Complex Event Processing for Sensor Stream Data - MDPI

Download PDF
1 downloads 0 Views 4MB Size Report
Comment
Sep 13, 2018 - Things environment, studies on complex event processing have been ...... CEP distributed processing methods for processing large sensor stream data. ... High Performance Visual Big Data Discovery Platform for Large-Scale.
sensors Article

Complex Event Processing for Sensor Stream Data Kyoungsoo Bok 1 , Daeyun Kim 2 and Jaesoo Yoo 1, * 1 2

*

Department of Information and Communication Engineering, Chungbuk National University, Chungdae-ro 1, Seowon-Gu, Cheongju, Chungbuk 28644, Korea; [email protected] Department of Big Data, Chungbuk National University, Chungdae-ro 1, Seowon-Gu, Cheongju, Chungbuk 28644, Korea; [email protected] Correspondence: [email protected]; Tel.: +82-43-261-3230

Received: 12 August 2018; Accepted: 11 September 2018; Published: 13 September 2018

 

Abstract: As a large amount of stream data are generated through sensors over the Internet of Things environment, studies on complex event processing have been conducted to detect information required by users or specific applications in real time. A complex event is made by combining primitive events through a number of operators. However, the existing complex event-processing methods take a long time because they do not consider similarity and redundancy of operators. In this paper, we propose a new complex event-processing method considering similar and redundant operations for stream data from sensors in real time. In the proposed method, a similar operation in common events is converted into a virtual operator, and redundant operations on the same events are converted into a single operator. The event query tree for complex event detection is reconstructed using the converted operators. Through this method, the cost of comparison and inspection of similar and redundant operations is reduced, thereby decreasing the overall processing cost. To prove the superior performance of the proposed method, its performance is evaluated in comparison with existing methods. Keywords: complex event; similar operation; redundant operation; query tree; event detection

1. Introduction Due to the trend of miniaturization and price drop of communication modules, communication among objects in daily life is now possible. Along with this trend, environments where things can create and share information are provided due to the penetration of intelligent digital devices. As things such as vehicles, refrigerators, bicycles and even shoes are now able to communicate, new information technology services are emerging. The Internet of Things (IoT) is intelligent networking where a variety of things are connected to wired and wireless networks and collect and share information for interaction [1–3]. Through the IoT, information can be created, collected and shared organically, as everything including people, surrounding things and data are connected through the network. Sensor network technology is essential to create, collect and exchange information for things over the IoT environment [4–6]. Physical states and surrounding environment information are collected by attaching sensors to various things, and information is transmitted among things using the sensor network technology. A technology that can process or analyze big data collected through the sensor network technology is required to provide intelligent services in the IoT environment [7–11]. In the IoT environment, sensor networks can be used to determine future predictions and trends by detecting physical situations or analyzing collected information. Recently, time-critical applications have been developing to analyze data sensing from multiple sources in order to respond in real time in case of abnormal and dangerous situations in the areas of disaster safety, manufacturing, transportation and communication [12–14]. For example, manufacturers are building smart factories that collect and

