Abstract: A method and apparatus for processing at least one data stream are disclosed. For example, the method receives at least a join query for the at least one data stream, wherein the join query specifies a lifetime for keeping a tuple as a marker for a beginning of a sequence of interest, and receives a tuple from the at least one data stream. The method marks the tuple as a beginning of a sequence of interest and stores the tuple, if the tuple is the beginning of the sequence of interest. The method applies one or more initial predicates to the tuple, and determines if the tuple matched a marked tuple, if the tuple meets the one or more initial predicates. The method determines if the tuple meets one or more conditions to be outputted, if the tuple meets the one or more initial predicates conditions.

Abstract: A method of labeling unlabeled nodes in a graph that represents objects that have an explicit structure between them. A computing device can use a labeling engine to labeled nodes in a graph that are labeled and can identify an unlabeled node in the graph that is structurally associated with the labeled nodes. The labeling engine can label the unlabeled node with the label of the labeled node based on the structural association between the unlabeled node and the labeled node.

Abstract: In one embodiment, the present invention is a method and apparatus for data stream sampling. In one embodiment, a tuple of a data stream is received from a sampling window of the data stream. The tuple is associated with a group, selected from a set of one or more groups, which reflects a subset of information relating to a sample of the data stream. In addition, the tuple is associated with a supergroup, selected from a set of one or more supergroups, which reflects global information relating to the sample. It is then determined whether receipt of the tuple triggers a cleaning phase in which one or more tuples are shed from the sample. The operator can be implemented to execute a variety of different sampling algorithms, including well-known and experimental algorithms.

Abstract: A system, method and computer-readable medium provide for regular expression matching over a plurality of packets. The method embodiment comprises, for each data segment in a flow with no predecessor in a stored list of objects generated from traversing a deterministic finite sate automation (DFA) associated with the regular expression: traversing the DFA using the data segment and a list of all non-accepting states; and if the plurality of packets is not declared as matching, then storing, as list of equivalence classes, automaton state pairs having different starting states but an identical ending state. Finally, the method comprises determining whether the flow matches the regular expression.