Time/Space Aware Event Correlation

Introduction

We envision event correlation in a publish/subscribe system becoming important. A publish/subscribe system may offer content-based filtering, which allows subscribers to declare their interests in the attribute values of events using a flexible subscription language, while event correlation addresses the relationships among event instances of different event types. Especially with a dramatic increase in the event monitoring capabilities of wireless devices and sensors, selective data dissemination in publish/subscribe systems requires more complex temporal and spatial resolution in event correlation.

Sensor technology enables monitoring of the environment that may trigger the operation of subsequent services. An example of such a subscription is ‘Notify’ the products in the store that become on sale with 30% discount price within 50 minutes after the total number of customers in the store reaches 120. This subscription may not be described by filtering, where an exact temporal constraint (e.g., time instant, time interval) is expected. A time interval is relative to a time point (e.g., 50 minutes after the number of customers reaches 120). Thus, it is desirable that the semantics of filtering and correlation can be defined together.

Wireless Sensor networks (WSNs) raise new issues to be addressed such as data aggregation and an operation dealing with redundancy, summarisation, and quality control of data in the network. Figure 1 shows the relationships between aggregation, filtering and correlation. For example, some conditions/values being sensed last longer than the sensing interval, which causes repetitive event reports. Similarly, the same events will be reported by several spatial groups, if the size of the detection group is too small. Another characteristic of WSNs is that they aim to link the real and virtual worlds. Events tie the two worlds together, and relevant state changes in the real world have to be detected and signalled to the virtual world by generating appropriate events. Note that sensors can detect state changes in the real world, but low-level sensor information is often not directly useful. Typically, raw sensor input is therefore processed and combined to form high-level events that model real world actions.

Figure 1.

Filtering, correlation and aggregation

We envision supporting more sophisticated and unambiguous event correlation over time and space. Spatio-temporal queries may contain changes in both object and query locations over time. For example:

• •

  Moving queries on stationary objects: as I am moving along a certain route, show me all gas stations within 3 minutes of my location.

• •

  Stationary queries on moving objects: how many speeding cars are within the city boundary.

• •

  Moving queries on moving objects: as the President moves make sure that the number of security guards within 50 metres of his/her location is more than 50.

Event Correlation will be a multi-step operation from event sources to the final subscribers, combining information collected by wireless devices into higher-level information or knowledge. Distributed events are fragmented and dispersed among various devices, services, and agents, and interpretation of events can occur at any time and any location. Events flow based on queries to databases, subscriptions, notifications, and search results over the networks.

In this chapter, we look closely into events and find out how their semantics and representation should be defined. Events contain multidimensional attributes and should be well indexed for searching and complex correlation. Besides the existing attributes of events, it will be crucial to incorporate continuous context information such as time or geographic location within an event model. Defining an unambiguous event model provides a common interface for event correlation. We then introduce a novel and generic interval-based semantics for composite event detection. This precisely defines complex timing constraints among correlated event instances. The described durative event model, combined with interval-semantics, provides a new vision for data processing. This extends the functionality of simple publish/subscribe filters to enable stateful subscriptions, parameterisation, and computation of aggregates.