Sensors 2018, 18, 3084; doi:10.3390/s18093084

www.mdpi.com/journal/sensors

Sensors 2018, 18, 3084

2 of 16

analyze product production data, environmental data and so on to determine if defective products have occurred or to detect hazardous situations in a factory. In transportation, intelligent traffic services are being developed to recognize situations around vehicles and roads through sensors and to provide vehicles and pedestrians with a risk alert service in the case of a hazardous or sudden event. A large number of studies have been conducted to process or analyze stream data generated through numerous sensors in real time [15–18]. In particular, a complex event processing (CEP) method has been developed to remove unnecessary information from a large amount of stream data generated through sensors or to detect information that is required only for a specific application [19–21]. Generally, data processing is conducted by storing collected data in disks followed by batch processing to create needed information. Thus, real-time processing is not appropriate since processing delay occurs if a large amount of stream data is generated through sensors [22–24]. CEP analyzes real-time stream data that are generated continuously, thereby delivering required information selectively once users or application requirements are inputted as a continuous query form [25–27]. CEP utilizes in-memory-based processing and event-driven architecture (EDA) to process stream data in real time generated from sensor networks [28–30]. In CEP, stream data generated through sensors are defined as primitive events, which are then combined through various operators to detect meaningful events to users or applications. In stream-based and shared event (SASE) processing, complex events are expressed in the automata form, and complex events are stored in a stack as primitive events and connected by pointers based on the occurrence time [31,32]. However, complex events consisting of the same primitive events are processed redundantly, which increases processing time. In the Radio frequency identification (RFID) complex event detection algorithm (RCEDA), a pattern of complex events is configured as a graph form, and all primitive events are delivered to parent nodes of the graph, thereby performing an operation that compares the conditions [33]. However, if primitive events that require similar operations are introduced, the operation for each event is processed individually, thereby increasing computational load. Siddhi can reduce processing amount, since it can process redundant operations into a single operation using a pipeline format. However, it has a problem of increasing computational load as well due to individual processing of a large number of similar operations. This paper presents an efficient CEP method considering similar and redundant operations on sensor stream data. The proposed method generates an event query tree and detects similar and redundant operations by circulating the tree to detect complex events, which is similar to the structure of RCEDA. The similar operations that perform similar comparison operations or operations that are interrelated with common events are combined by a single virtual operator for processing. The redundant operations (i.e., those that perform the same operations on the same events) are processed by a single operation. Once a primitive event occurs, the hash table is searched and the primitive event is delivered to the event query tree to detect a complex event. Since a virtual operator expresses a number of operations that perform similar operations, it expresses event occurrences through bits, and when events that satisfy the condition occur, the events are delivered to the parent node for the next operation. This paper is organized as follows. In Section 2, related study trends and issues are described. In Section 3, the proposed method is described in detail, and in Section 4, performance evaluation is conducted to prove the superiority of the proposed method. Finally, in Section 5, conclusions and future research are presented. 2. Related Works RFID is a technology used to identify and track objects in logistics and supply chain management, retail, healthcare, factory automation and security [34–36]. The objects with attached RFID tags are automatically identified by RFID readers. The RFID reader sends energy via RF signal to the tag, and the tag sends back a modulated signal. RFID readers can sense a number of RFID tags at the same time. RFID uses short-range radio technology to transfer data between the readers and tags.

Sensors 2018, 18, 3084

3 of 16

Since RFID streams can be continuously generated, CEP is required to detect meaningful events in RFID streams. RFID events are divided into primitive events and complex events in CEP. A primitive event is an RFID tag sensed by an RFID reader. A complex event is a composite event which consists of primitive events for applications or users [33,37]. SASE is a method to filter RFID data, monitor interrelated patterns, and detect meaningful information [31,32]. SASE consists of event patterns of complex events, conditions (where), and time intervals (within). The event pattern is a combination of primitive events, which are combined through AND, OR, NOT, and SEQ operators. To select events, sequence scan and construction (SSC), selection, within, and negation (NG) operations are performed. The SSC operation configures events in the automata form, and stores occurring events in the stack through sequential scan. A state of automata changes according to the sequential occurrence of primitive events. In SASE, even the operations consisting of the same primitive events are processed individually. Thus, it has a problem of increased overall computational load due to redundant inspection when processing similar or redundant operations. RCEDA is a RFID complex event-processing method using a graph-based computation model. RCEDA presents the definition rules and processing method to process complex events efficiently [33]. RCEDA employs primitive operations such as AND, OR and NOT, and additional operators such as SEQ, TSEQ, SEQ+ and TSEQ+ to configure complex events. The complex event is constructed by combining operator trees and primitive events. In the leaf node of the tree, a primitive event is positioned, and in the non-leaf node, an operator that connects events is positioned. Once the event in the leaf node matches the condition, it is transferred to an operator in the parent node, and if the event matches the condition of the operation in the root node, it is detected as a complex event. In the case of the NOT operation, an event cannot be detected in the corresponding operator. Thus, a virtual node is made in the upper hierarchy, and if the condition in the virtual node is satisfied in the NOT operator in the lower hierarchy, the event is delivered to the parent node. In RCEDA, complex events are registered as a graph form, and all occurred primitive events are delivered to the parent node, thereby performing the complex event processing. Siddhi consists of operations connected through the event queue, and operations are processed through the pipeline mode [38]. The system consists of an event queue that stores data, and processors that process input events. Once the primitive event is received through the input adapter, the model is changed into the common data model. Each processor consists of executors, and each executor processes the received events. Once the event that matches the condition occurs, the next step is performed through the pipeline processing using the publication/subscription model. Siddhi uses similar queries employed in the SQL, and constructs a query tree followed by performing optimization. In the Siddhi system, redundant subqueries are processed simultaneously to reduce the computational load. The bitmap index-based CEP method processes complex events using a trigger according to whether events occur or not [37]. In the above method, even if all events that make up the complex events do not occur, operations continue for partially occurred events, thereby performing a large number of operations and consuming a large amount of memory space. To solve this problem, the bitmap index-based CEP method does not process all events that have occurred in a large amount of stream data, but complex events are processed only when events that correspond to complex events registered in the application layer occur. However, this has the problem that computational load is not reduced significantly, since no consideration is given to operators at all in the case of complex events consisting of the same primitive events. In [37], the complex events is detected only when the minimum conditions for processing of events with regard to RFID stream data are satisfied. To inspect the minimum conditions of events, complex events are registered in the grid index, and they are extracted using the query indexes and bitmap. It only compares whether primitive events that make up the complex events occur or not, and when all primitive events that make up the complex events occur, the event detection operation is performed. However, since complex events, which have

