The talk about "ETALIS Language for Events", given at the RR 2010 conference.

1. A Rule-Based Language for Complex
Event Processing and Reasoning
Darko Anicic, Paul Fodor, Sebastian Rudolph, Roland Stühmer,
Nenad Stojanovic, Rudi Studer
The 4th International Conference on Web Reasoning and Rule Systems,
Bressanone/Brixen, Italy

2. Agenda
 Introduction, Motivation
 ETALIS Language for Events
• Syntax;
• Semantics;
• Experimental Results;
 Conclusion.

3. Complex Event Processing
 How to capture events from event sources; and
transform, combine, interpret and consume them?
Figure source: Opher Etzion & Tali Yatzkar, IBM Research
• Financial services (high frequency trading);
• Sensor networks (wireless and mobile networks);
• Real-Time Web (click stream analysis, processing updates from social
Web apps, on-line advertising).

4. Motivation
Efficient Complex Event Processing
(timeliness & large volume of data are dimensions
of concern)
J. Agrawal, Y. Diao, D. Gyllstrom, and N. Immerman. Efficient pattern matching
over event streams. In SIGMOD (2008).
Y. Mei and S. Madden. Zstream: a cost-based query processor for adaptively
detecting composite events. In SIGMOD (2010)
A. J. Demers, J. Gehrke. Cayuga: A general purpose event monitoring system.
In CIDR, 2007.
N. H. Gehani, Narain H. Composite event specification in active databases:
Model & implementation. In VLDB, 1992.
Current CEP systems, based on DSMS provide on the-fly analysis of
data streams, but cannot combine streams with evolving knowledge, and
they cannot perform reasoning tasks.

5. Motivation
Formal & knowledge-based processing of events
(detect events, context, situation and reason about them)
F. Bry and M. Eckert. Rule-based composite event queries: The language
XChangeEQ and its semantics (2007);
A. Paschke, A. Kozlenkov, and H. Boley. A homogenous reaction rules
language for complex event processing (2007);
G. Lausen, B. Ludäscher, W. May. On Active Deductive Databases: The
Statelog Approach (1996);
E. Behrends, O. Fritzen, W. May, and F. Schenk. Combining ECA rules with
process algebras for the Semantic Web. (2006);
Incremental Reasoning on Streams and Rich Background Knowledge, D. F.
Barbieri, D. Braga, S. Ceri, E. Della Valle, and M. Grossniklaus (2010).
Detection of complex events based on an event-driven and event-
at-a-time (incremental) evaluation remains a challenge.

6. Our Approach
ETALIS
Efficient CEP
w.r.t timeliness
Knowledge-
based
based on: Event-
and data processing of
volumedriven Backwardevents
Chaining Rules
• ETALIS is an inference system for Complex Event Processing;
• Formal semantics to guarantee well defined behaviour;
• Deductive rules to express complex relationships between events,
matching certain temporal, relational or causal conditions;
• Reasoning over streaming events w.r.t contextual (background)
knowledge, a current state etc.;
• ETALIS suitable for: enrichment of events with background
information; detection of more complex situations and intelligent
recommendations in real-time; or for accomplishing complex event
classifications, clustering, and filtering.

7. Agenda
 Introduction, Motivation
 ETALIS Language for Events
• Syntax;
• Semantics;
• Experimental Results;
 Conclusion.

8. ETALIS: Language Syntax
ETALIS Language for Events is formally defined by:
• pr - a predicate name with arity n;
• t(i) - denote terms;
• t - is a term of type boolean;
• q - is a nonnegative rational number;
• BIN - is one of the binary operators:
SEQ, AND, PAR, OR, EQUALS, MEETS, STARTS, or FINISHES.
Event rule is defined as a formula of the following shape:
where p is an event pattern containing all variables occurring in

