis. In the surveyed literature, the embedded object ranges from an indecomposable semantic unit in a heterogeneous information network, to a neuromorphic camera tuple $E_i=(x_i,y_i,t_i,p_i)$, to a security alert type, to a token in a discrete sequence. This suggests that Event2Vec is best understood not as a single canonical algorithm but as a family of methods whose common objective is to preserve event context, event structure, or event dynamics in a low-dimensional representation usable by standard machine-learning pipelines (Fu et al., 2019, Fang et al., 21 Apr 2025, Shen et al., 2019, Sulc, 15 Sep 2025).

1. Scope, terminology, and recurring design pattern

Across domains, Event2Vec methods share an event-first viewpoint: the primitive being represented is not necessarily an image, graph node, sentence, or time series sample, but an event or event-defined unit. What counts as an event depends on the domain. In heterogeneous information networks, an event is an indecomposable semantic unit formed by a set of objects. In neuromorphic vision, an event is an Address-Event Representation tuple $(x,y,t,p)$. In cyberattack telemetry, the token being embedded is an IPS alert type interpreted as a proxy for an attack step. In additive sequence formulations, an event is a discrete symbol whose embedding composes a history state (Fu et al., 2019, Fang et al., 21 Apr 2025, Shen et al., 2019, Sulc, 15 Sep 2025).

Line of work	Embedded object	Core mechanism
HIN Event2vec	Multi-object event; derived object embedding	Event autoencoder over object–event incidence matrices
Neuromorphic Event2Vec	Event tuple $(x,y,t,p)$	Embedding lookup, 2D factorization, neighbor-aware smoothing
ATTACK2VEC	Security event type / IPS alert type	Temporally regularized PPMI factorization
Geometric Event2Vec	Discrete event sequence	Additive recurrent state in Euclidean or hyperbolic space

A recurrent misconception is that Event2Vec always means a Word2Vec-style embedding lookup over event IDs. The literature surveyed here contradicts that simplification. One branch uses autoencoding over incidence matrices, another uses temporally regularized matrix factorization, another uses direct tokenization of event-camera coordinates, and another imposes a compositional recurrent geometry. The shared idea is event-centric representation, not a single optimizer, architecture, or loss family.

2. Event2vec for heterogeneous information networks

The 2019 HIN framework named Event2vec formalizes an event as a complete semantic unit that preserves the full relation among multiple objects rather than decomposing that relation into pairwise links. Given a heterogeneous information network $\mathcal{G}=(V,E,T)$, the method constructs an event set $\Omega$, object-specific incident event sets $\Omega_i$, and type-specific incident matrices $\{\mathcal{H}^t\}_{t=1}^{|T_V|}$. Its central claim is that object relevance in a HIN depends both on the quantity of shared relations and on the properties of those relations (Fu et al., 2019).

That distinction is encoded through event-driven first-order and second-order proximities. The first-order proximity is a Jaccard-style overlap over incident events,

$$s_{i,j}^1 = \frac{|\Omega_i\cap\Omega_j|}{|\Omega_i\cup\Omega_j|},$$

while the second-order proximity measures similarity between non-shared but similar events,

$$s_{i,j}^2 = \frac{1}{|\Omega_i\cup\Omega_j|}\sum_{e\in\Omega_i,k\in\Omega_j,e\neq k}sim(e, k).$$

Event embeddings are learned by a single hidden layer autoencoder with type-specific encoders and decoders,

$$Z_i^t = \sigma(W_t*\mathcal{H}_i^t + b_t), \qquad Z_i = \sum_{t=1}^{|T_V|}Z_i^t,$$

followed by reconstruction of the type-specific incidence vectors. A weighted reconstruction loss emphasizes nonzero incidences, and object embeddings are obtained by averaging incident event embeddings,

$(x,y,t,p)$0

The paper’s theoretical lemma states that the similarity between object embeddings is proportional to $(x,y,t,p)$1, providing a formal bridge between event overlap, event similarity, and object similarity. Empirically, Event2vec is evaluated on DBLP, Douban, IMDB, and Yelp, against DeepWalk, node2vec, LINE, metapath2vec, and DHNE. It is strongest on semantic tasks such as link prediction and node classification, while DeepWalk remains stronger on some network reconstruction settings such as Douban and Yelp (Fu et al., 2019).