Sensors 2018, 18, 3084

4 of 16

Sensors 2018, 18, x FOR PEER REVIEW 4 of 16 similar operations, have redundant searches for events stored in the bitmap, the problem of increased computational load is incurred. Since the existing methods cannot process events by sharing similar operations as one, they Since the existing methods cannot process events by sharing similar operations as one, they have have a drawback of increasing computation due to individual processing of events that have a drawback of increasing computation due to individual processing of events that have operations operations of similar patterns. They also have no consideration about redundant operations that of similar patterns. They also have no consideration about redundant operations that have the same have the same primitive events. Due to this drawback, computations to process complex events from primitive events. Due to this drawback, computations to process complex events from a voluminous a voluminous data stream are increased significantly, and completion time is delayed because events data stream are increased significantly, and completion time is delayed because events cannot be cannot be processed in a given time. Thus, a study on reduction of overall computational load is processed in a given time. Thus, a study on reduction of overall computational load is needed in needed in consideration of cases where primitive events that make up the complex events have consideration of cases where primitive events that make up the complex events have similar and similar and redundant operations. redundant operations.

3. Complex Complex Event Event Processing Processing 3. 3.1. Overall Overall Procedure Procedure 3.1. The existing existing CEP CEP methods methods require require aa large large amount amount of of comparison comparison and and inspection inspection cost, cost, since since they they The individually process process similar similar and and redundant redundant operations operations that that process process the the same same event event when when aa large large individually amount of stream data is generated in real time through sensors. Thus, a study on processing a large amount of stream data is generated in real time through sensors. Thus, a study on processing a large amount of of complex complex events events rapidly rapidly is is needed needed for for reducing reducing the the computational computational load load of of complex complex event event amount detection. The CEP method method that that reduces reduces the the processing processing cost cost of of similar similar detection. The proposed proposed method method is is aa new new CEP and redundant operations. In this method, the execution plan for the detection of complex events is and redundant operations. In this method, the execution plan for the detection of complex events is converted into into aa tree, tree, and and an an event event query query tree tree is is reconstructed reconstructed with with regard regard to to similar similar and and redundant redundant converted operations. Similar single virtual virtual operator operator to to determine determine whether whether the the operations. Similar operations operations are are expressed expressed as as aa single event occurs or not. event occurs or not. Figure 11 shows shows the the overall overall processing processing procedure procedure for for complex complex events. events. Once user or or specific specific Figure Once aa user application registers a query to detect a complex event, an event query tree is created to process the application registers a query to detect a complex event, an event query tree is created to process event. In the operator identification, the event query tree is traversed to determine whether the event the event. In the operator identification, the event query tree is traversed to determine whether the is similar or redundant. The The similar operation is changed into a asingle the event is similar or redundant. similar operation is changed into singlevirtual virtualoperator, operator, and and the redundant operation is converted into a single operation to reconstruct the event query tree. Once redundant operation is converted into a single operation to reconstruct the event query tree. Once aa primitive event event occurs occurs through through sensors, sensors, errors errors or or redundant redundant data data are are filtered. filtered. The The complex complex event event primitive detection determines determines whether whether the the primitive primitive event event satisfies satisfies the the complex complex event event condition condition after after event event detection filtering. Here, the reconstructed event query tree is employed to determine whether the complex filtering. Here, the reconstructed event query tree is employed to determine whether the complex event condition condition is is met. met. Once Once the the complex complex event event is is detected, detected, the the event event information information is is transmitted transmitted to to event the user. the user.

procedure. Figure 1. Overall complex event processing procedure.

