Plan-based Complex Event Detection across Distributed Sources


 
Thread Tools Search this Thread
Special Forums News, Links, Events and Announcements Complex Event Processing RSS News Plan-based Complex Event Detection across Distributed Sources
# 1  
Old 09-25-2008
Plan-based Complex Event Detection across Distributed Sources

Tim Bass
09-25-2008 09:49 AM
Here is an interesting 2008 paper, Plan-based Complex Event Detection across Distributed Sources.

Abstract
Complex Event Detection (CED) is emerging as a key capability for many monitoring applications such as intrusion detection, sensorbased activity & phenomena tracking, and network monitoring. Existing CED solutions commonly assume centralized availability and processing of all relevant events, and thus incur significant overhead in distributed settings. In this paper, we present and evaluate communication efficient techniques that can efficiently perform CED across distributed event sources.

Our techniques are plan-based: we generate multi-step event acquisition and processing plans that leverage temporal relationships among events and event occurrence statistics to minimize event transmission costs, while meeting application-specific latency expectations. We present an optimal but exponential-time dynamic programming algorithm and two polynomial-time heuristic algorithms, as well as their extensions for detecting multiple complex events with common sub-expressions. We characterize the behavior and performance of our solutions via extensive experimentation on synthetic and real-world data sets using our prototype implementation.

Source...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question
EVENT(3)								 1								  EVENT(3)

The Event class

INTRODUCTION
Event class represents and event firing on a file descriptor being ready to read from or write to; a file descriptor becoming ready to read from or write to(edge-triggered I/O only); a timeout expiring; a signal occuring; a user-triggered event. Every event is associated with EventBase . However, event will never fire until it is added (via Event::add ). An added event remains in pending state until the registered event occurs, thus turning it to active state. To handle events user may register a callback which is called when event becomes active. If event is configured persistent , it remains pending. If it is not persistent, it stops being pending when it's callback runs. Event::del method deletes event, thus making it non-pending. By means of Event::add method it could be added again. CLASS SYNOPSIS
Event final Event Constants o const integer$Event::ET32 o const integer$Event::PERSIST16 o const integer$Event::READ2 o const integer$Event::WRITE4 o const integer$Event::SIGNAL8 o const integer$Event::TIMEOUT1 Properties o publicreadonly bool$pending Methods o public bool Event::add ([double $timeout]) o public bool Event::addSignal ([double $timeout]) o public bool Event::addTimer ([double $timeout]) o public Event::__construct (EventBase $base, mixed $fd, int $what, callable $cb, [mixed $arg = NULL]) o public bool Event::del (void ) o public bool Event::delSignal (void ) o public bool Event::delTimer (void ) o public void Event::free (void ) o publicstatic array Event::getSupportedMethods (void ) o public bool Event::pending (int $flags) o public bool Event::set (EventBase $base, mixed $fd, [int $what], [callable $cb], [mixed $arg]) o public bool Event::setPriority (int $priority) o public bool Event::setTimer (EventBase $base, callable $cb, [mixed $arg]) o publicstatic Event Event::signal (EventBase $base, int $signum, callable $cb, [mixed $arg]) o publicstatic Event Event::timer (EventBase $base, callable $cb, [mixed $arg]) PROPERTIES
o $pending - Whether event is pending. See About event persistence . PREDEFINED CONSTANTS
o Event::ET - Indicates that the event should be edge-triggered, if the underlying event base backend supports edge-triggered events. This affects the semantics of Event::READ and Event::WRITE . o Event::PERSIST - Indicates that the event is persistent. See About event persistence . o Event::READ - This flag indicates an event that becomes active when the provided file descriptor(usually a stream resource, or socket) is ready for reading. o Event::WRITE - This flag indicates an event that becomes active when the provided file descriptor(usually a stream resource, or socket) is ready for reading. o Event::SIGNAL - Used to implement signal detection. See "Constructing signal events" below. o Event::TIMEOUT - This flag indicates an event that becomes active after a timeout elapses. The Event::TIMEOUT flag is ignored when constructing an event: one can either set a timeout when event is added , or not. It is set in the $what argument to the callback function when a timeout has occurred. PHP Documentation Group EVENT(3)