This formulation is historically important because it established a precise event-centric alternative to pairwise-link and meta-path approaches. In this sense, Event2vec is not merely “node embedding with extra structure”; it redefines the semantic unit of representation from the node or edge to the event itself.

3. Direct vectorization of neuromorphic events

A distinct 2025 usage of Event2Vec appears in event-camera research, where the term refers to representing each neuromorphic event directly as a learned vector rather than first converting the asynchronous event stream into frames, voxels, graphs, or spikes. The underlying event is the Address-Event Representation tuple

$(x,y,t,p)$2

with spatial coordinates $(x,y,t,p)$3, timestamp $(x,y,t,p)$4, and polarity $(x,y,t,p)$5 (Fang et al., 21 Apr 2025).

The basic construction flattens polarity and spatial coordinates into a discrete token index,

$(x,y,t,p)$6

with embedding table $(x,y,t,p)$7. The paper then introduces a 2D Event2Vec variant to preserve spatial structure,

$(x,y,t,p)$8

and a neighbor-augmented formulation

$(x,y,t,p)$9

with weights initialized as

$(x,y,t,p)$0

Temporal information is handled by making timestamps relative to the first event in the stream and normalizing by the maximum timestamp observed in the training set; for ASL-DVS, $(x,y,t,p)$1. In the reported implementation, timestamps are directly added to the event embeddings, and the resulting sequence is processed by a 2-layer transformer encoder with hidden dimension 256, 16 attention heads, and feedforward dimension 512. To control $(x,y,t,p)$2 self-attention cost, the model randomly samples $(x,y,t,p)$3 events from each sample (Fang et al., 21 Apr 2025).

The reported evaluation is on ASL-DVS, where Event2Vec + Transformer reaches $(x,y,t,p)$4 test accuracy using the 2D Event2Vec with $(x,y,t,p)$5 neighbors. The full model is $(x,y,t,p)$6 MB. Training speed is 2185 samples/s and inference speed is 4320 samples/s on an Intel Xeon Gold 6240 CPU, one Tesla V100-SXM2-32GB GPU, and 64 GB RAM. Relative to the compared GNN + Transformer baseline, the paper reports about $(x,y,t,p)$7 faster inference per sample including data reading and sampling (Fang et al., 21 Apr 2025).

Two further points are significant. First, the method removes event-to-frame, event-to-voxel, and event-to-graph preprocessing entirely. Second, the paper explicitly argues that Event2Vec “aligns events to the domain of natural language processing,” and presents this as a promising prospect for integrating events into large language and multimodal models. The limitations are equally explicit: validation is restricted to ASL-DVS; only 255 events are sampled per sample; and transformer complexity is not eliminated but sidestepped through sampling (Fang et al., 21 Apr 2025).

4. Temporal embeddings of evolving event contexts

A separate temporal formulation appears in ATTACK2VEC, which is best understood as an Event2Vec-style method specialized to cyberattack telemetry. Here, the embedded object is a security event type, specifically an IPS-generated alert corresponding to a signature match and interpreted as a proxy for an attack step. The data come from Symantec’s intrusion prevention system, span 102 observation days from December 1, 2016 to November 8, 2018, and contain about 190 million security events per observation day from tens of millions of unique machines, with 8,087 unique security event types over the full study (Shen et al., 2019).

The preprocessing is sequence-based. For each observation period $(x,y,t,p)$8, the method reconstructs per-machine chronologically ordered sequences

$(x,y,t,p)$9

collects them into $\mathcal{G}=(V,E,T)$0, and then learns time-indexed embeddings $\mathcal{G}=(V,E,T)$1 from local co-occurrence within a symmetric context window. The representation is not trained with standard Skip-gram or CBOW. Instead, ATTACK2VEC factorizes a per-slice PPMI matrix with temporal regularization: $\mathcal{G}=(V,E,T)$2 and learns $\mathcal{G}=(V,E,T)$3 such that $\mathcal{G}=(V,E,T)$4, with joint objective

$\mathcal{G}=(V,E,T)$5

The reported hyperparameters are $\mathcal{G}=(V,E,T)$6, $\mathcal{G}=(V,E,T)$7, $\mathcal{G}=(V,E,T)$8, $\mathcal{G}=(V,E,T)$9, and 5 training epochs (Shen et al., 2019).