3.2. 3.2. Complex Complex Event Event Registration Registration The through sensors in the IoT IoT environment is defined as a primitive event, The input inputstream streamcollected collected through sensors in the environment is defined as a primitive and a complex event is inferred by a query requested from a specific user and application to detect event, and a complex event is inferred by a query requested from a specific user and application to meaningful information or remove unnecessary information. The The primitive event is expressed as detect meaningful information or remove unnecessary information. primitive event is expressed raw data collected through sensors at at a specific period of of time, which is is represented asas < e,et,, t ,vv >.. as raw data collected through sensors a specific period time, which represented Here, e refers to a sensor identifier as a primitive event type, t refers to a time that collected the primitive event, and v refers to a value collected through the sensor. The primitive event means the original data collected through the sensor itself. Each data collected by each sensor is defined as a

Sensors 2018, 18, 3084

5 of 16

Here, e refers to a sensor identifier as a primitive event type, t refers to a time that collected the primitive and v refers to a value collected through the sensor. The primitive event means Sensors 2018,event, 18, x FOR PEER REVIEW 5 ofthe 16 original data collected through the sensor itself. Each data collected by each sensor is defined as a primary primary event event and and used used as as input input data data for for complex complex event event processing. processing. Complex Complex events events are are generated generated by by aa combination combination of of primitive primitive events events to to create create or or extract extract meaningful meaningful information information needed by a user user or or application. application. Various event event operators operators are are used used to to generate generate composite composite events events in in combination combination with with primitive event operator, thethe operator defined in RCEDA is used thisin study define primitiveevents. events.For Forthe the event operator, operator defined in RCEDA is in used this to study to the complex event. event. define the complex A A user user and and application application registers registers aa complex complex event event that that combines combines primitive primitive events events generated generated in in real real time time through through sensors sensors as as aa type type of of continuous continuous query. query. The The event event query tree is is created created to to detect detect whether whether the the registered registeredcomplex complexevent eventoccurs occursor or not. not. The The event event query query tree tree consists consists of of the the combination combination of primitive event ofof RCEDA. A primitive event is stored in the of event and andoperator, operator,which whichisissimilar similartotothat that RCEDA. A primitive event is stored in leafleaf node in the tree, and operators for the the node in the tree, and operators forevent eventcombination combinationororcombined combinedevents events are are stored stored in the internal node. node. Once the event query tree is created, created, the the tree tree is is in-order in-order traversed traversed to to detect detect similar similar and and internal redundant operations, operations,thereby therebycreating creatinga complex a complex event information table (CEIT). CEIT stores redundant event information table (CEIT). TheThe CEIT stores the the operator’s address, operation type, parent node address. Figure 2 shows event query operator’s address, operation type, andand parent node address. Figure 2 shows thethe event query treetree of of complex event Q. When event query is created, the tree is in-order traversed numbers complex event Q. When the the event query treetree is created, the tree is in-order traversed and and numbers one one to nine are assigned according theorder visit order the internal node. In addition, information to nine are assigned according to thetovisit of the of internal node. In addition, information about about the visited is stored in the CEIT. the visited node isnode stored in the CEIT.

