Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Event Processing Course

Lecture 10 –Focal points on challenging topics (related to chapter 11)

2Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Lecture outline

Temporal semantics of event processing

Inexact event processing

Retraction and causality

3Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Time point vs. time interval

A time interval is a data type that designates a continuous segment in time, starting at a time point (Ts) and ending at a time point (Te).

A temporal element is a non overlapping collection of time intervals

Context IntervalEvent Interval

Context Interval

Context Interval

Context Interval

Context Interval

Context Interval

Context Interval

Before

Event Interval

Event Interval

Event Interval

Event Interval

Event Interval

Event Interval

Meets

Overlaps

During

Starts

Finishes

Equalstime

4Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Putting derived events in order

Auction Context Interval timeB

id event

Auctionentry

Anomaly 1

Bid

events

Auction

entries

Anomaly 2

5Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Occurrence time of derived events Event Identity

Event Type

Patient Hospitalization Reason

Detection Time

Occurrence Time

E232243 Patient-

Discharge

Pierre

Werner

High fever September 14,

2009 15:04

September

14, 2009 14:50

E291126 Patient-

Admission

Pierre

Warner

High Fever September 16,

2009

08:20

September

16, 2009

08:18

E291244 Patient-

Readmission

(derived)

Pierre

Warner

High Fever September 16,

2009

08:21

?

1. Occurrence time := detection time

2. Occurrence time := Occurrence time of last event / expiration of context

3. Occurrence time := time interval that includes all relevant event/ temporal context

Event Identity Request Id Detection Time Occurrence Time

Bid Request R302291 October 8, 2009

11:30

October 8, 2009

11:30

No Bidders

(derived)

R310012 October 8, 2009

11:36

?

6Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Event order and out-of-order semantics –occurrence time synchronization

Clock synchronization

Time server. Example: http://tf.nist.gov/service/its.htm

7Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Ordering in a distributed environment - possible issues

The occurrence time of an event is accurate, but the event arrives out-of-order and processing that should have included the event might already been executed.

Neither the occurrence time nor detection time can be trusted, so the order of events cannot be accurately determined.

8Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Buffering technique

Assumptions:

o Events are reported by the producers as soon as they occur;

o The delay in reporting events to the system is relatively small, and can be bounded by a time-out offset;

o Events arriving after this time-out can be ignored.

Principles:

o Let be the time-out offset, according to the assumption it is safe to assume that at any time-point t, all events whose occurrence time is earlier than t - have already arrived.

o Each event whose occurrence time is To is then kept in the buffer until To+, at which time the buffer can be sorted by occurrence time, and then events can be processed in this sorted order.

9Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Retrospective compensation

Find out all EPAs that have already sent derived events which would have been affected by the "out-of-order" event if it had arrived at the right time.

Retract all the derived events that should not have been emitted in their current form.

Replay the original events with the late one inserted in its correct place in the sequence so that the correct derived events are generated.

10Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Inexact event processing

uncertainty whether an event actually occurred

inexact content in the event payload

inexact matching between derived events and the situations they purport to describe

Sourcemalfunction

Malicioussource

Projection oftemporal

anomalies

Imprecise source

Sampling orestimate

Propagation of

inexactness

Uncertainevent

Inexact event content

11Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

False positives and false negatives

False positive situation detection refers to cases in which an event representing a situation was emitted by an event processing system, but the situation did not occur in reality.

False negative situation detection refers to cases in which a situation occurred in reality, but the event representing this situation was not emitted by an event processing system

12Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Handling inexact event processing

Example: probabilistic approach

Inexact indicator Probability

Event did not occur 0.4

Event occurred before T1 0.1

Event occurred in [T1, T2] 0.45

Event occurred after T2 0.05

13Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Retraction

Delivery Request issued

Bid Request issued

Assignment issued

Pick-up occurred

Delivery occurred

Order Cancellation

Cancel bid preparation

Cancel bid and assignm

ent process

Notify assigned driver about

cancellation

Undoable

May still be cancelled w

ith some

penalty

14Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Event Causality

Event Causality is a relation between two events e1 and e2, designating the fact that the occurrence of the event e1 caused the occurrence of event e2.o Type I: predetermined causality. This type of causality refers to raw events, e1

and e2 where we know that event e2 always occurs as a result the occurrence of e1. We may thus assume that if e1 has been reported, e2 occurred whether reported or not. This occurrence may also be conditioned, for example some time offset or interval may be attached to this causality.

o Type II: Induced causality. The event e1 is an input to an EPA a1, and the derived event e2 is the output of a1.

o Type III: Potential causality. The event e1 is an event that is sent from an EPN to a consumer c1. The actions of c1 are beyond the borders of the event processing system, but c1 also acts as an event producer and can produce events of type e2. The event processing system cannot know, without further knowledge, whether there is indeed causality among events e1 and e2, but cannot rule out this possibility.

15Copyright ©2009 Opher EtzionCopyright ©2009 Opher Etzion

Summary

In the lecture we discussed:

Temporal semantics issues: temporal intervals, occurrence time of derived events, and keeping events in order

Inexact event processing, false positives and false negatives

Retraction

Causality