This design makes temporal comparability first-class. Rather than training separate embeddings and aligning them post hoc, ATTACK2VEC jointly optimizes all time slices. Cosine similarity is then used both for cross-event similarity within a slice and for self-similarity across time, making it possible to detect drift in how an event is used. The paper reports that, before a CVE exists in telemetry, similarity to its initial embedding remains high, above 0.9 and often above 0.95; after disclosure and signature availability, similarity drops sharply, indicating entry into real attack contexts. Weighted drift analysis identifies ecosystem-level shifts, including a period from October 11–18 2018 in which 34 security events showed major usage changes (Shen et al., 2019).

The strongest operational case study concerns Apache Struts CVE-2017-5638. ATTACK2VEC first associates it with IoT-related attack vectors such as WifiCam Authentication Bypass, CCTV-DVR Remote Code Execution, and ZyNOS Information Disclosure, and later with Apache-Struts-related events such as Malicious OGNL Expression Upload. The authors report 701 unique IPs on a selected date associated with the early-event combination, and later external confirmation that a Mirai variant was exploiting exactly these vulnerabilities. ATTACK2VEC surfaced this combination 72 weeks before security researchers publicly documented it (Shen et al., 2019).

This temporal line of work broadens the Event2Vec concept from static embedding to aligned sequences of embeddings. The event is no longer only “represented”; it is tracked as a moving point in a time-indexed semantic space.

5. Compositional and geometric sequence models

Another meaning of Event2Vec centers on compositional sequence geometry. In the 2025 geometric formulation, the model learns an embedding $\Omega$0 for each event type and constructs a history representation by additive recurrence,

$\Omega$1

with next-event prediction

$\Omega$2

reconstruction

$\Omega$3

and consistency

$\Omega$4

The total loss is

$\Omega$5

with all loss weights set to 1 in experiments. A hyperbolic variant replaces Euclidean addition with Möbius addition in the Poincaré ball and uses a hyperbolic reconstruction objective (Sulc, 15 Sep 2025).

The key concept is the linear additive hypothesis,

$\Omega$6

under which a sequence representation is the vector sum of its constituent events. The paper presents this as a route to composable and interpretable sequence representations. Empirically, it evaluates the formulation on a synthetic life-path dataset of 10,000 unique sequences and on the Brown Corpus. On the Brown Corpus, Event2Vec attains silhouette score $\Omega$7 for clustering POS-sequence composites, compared with $\Omega$8 for Word2Vec. On synthetic life paths, appendix analyses report that cosine similarity between the recurrent hidden state and the direct vector sum remains around $\Omega$9 even for long sequences, though it decays with length due to norm clipping (Sulc, 15 Sep 2025).

A biologically oriented adaptation applies Event2Vec to random walks on the human STRING v12.0 interactome, using 16,201 proteins and 89,234 high-confidence edges with score $\Omega_i$0. In that study, the recurrence again takes additive form,

$\Omega_i$1

and training uses a future-event prediction term over look-ahead window 5 plus a reconstruction penalty

$\Omega_i$2

with $\Omega_i$3, embedding dimension 64, Adam, learning rate 0.001, batch size 32, and 100 epochs. Compared with a DeepWalk baseline trained on the same random walks, the paper reports pathway coherence $\Omega_i$4 above random versus $\Omega_i$5 above random, mean analogy similarity $\Omega_i$6 versus $\Omega_i$7, and clearer hierarchical pathway organization (Sulc, 1 Apr 2026).

These compositional models make explicit something that remains only implicit in other Event2Vec branches: an event embedding can be interpreted not just as a point in a semantic space but as an additive operator on history. A plausible implication is that this line of work provides the strongest formal account of why event vectors might support analogy, decomposition, and trajectory arithmetic.

6. Domain-specific extensions and multimodal outlook

Several papers extend Event2Vec-like thinking into applied multimodal systems. In football analytics, a Transformer-based dense event representation learns contextualized embeddings for categorical event fields inside a single event instance and concatenates them with numerical features, yielding a final 911-dimensional event representation with $\Omega_i$8, $\Omega_i$9, and $\{\mathcal{H}^t\}_{t=1}^{|T_V|}$0. Pretraining uses masked reconstruction of categorical fields on 6,391,338 events from 1,823 matches across the five major European leagues, and downstream evaluations emphasize improved probability calibration, measured by Brier score, on xG and VAEP tasks (Yang et al., 8 Jun 2026). The paper does not use the Event2Vec label, but this suggests an Event2Vec-style shift from sparse one-hot encodings to transferable dense event-instance embeddings.

In game analytics, player2vec treats telemetry logs as event sequences, sessionizes them with a 15-minute inactivity rule, tokenizes the resulting text-like stream, and trains Longformer models with masked language modeling. The largest model, player2vec-large, outputs a $\{\mathcal{H}^t\}_{t=1}^{|T_V|}$1 final-layer representation that is aggregated by max pooling over sequence length to yield a fixed-dimensional player embedding. On intrinsic validation, player2vec-large reports accuracy $\{\mathcal{H}^t\}_{t=1}^{|T_V|}$2, perplexity $\{\mathcal{H}^t\}_{t=1}^{|T_V|}$3, and cross-entropy $\{\mathcal{H}^t\}_{t=1}^{|T_V|}$4 (Wang et al., 2024). This is not Event2Vec in name, but it is directly relevant to the broader event-to-vector paradigm because it learns contextual event representations and then aggregates them into entity-level embeddings.

In financial forecasting, MMF-Trans includes an Event2Vec algorithm inside an event knowledge channel. The module uses Graph Attention Network updates

$\{\mathcal{H}^t\}_{t=1}^{|T_V|}$5

and participates in dynamic cross-modal fusion

$\{\mathcal{H}^t\}_{t=1}^{|T_V|}$6

The event source is GDELT with 127K events from 2005–2022. In ablation, removing the event graph worsens RMSE from 0.091 to 0.105, a $\{\mathcal{H}^t\}_{t=1}^{|T_V|}$7 degradation, and the paper presents interpretable event impact coefficients such as $\{\mathcal{H}^t\}_{t=1}^{|T_V|}$8 for the new energy industry and $\{\mathcal{H}^t\}_{t=1}^{|T_V|}$9 for the traditional energy industry under the “carbon neutrality” policy, with duration 63 trading days (AI et al., 28 Jan 2025). At the same time, the paper leaves the exact event impact coefficient formula unspecified, illustrating a broader pattern in applied Event2Vec work: empirical usefulness may be clearer than algorithmic transparency.

A further development links event representations to foundation-model interfaces. The abstract of LLM-EvRep reports an event representation generator, LLM-EvGen, that produces LLM-compatible event representations named LLM-EvRep, trained by a self-supervised framework. On N-ImageNet, N-Caltech101, and N-MNIST, the method is reported to outperform E2VID by $$s_{i,j}^1 = \frac{|\Omega_i\cap\Omega_j|}{|\Omega_i\cup\Omega_j|},$$0, $$s_{i,j}^1 = \frac{|\Omega_i\cap\Omega_j|}{|\Omega_i\cup\Omega_j|},$$1, and $$s_{i,j}^1 = \frac{|\Omega_i\cap\Omega_j|}{|\Omega_i\cup\Omega_j|},$$2, respectively, in recognition tasks when evaluated using GPT-4o (Yu et al., 20 Feb 2025). This suggests an Event2Vec-adjacent direction in which event representations are optimized not only for discriminative performance but also for compatibility with multimodal large models.

Taken together, these extensions show that Event2Vec has become less a single method than a reusable representational stance. In some papers, the output is an event embedding; in others, it is an object, player, stock, or sequence representation derived from event embeddings. In some cases, the embedding is a static vector; in others, it is temporal, contextualized, or explicitly compositional. What remains stable is the decision to treat events as the primary semantic atoms of learning.