9. ETALIS: Interval-based Semantics

10. ETALIS: Declarative Semantics

11. ETALIS: Declarative Semantics

12. ETALIS: Declarative Semantics

13. ETALIS: Operational Semantics (SEQ)
1. Complex pattern (not
a SEQ b SEQ c → ce1
event-driven rule)
((a SEQ b) SEQ c) → ce1 2. Decoupling
a SEQ b → ie1 3. Binarization
ie1 SEQ c → ce1
4. Event-driven backward
chaining rules
action action action
1 3 action action action
2
1 2 3
⊗ e2⊗ e3⊗
e1 e1⊗ e2⊗ e3⊗
e5
⊗
e4 ⊗
a b c d a b c d

14. Evaluation Tests I
Test patterns:
Intel Core Quad CPU Q9400 2,66GHz, 8GB of RAM, Vista x64;
ETALIS on SWI Prolog 5.6.64 and YAP Prolog 5.1.3 vs. Esper 3.3.0
Throughput vs. Predicate Selectivity (Sequence)
Throughput vs. Stream Size (Sequence) Esper 3.3.0 P-SWI P-YAP
Throughput vs. Workload Change (Sequence)
500
Esper 3.3.0 P-SWI P-YAP Esper 3.3.0 P-SWI P-YAP
450
Throughput (1000 x Events/Sec)
Throughput (1000 x Events/Sec)
35 30
400
Throughput (1000 x
30 350 25
Events/Sec)
25 300 20
20 250
15
200
15
10
150
10
100 5
5
50 0
0 25 50 75 100
0
25 50 75 100
10% 50% 100% Event stream size x 1000
Event stream size x 1000 Predicate selectivity
Figure 3: Sequence - (a) Throughput (b) Throughput vs. Predicate
Selectivity (c) Throughput vs. Workload Change

15. Evaluation Tests II
Throughput vs. Negation Selectivity Throughput vs. Workload Change (Negation) Throughput vs. Workload Change (Conjunction)
Esper 3.3.0 P-SWI P-Yap Esper 3.3.0 Etalis - SWI Etalis - Yap
Esper 3.3.0 P-SWI P-Yap
50 40
45
Throughput (1000 x
Throughput (1000 x
45
Throughput (1000 x
40 35
40
Events/Sec)
Events/Sec)
35 30
Events/Sec)
35
30 25
30
25 25 20
20 20 15
15 15
10
10
10
5 5 5
0 0 0
10% 50% 100% 25K 50K 75K 100K 25K 50K 75K 100K
Selectivity of negated events Event stream size Event stream size
Figure 4: Negation - (a) Throughput vs. Selectivity (b) Throughput vs.
Workload Change (c) Conjunction - Throughput

16. Evaluation Tests III
Computation Sharing (Sequence)
Throughput vs. Workload Change (Disjunction) Throughput for Transitive Closure
Esper 3.3.0 P-SWI P-Yap
Esper 3.3.0 P-SWI P-Yap Throughput (100 x Events/Sec) Esper 3.3.0 P-SWI P-Yap
30 100
30
Throughput (1000 x
25 25
80
Throughput (1000 x
Events/Sec)
20 20
Events/Sec)
60
15 15
40
10 10
20
5 5
0 0 0
25K 50K 75K 100K 2500 5000 7500 10000 1 8 16
Event stream size Event stream size Number of queries
Figure 5: (a) Disjunction-Throughput (b) Transitive Closure (c) Plan
Sharing

17. Agenda
 Introduction, Motivation
 ETALIS Language for Events
• Syntax;
• Semantics;
• Experimental Results;
 Conclusion.

18. Conclusion: A Common Framework for Event
Processing in ETALIS
ETALIS
A Reasoning
Integration
deductive over A general
with the
rule streaming and
domain
framework data to extensible
knowledge
with event- detect framework
and
at-time complex for CEP
databases
processing situations
ETALIS: A Common Framework for Event Processing
18

19. Thank you! Questions…
ETALIS
Open source:
http://code.google.com/p/etalis
See also our live DEMO at:
http://krake26.perimeter.fzi.de:8080/etalis
Darko.Anicic@fzi.de