Figure 2. 2. Complex Complex event event query query tree. tree. Figure

3.3. 3.3. Operator Operator Identification Identification Since Since aa number number of of operators operators are are contained contained in in aa complex complex event, event, the the comparison comparison and and inspection inspection costs increase if similar and redundant operations are processed individually. To solve costs increase if similar and redundant operations are processed individually. To solve this this problem, problem, similar operations are are detected detected and and their their operators operatorsare areconverted. converted.InInthis this paper,a similar and and redundant redundant operations paper, aredundant redundantoperation operationisisdefined definedwhen whenthe thenumber numberof ofthe thesame same operators operators is is one one or or more more in the in the same same event, and a similar operation is defined when interrelated operations or similar comparison operations event, and a similar operation is defined when interrelated operations or similar comparison are performed regardwith to the same to event. operations are with performed regard the same event. Table 1 presents a type of similar operations. OA refers to to a case where OROR andand AND operations are Table 1 presents a type of similar operations. OA refers a case where AND operations processed simultaneously with regard the same event; SS refers to aSScase where earlier-occurred are processed simultaneously with to regard to the same event; refers to the a case where the operation performs the same two SEQ operations; and OS refers to a case where the earlier-occurred earlier-occurred operation performs the same two SEQ operations; and OS refers to a case where the event in the SEQ event operation performs an OR operation. In the operation, when of the events earlier-occurred in the SEQ operation performs an OR OA operation. In the OAone operation, when consisting OR operations the event isoccurs, transmitted to the node.toInthe contrast, one of the of events consisting occurs, of OR operations the event is higher transmitted higherwhen node.all In events in the AND operation occur, the events are transmitted to the parent node. That is, when one of contrast, when all events in the AND operation occur, the events are transmitted to the parent node. the that participates in OR and operations occurs, event occurrence is transmitted Thatevents is, when one of the events that AND participates in OR and the AND operations occurs, the event to the parent node in the case of OR operation and the occurrence of the previous event is setofbythe a occurrence is transmitted to the parent node in the case of OR operation and the occurrence previous event is set by a bit. In the case of AND operation, only when related other events occur is the result transmitted to the parent node for processing. Since the SEQ operation takes the occurrence order of events into account, the result of SS is delivered to the parent node depending on whether the other event occurs or not while the one event that shall occur first between two SEQ

Sensors 2018, 18, 3084

6 of 16

bit. In the case of AND operation, only when related other events occur is the result transmitted to the parent node for processing. Since the SEQ operation takes the occurrence order of events into account, the result of SS is delivered to the parent node depending on whether the other event occurs or not while the one event that shall occur first between two SEQ events has already occurred in the node. The result of the OR operation is transferred to the parent node if the precedent event in the SEQ operation is one of the events that should be processed in the OR operation, and the result of the SEQ operation is delivered to the parent node if the event that participated in the SEQ operation occurs. Table 1. Similar operations on the same primitive events. Similar Operation

Participated Operation

Description When events that are contained in the OR and AND operations are the same

OA

E1 ∨ E2

E1 ∧ E2

SS

E1 ; E2

E1 ; E3

When a precedent event occurs between events included in two SEQ operations

OS

E1 ∨ E2

E1 ; E3

When a precedent event in the SEQ operation among the events included in the OR and SEQ operations is included in the OR operation

The similar and redundant operations are detected while performing in-order traversal over the event query tree. Here, the CEIT created in the complex event registration process is used. Table 2 presents the similar operation detection results, and Table 3 presents the redundant operation detection results. OA and OS are detected as similar operations when there is an event query tree shown in Figure 2. The AND and OR operations that can be combined as the similar operation OA, and OR and SEQ operations that can be combined as the similar operation OS, are detected. As presented in Table 3, the same operation on E1 and E3 events is performed in Nodes 2 and 8, and it is detected as the redundant operation. Table 2. Similar operation detection results. Similar Operation OA(1, 6) OS(3, 7)

Participated Operation E1 ∨ E2 E1 ∧ E2

Parent Node 4 9

E4 ∨ E5 E4 ; E6

4 9

Table 3. Redundant operation detection results. Redundant Operation SO(2, 8)

Participated Operation E3 ; E1

Parent Node 4, 9

3.4. Reconstruction of Event Query Tree The event query tree is created to detect complex events once they are registered. The previously created event query tree is reconstructed based on the similar and redundant operation detection results to reduce the processing cost. In the event query tree, similar and redundant operations are converted into a single operator to reduce the comparison and inspection cost. Similar operations are converted into a virtual operator, and redundant operations are represented by a single operator. A virtual operator is expressed in the lowest node number among the unique numbers in the nodes related to the similar operations. In addition, the Event Occurrence Information Table (EOIT) is created to determine whether a related event occurs or not in the virtual operator where two or more operations are combined. In the EOIT, the Occurrence Bit (OB), which represents an operation to be performed according to the event occurrence, and Parent node Address (PA), where the next operation process is performed, are stored.

