Abstract: A system comprising: at least one hardware processor; and a non-transitory computer-readable storage medium having stored thereon program instructions, the program instructions executable by the at least one hardware processor to: receive a data stream representing events; receive a plurality of complex event patterns (CEPs) comprising (a) a set of conditions reflecting relations among said events, and (b) a set of attributes associated with each of said events; and calculate an optimal multi-pattern evaluation plan corresponding to said CEPs by: (i) generating an initial evaluation plan, (ii) applying a search method to calculate modified versions of said initial evaluation plan, (iii) assigning a score to each of said modified versions based on a cost function, and (iv) selecting one of said modified versions having a highest said score as said optimal multi-pattern evaluation plan.

Abstract: A method comprising receiving, as input, a data stream representing events; receiving a complex event pattern (CEP) specification representing an occurrence of a CEP in said data stream based on a set of conditions and set of event attributes; applying an algorithm to generate a current CEP plan configured to determine said occurrence of said CEP, wherein said current CEP plan comprises of a series of execution steps; optimize said current CEP plan by, iteratively: (i) executing said current CEP plan, (ii) identifying, with respect to each of said execution steps, one of said conditions whose verification causes said execution step to be included in said current CEP plan, and (iii) performing a re-verification of all of said identified conditions using said updated current values; and re-applying said algorithm when said re-verification fails with respect to at least one of said identified conditions, to generate an updated CEP plan.

Abstract: A system comprising: at least one hardware processor; and a non-transitory computer-readable storage medium having stored thereon program instructions, the program instructions executable by the at least one hardware processor to: receive a data stream representing events; receive a plurality of complex event patterns (CEPs) comprising (a) a set of conditions reflecting relations among said events, and (b) a set of attributes associated with each of said events; and calculate an optimal multi-pattern evaluation plan corresponding to said CEPs by: (i) generating an initial evaluation plan, (ii) applying a search method to calculate modified versions of said initial evaluation plan, (iii) assigning a score to each of said modified versions based on a cost function, and (iv) selecting one of said modified versions having a highest said score as said optimal multi-pattern evaluation plan.

Abstract: A method comprising receiving, as input, a data stream representing events; receiving a complex event pattern (CEP) specification representing an occurrence of a CEP in said data stream based on a set of conditions and set of event attributes; applying an algorithm to generate a current CEP plan configured to determine said occurrence of said CEP, wherein said current CEP plan comprises of a series of execution steps; optimize said current CEP plan by, iteratively: (i) executing said current CEP plan, (ii) identifying, with respect to each of said execution steps, one of said conditions whose verification causes said execution step to be included in said current CEP plan, and (iii) performing a re-verification of all of said identified conditions using said updated current values; and re-applying said algorithm when said re-verification fails with respect to at least one of said identified conditions, to generate an updated CEP plan.

Abstract: A method for detecting a pattern of events, comprising: receiving a template defining the pattern of events to detect; producing a join query for a relational database from the template; selecting a cost function for the join query, wherein a computation cost of the join query is equivalent to a computation cost of matching between a plurality of events from a plurality of streams of events and the template; identifying a preferred plan for executing the join query according to a minimal value of the cost function; producing an ordered set of a plurality of patterns, according to the preferred plan, by converting a plurality of database operations of the preferred plan into the ordered set of the plurality of patterns; and using the ordered set as an input for detecting a plurality of matches between the plurality of patterns and the plurality of events.

Abstract: A method for detecting a pattern of events, comprising: receiving a template defining the pattern of events to detect; producing a join query for a relational database from the template; selecting a cost function for the join query, wherein a computation cost of the join query is equivalent to a computation cost of matching between a plurality of events from a plurality of streams of events and the template; identifying a preferred plan for executing the join query according to a minimal value of the cost function; producing an ordered set of a plurality of patterns, according to the preferred plan, by converting a plurality of database operations of the preferred plan into the ordered set of the plurality of patterns; and using the ordered set as an input for detecting a plurality of matches between the plurality of patterns and the plurality of events.