CORE: a Complex Event Recognition Engine

TL;DR

CORE is an efficient complex event recognition engine that uses a novel automaton-based algorithm to handle large data streams, outperforming existing systems by up to five orders of magnitude.

Contribution

The paper introduces CORE, a new CER engine with an automaton-based evaluation algorithm that avoids super-linear partial match growth, enabling constant-time processing per event.

Findings

CORE's performance remains stable across different query and window sizes.

CORE outperforms state-of-the-art CER systems by up to five orders of magnitude.

The engine efficiently handles real-world data streams with large data and query complexities.

Abstract

Complex Event Recognition (CER) systems are a prominent technology for finding user-defined query patterns over large data streams in real time. CER query evaluation is known to be computationally challenging, since it requires maintaining a set of partial matches, and this set quickly grows super-linearly in the number of processed events. We present CORE, a novel COmplex event Recognition Engine that focuses on the efficient evaluation of a large class of complex event queries, including time windows as well as the partition-by event correlation operator. This engine uses a novel automaton-based evaluation algorithm that circumvents the super-linear partial match problem: under data complexity, it takes constant time per input event to maintain a data structure that compactly represents the set of partial matches and, once a match is found, the query results may be enumerated from the data structure with output-linear delay. We experimentally compare CORE against state-of-the-art CER systems on real-world data. We show that (1) CORE's performance is stable with respect to both query and time window size, and (2) CORE outperforms the other systems by up to five orders of magnitude on different workloads.