This document summarizes research on out-of-order event processing. It describes ETALIS, a system for complex event processing (CEP) that uses logic programming to reason about streaming events. ETALIS transforms CEP rules to handle out-of-order events by adding time constraints. It prunes outdated partial event compositions through pattern-based garbage collection with time-based alarms. Evaluation tests on stock market patterns showed ETALIS can effectively detect complex events in out-of-order streams.
14. BIN - is one of the binary operators: SEQ, AND, PAR, OR, EQUALS, MEETS, STARTS, or FINISHES.Event rule is defined as a formula of the following shape: where p is an event pattern containing all variables occurring in
17. ETALIS: Operational Semantics Complex pattern (not event-driven rule) a ⊗ b ⊗ c -> ce1 ((a ⊗ b) ⊗ c) -> ce1 a ⊗ b -> ie1 ie1 ⊗ c -> ce1 Binarization a :- while_do(a,1). a(1) :- ins(goal(b,a,ie1)). b :- while_do(b,1). b(1) :- goal(b,a,ie1) ⊗ del(goal(b,a,ie1)) ⊗ ie1. ie1 :- while_do(ie1,1). ie1(1) :- ins(goal(c,ie1,ce1)). c :- while_do(c,1). c(1) :- goal(c,ie1,ce1) ⊗ del(goal(c,ie1,ce1)) ⊗ ce1. ce1 :- action1. Event-driven backward chaining rules
18.
19. Incremental Detection of Composed Events – Compiled rules in Prolog Complex pattern (not event-driven rule) a ⊗ b ⊗ c -> ce1 ((a ⊗ b) ⊗ c) -> ce1 a ⊗ b -> ie1 ie1 ⊗ c -> ce1 Binarization a :- while_do(a,1). a(1) :- ins(goal(b,a,ie1)). b :- while_do(b,1). b(1) :- goal(b,a,ie1) ⊗ del(goal(b,a,ie1)) ⊗ ie1. ie1 :- while_do(ie1,1). ie1(1) :- ins(goal(c,ie1,ce1)). c :- while_do(c,1). c(1) :- goal(c,ie1,ce1) ⊗ del(goal(c,ie1,ce1)) ⊗ ce1. ce1 :- action1. Event-driven backward chaining rules
20. Out-of-order Motivating Example Hedge fund with independent cooperating agents events arrive in an out-of-order Received vs. real order of events missing complex events due to an out-of-order stream, e.g., ce1 false positive complex events due to out-of-order events, e.g., ce2
23. Pruning outdated events- Pattern-Based Garbage Collection - GC via alarms partial composed events are saved into memory with time stamps the rules are labeled with a rule tag X For a given rule the partial goals can be pruned by alarms based on the time stamps pruning for: