1. Event Stream Processing with Out-of-Order Data Arrival Ming Li and Mo Liu Department of Computer Science Worcester Polytechnic Institute Worcester Massachusetts CS 525 Project Final Presentation 12.14 2006

2. Outline Introduction Preliminary Problem with Out-of-Order Event Arrival Solution Implementation Experiment Conclusion Related Work

3. Outline Introduction Preliminary Problem with Out-of-Order Event Arrival Solution Implementation Experiment Conclusion Related Work 1.Event Stream Processing 2.SASE System 3.Limitation of SASE 4.Goal and Contribution

4. Introduction: Event Stream Processing Raising interest on the database community Wild-range and growing applications Traffic Control Sensor is Moving: ( police vehicle, ambulance, Reporter Vehicle) Retail Management Sensor isn’t Moving: (Shelf, !CheckoutCounter, Exit)

5. Event Stream Processing Engine  Stream engine specific for even stream query: generic for detecting and extracting expected pattern sequence  Performance gain compared to stream system using joins to handle event sequence query Introduction: SASE System SASE Approach TelegraphCQ Approach

6. EVENTSEQ(A, B, !C, D) WITHIN10 seconds acbadfcd a c a… 356710121315 16 17 18… Timestamp SS (A, B, D) NG: !C (B.time<C.time<D.time TF: sequence to composite event a 3 b 6 d 10 …… Event Stream Introduction: SASE System (Cont.) SC (A, B, D) SSC WD in SS: W = 10 WD in SC: D.time – A.time < 10secs b 1 b 11 a 3 b 6 d 10 a 7 b 11 d 15 …… a 3 b 6 d 10 …… a 3 b 6 d 15 a 3 b 11 d 15 will not be selected

7. EVENTSEQ(A, B, !C, D) WHERE[attr_1] WITHIN10 seconds a(2)c(2)b(2)a(3)d(2)f(3)c(3)d(3) a(4) c(4) a(5)… 356710121315 16 17 18… Timestamp SS (A, B, D) SL: [attr] NG: !C (B.time<C.time<D.time Λ B.attr_1 = C.attr_1) TF: sequence to composite event a(2) b(2) d(2) a(3) b(3) d(3) …… a(2) b(2) d(2) a(3) b(3) d(3) …… a(2) b(2) d(2) …… …… Event Stream Introduction: SASE System (Cont.) SC (A, B, D) SSC WD in SS: W = 10 WD in SC: D.time – A.time < 10secs b(1) 1 b(3) 11

8. Total Order Assumption in event arrivals  Order in which the events are received by the query system is the same as their timestamp order  By this assumption, “later arrival” means “larger timestamp”  Example e1.timestamp = 5:15pm e1.received_time = 5:17pm e2.timestamp = 5:19pm e2.received_time = 5:20pm e2 e2 is received later than e1  e2’s timestamp is larger than e1 In the Case of Out-of-Order Event Arrival  Missing result  Spurious result  Unbound memory requirement Introduction: Limitation in SASE

9. Goal  Proposing solution to handle the sequence query processing with out-of-order event arrival Contributions  Study the problem with OOO event arrival  Solution framework on all the problems Solution on Sequence Scan Solution on Negation Solution on Window in SS Introduction: Goal and Contributions

10. Outline Introduction Preliminary Problem with Out-of-Order Event Arrival Solution Implementation Experiment Conclusion Related Work 1.Event, Event Stream and Query 2.SASE Evaluation - SSC 3.SASE Evaluation - Negation 4.SASE Evaluation - Window

11. Event and Event Stream  An event is defined to be an instantaneous, atomic (happens completely or not at all) occurrence of interest at a point in time  Each event, denoted by a lower case letter (e.g., “ a ” ), consists of the name of its type, denoted by a upper case letter and a set of values corresponding to the attributes in the type.  Each Event is with a timestamp under the total order assumption  Event stream: containing different event types  Example: a(attr_1 = 2, timestamp = 4), c(attr_1 = 1, timestamp = 5) … SASE Query Language  EVENT [WHERE ] [WITHIN ] Preliminary: Event, Event Stream and Event Sequence Query Language Example: EVENTSEQ(A, B, !C, D) WHERE[attr_1] WITHIN10 seconds

12. SSC: SS (Sequence Scan) and SC (Sequence Construction) NFA with AIS (Active Instance Stack) RIP (most Recent Instance in Previous stack) field Example 0123 ABD ** [] a 3 [] a 7 [a 3 ] b 6 [a 7 ] b 11 [b 6 ] d 10 [b 11 ] d 15 [] a 16 S1S2S3 Preliminary: SASE Evaluation – SSC EVENTSEQ(A, B, D) WITHIN10 Seconds a 3 b 6 d 15 a 3 b 11 d 15 a 7 b 11 d 15 a 3 b 6 d 10 acbadfcd a c a… 356710121315 16 17 18… Timestamp b 1 b 11

13. Preliminary: SASE Evaluation – NG EVENTSEQ(A, B, !C, D) WITHIN10 Seconds a 3 b 6 d 10 [3, 10] √ Negation (NG) Example acbadfcd a c a… 356710121315 16 17 18… Timestamp b 1 b 11 a 7 b 11 d 15 [10, 15] Χ

14. Purge  Purge in SSC  Purge in NG Example Preliminary: SASE Evaluation – Purge 0123 ABD ** EVENTSEQ(A, B, D) WITHIN10 Seconds a 3 b 6 d 15 a 3 b 11 d 15 a 7 b 11 d 15 a 3 b 6 d 10 acbadfcd a c a… 356710121315 16 17 18… Timestamp b 1 b 11 () a 3 () a 7 (a 3 ) b 6 (a 7 ) b 11 (b 6 ) d 10 (b 11 ) d 15 S1 S2 S3 WD PG in SS : You see d15  Purge a3 and so on The similar mechanism, You clean c5 and so on

15. Outline Introduction Preliminary Problem with Out-of-Order Event Arrival Solution Implementation Experiment Conclusion Related Work 1.Sequence Scan 2.Negation 3.Window in Sequence Scan 4.Problem Analysis

16. 0123 ABD ** () a 3 () a 7 (a 3 ) b 6 (a 7 ) b 11 (b 6 ) d 10 a 3 b 6 d 10 a 7 b 11 d 15 a 0 b 1 d 2 a 3 b 6 d 10 a 7 b 11 d 15 Produced ResultCorrect Result Missing! EVENTSEQ(A, B, D) WITHIN10 Seconds Problem with OOO: Sequence Scan acbadfcd a c a… 356710121315 16 17 18… Arrival Order b 1 b 11 (b 11 ) d 15 a 0 d 2 SS Missing Result

17. EVENTSEQ(A, B, !C, D) WITHIN10 Seconds Problem with OOO: Negation 0123 ABD ** () a 3 (a 3 ) b 6 (b 6 ) d 10 a 3 b 6 d 10 a 7 b 11 d 15 Produced Result Incorrect! acbad 356710 Arrival Order b 1 c 9 NG Incorrect Result

18. 0123 ABD ** EVENTSEQ(A, B, D) WITHIN10 Seconds a 3 b 6 d 15 a 3 b 11 d 15 a 7 b 11 d 15 a 3 b 6 d 10 acbadfcd a c a… 356710121315 16 17 18… Timestamp b 1 b 11 () a 3 () a 7 (a 3 ) b 6 (a 7 ) b 11 (b 6 ) d 10 (b 11 ) d 15 S1 S2 S3 Purge in SS You see d15 then purge a3 and so on After that, OOO d8 comes  Missing Result! Similar case of purging then making incorrect result!  (1) You cannot purge any data if you want to avoid missing results or creating spurious result (2) Unbounded buffer requirement in that case Problem with OOO: Purge in SSC d 8 If precise query result is required, and memory resources is limited, WD in SS would not be sufficient for handling Out-of-order event arrival!

19. Problem with OOO: Purge in NG

20. Outline Introduction Preliminary Problem with Out-of-Order Event Arrival Solution Implementation Experiment Conclusion Related Work 1.Sequence Scan 2.Window in Sequence Scan 3.Negation (skipped)

21. 0123 ABD ** () a 3 () a 7 (a 3 ) b 6 (a 7 ) b 11 (b 6 ) d 10 EVENTSEQ(A, B, D) WITHIN10 Seconds Solution in SS: Using Sort Semantic acbadfcd a c a… 356710121315 16 17 18… Arrival Order b 1 b 11 (b 11 ) d 15 a 0 d 2 Initially, every stack is active Search for proper place in the stack for a new event RIP pointer might be reset ( ) b 1 () a 3 a3a3 (a 3 ) b 1 () a 3 () a 7 (a 3 ) b 6 (a 7 ) b 11 (b 6 ) d 10 (b 11 ) d 15 (a 3 ) b 1 Inserting the a0 / d2 (OOO) into the right spot and reset RIP (both coming after d15)

22. Using K-Slack  Pros: simple  Cons: big assumption about the input stream Punctuation  Pros: general and more optimization opportunities  Cons: might have overhead Solution in NG / PSSC / PNG: Possible Solutions

23. Solution in NG / PSSC / PNG by K-Slack

24. Solution in NG / PSSC / PNG by Punctuation

25. Punctuation: Range-Out-of-Order-Free Punctuation Range-Out-of-Order-Free (Roof) Punctuation P  time_stamp t  Event type E Property  Total Order in-order events (simply we can just use the timestamp and don’t care the received time)  No contradiction within the punctuations: getting stronger and stronger Example No More out-dated D events will come v d a v d a Time Stamp D_p

26. a If Yes, any d ’ s inside back window? d Punct in PSSC: Back2Front Singleton Purge EVENTSEQ( A, B, D, E ) WITHIN10 Seconds distance (a, D_p) > w?? (D_p.Timestam - a.Timestamp > w) w w

27. Punct in PSSC: Front2Back Singleton Purge A_p a If Yes, any a ’ s inside the front window? d EVENTSEQ( A, B, D, E ) WITHIN10 Seconds d appears infront of A_p? (d.Timestam < A_p.Timestamp ?) w

28. Punct in PSSC: Lazy Purge Algorithm P e e EVENTSEQ ( E1, E2, …, En ) WITHIN10 Seconds P P e e e P Algorithm: Lazy Purging Receiving event e or roof punctuation rp: Event e: updating the stored event sequence and periodically doing ALG purging_event_seq (ROOF_Set, stored event sequence) (2) ROOF rp: updating the ROOF_Set and periodically doing ALG purging_event_seq (ROOF_Set, stored event sequence) Purging event sequence

29. Punct in PSSC: Lazy Purge Algorithm (Cont.) P EVENTSEQ ( E1, E2, …, En ) WITHIN10 Seconds P P e P Algorithm: purging_single_event A single event e and a ROOF_Set: ALG purging_single_event (ROOF_Set, stored event sequence) // sequential checking + dependency checking

30. Punct in PSSC: Lazy Purge Algorithm (Cont.) P e e EVENTSEQ ( E1, E2, …, En ) WITHIN10 Seconds P P e e e P Algorithm: purging_event_sequence Event sequence and roof punctuation rp: ALG purging_event_seq (ROOF_Set, stored event sequence) // by the event order, do purging_single_seq

31. Punct in PSSC: Aggressive Purge Algorithm P e e EVENTSEQ ( E1, E2, …, En ) WITHIN10 Seconds P P e e e P Algorithm: Aggressive Purging Receiving event e or roof punctuation rp: Event e: updating the stored event sequence and periodically doing ALG purging_single_event (ROOF_Set, stored event sequence) (2) ROOF rp: updating the ROOF_Set and periodically doing ALG purging_signle_event (ROOF_Set, stored event sequence) Can drop event directly Purging old sequence

32. Punct in PSSC: Optimization (Cont.) Keeping the purging complete, but smarter  Under construction Making the purging “incomplete”  Singleton purging  Total purging  Density-based purging

33. D_p Furriest D event outside the window d Punct in PSSC: Optimization EVENTSEQ( A, B, D, E ) WITHIN10 Seconds Every A and B event falling in this range can be purged w Singleton Batch Purging 1

34. B_p Furriest B event outside the window b Punct in PSSC: Optimization EVENTSEQ( A, B, D, E ) WITHIN10 Seconds Every D and E event falling in this range can be purged Singleton Batch Purging 2

35. Outline Introduction Preliminary Problem with Out-of-Order Event Arrival Solution Implementation Experiment Conclusion Related Work 1.Sequence Scan 2.Window in Sequence Scan

36. Basic Event Processing  Event and event generator, query plan and plan generator, basic operators Out-of-order Handler  New functionalities of SS: two modes – append and sort (for further possible chance of using punctuation)  New functionalities of the NG and WD operator Implementation: Design

37. Implementation: Design (Cont.) Query Plan Generator NFA Query Event stream generator Query Plan Window SSC tuples Stack maintain state and pointers

38. Outline Introduction Preliminary Problem with Out-of-Order Event Arrival Solution Implementation Experiment Conclusion Related Work 1.Design and Setup 2.Result Analysis

39. Experiment: Design and Setup

40. Experiment: Result Analysis

41. Outline Introduction Preliminary Problem with Out-of-Order Event Arrival Solution Implementation Experiment Conclusion Related Work

42. Conclusion We study the problem with OOO event arrival We propose a solution framework on handling sequence query processing with out-of-order data arrival

43. Outline Introduction Preliminary Problem with Out-of-Order Event Arrival Solution Implementation Experiment Conclusion Related Work

44. Event stream process (SASE system) Regular stream processing system (TelegraphCQ, Eddy, etc. ) Basic event processing (Amit system) Luping Ding ’ s comprehensive exam talk K-slack and punctuation

45. Happy Holiday Season!

46. SS: (A, B, D) TF: sequence to composite event Input Event Stream SC: (A, B, D) SSC WD: D.ts – A.ts < 10 secs PSSC: W = 10 secs ( ts:timestamp ) Q: EVENT SEQ (A, B,!C, D) WITHIN 10 seconds NG:!C(B.time<C.time<D.time)

47. acbadfcd f 356710121315 16 Receiving Order b 1 b 11 (c) Input Event Stream a 3 b 6 d 10 a 7 b 11 d 15 a 3 b 6 d 10 a 3 b 6 d 15 a 3 b 11 d 15 a 7 b 11 d 15 WD TF (d) Producing Result Tuples SSC Input Event Stream Tuples Holding Event Sequences … … f 17 0123 A BD * * [ ] a 3 [ ] a 7 [a 3 ] b 6 [a 7 ] b 11 [b 6 ] d 10 [b 11 ] d 15 S1S2S3 (b) SSC using Active Instance Stacks (a) SSC using Active Instance Stacks

48. SS: (E1,E2,…,Em) TF: sequence to composite event Input Event Stream SSC WD: Em.ts – E1.ts < W SC: (E1,E2,…,Em) Active Instance Stacks (AIS) PSSC: window W PSSC mistakenly purges events from the AIS (events might be used to form out-of- order sequences in the future) 2 3 Unauthorized AIS Purge NG: !C(B.time<C.time<D.time) PNG: window W Unauthorized Negation Buffer Purge NG produces spurious results PNG mistakenly purges events from the Negation Buffer (events might be used to form out-of-order sequences in the future) 1 Output spurious results

49. [] a 3 [] a 7 [a 3 ] b 6 [a 7 ] b 11 [b 6 ] d 10 [b 11 ] d 15 S1S2 S3 [b 11 ] d 8 [] a 3 [] a 7 [a 3 ] b 6 [a 7 ] b 11 [b 6 ] d 10 [b 11 ] d 15 S1 S2 S3 (a) Incorrect AIS Appending Example1 (b) Incorrect AIS Appending Example2 [a 7 ] b 8

50. acbadfcd f 356710121315 16 b 1 b 11 acbadfcd f 356710121315 16 Received Order b 1 b 11 (a) Out-of-Order Event Arrival Example 1 acbadfcd f 356710121315 16 b 1 b 11 (b) Out-of-Order Event Arrival Example 2 (c) Out-of-Order Event Arrival Example 3 c 9 a 0 d 2 d (or b) 8 f 17 f f Received Order Received Order

51. acbadfc d d 356710121315 16 b 1 b 11 acbadfcd d 356710121315 16 Received Order b 1 b 11 (a) Out-of-Order Event Arrival Example 1 acbadfcd d 356710121315 16 b 1 b 11 (b) Out-of-Order Event Arrival Example 2 (c) Out-of-Order Event Arrival Example 3 c 9 a 0 d 2 d (or b) 8 d 17 d d Received Order Received Order