Sensors 2018, 18, 3084

7 of 16

Sensors 2018, 18, x FOR PEER REVIEW SensorsFigure 2018, 18,3xshows FOR PEER theREVIEW reconstructed

7 of 16

7 of 16 results of the event query tree shown in Figure 2. The similar operations aredetection. processedInwith single virtual operator reduceoperator, the comparison operation during during event the anode that represents thetovirtual the EOIT is storedcost together, during event detection. In the node that represents the virtual operator, the EOIT is stored together, event the operator, EOIT to is stored together, and the and thedetection. number In of the bitsnode equalthat to represents the number ofvirtual primitive eventsthe related the virtual operator is and the number of bits equal to the number of primitive events related to the virtual operator is number of bits equal to the number of primitive events related to the virtual operator is assigned to assigned to the EOIT. Since the number of primitive events of operations in the virtual operation assigned to the EOIT. Since the number of primitive events of operations in the virtual operation the EOIT. Since the number of primitive events of operations in the virtual operation OA(1,6) is two, OA(1,6) is two, the bit that represents the occurrence is set to two, and the address of the higher node OA(1,6) is two, the bit that represents the occurrence is set to two, and the address of the higher node the bitthe thatnext represents thewill occurrence is set to andSince the address of the higher node where the next where operation be performed is two, stored. the virtual operation OS(3,7) is related to where the next operation will be performed is stored. Since the virtual operation OS(3,7) is related to operation will be performed is stored. Since the virtual operation OS(3,7) is related to three events, three events, the bit that represents the occurrence is set to three. Nodes 2 and 8 are redundant three events, the bit that represents the occurrence is set to three. Nodes 2 and 8 are redundant the bit thatwhere represents the occurrence is set to Nodes andand 8 areE redundant operations where operations the same SEQ operation is three. performed in2 E . To reduce the processing operations where the same SEQ operation is performed in E11 and E33 . To reduce the processing the same SEQ operation is performed in E and E . To reduce the processing cost of the redundant 3 1 cost of the redundant operations, the operation of Nodes 2 and 8 is expressed as SO(2,8). cost of the redundant operations, the2 operation of Nodesas2 SO(2,8). and 8 is expressed as SO(2,8). operations, the operation of Nodes and 8 is expressed

Figure 3.3.Reconstruction of the event query tree using virtual operation. Figure3. Reconstructionof ofthe theevent eventquery querytree treeusing usingvirtual virtualoperation. operation. Figure Reconstruction

As presented in Table 2, since Nodes and perform the OR and AND operations on the same Aspresented presentedin inTable Table2, 2, since sinceNodes Nodes111and and666perform performthe theOR ORand andAND ANDoperations operationson onthe thesame same As E11 and E events and , virtual operator OA(1,6) is created. Figure 4 shows the reconstructed results of events E E , virtual operator OA(1,6) is created. Figure 4 shows the reconstructed results of 2 2 2 , virtual operator OA(1,6) is created. Figure 4 shows the reconstructed results the events E1 and E of the event query tree through the virtual operator OA(1,6). The operation of Node 1 in the event event query tree tree through the virtual operator OA(1,6). The operation of Nodeof 1 in the event query tree the event query through the virtual operator OA(1,6). The operation Node 1 in the event query tree is to modified toand OA(1,6), and the operation of Node 6 isOnce deleted. Once the event is inputted, is modified OA(1,6), the operation of Node 6 is deleted. the event is inputted, the event query tree is modified to OA(1,6), and the operation of Node 6 is deleted. Once the event is inputted, the event occurrence is expressed by the bit in the OB, and when the event that matches the occurrence is expressed the bit inby thethe OB,bit and the and event that matches thethat operation occurs, the event occurrence is by expressed in when the OB, when the event matches the E1 result operation occurs, the next execution request is given to the parent node address. Once E and Eof the next execution request is given to the parent node Once E1address. and E2 occur, 2 operation occurs, the next execution request is given to address. the parent node Once the 1 and E2 the ORthe operation delivered to theisparent node. other events occur in addition to theinevent that occur, result of is the OR operation delivered to If the parent node. If other events occur addition occur, the result of the OR operation is delivered to the parent node. If other events occur in addition satisfies the OR theOR AND operation condition is checked and the is next execution to the event thatoperation, satisfies the operation, the AND operation condition checked and request the nextis to the event that satisfies the OR operation, the AND operation condition is checked and the next given to all the parent nodes of the OR andnodes AND of operations. execution request is given to all parent the OR and AND operations. execution request is given to all the parent nodes of the OR and AND operations.

Figure4.4.Creation Creationof ofvirtual virtualoperator operatorOA(1,6). OA(1,6). Figure Figure 4. Creation of virtual operator OA(1,6).

In the similar operation OS(3,7), as presented in Table 2, in the SEQ operation in Node 3 and the In the similar operation OS(3,7), as presented in Table 2, in the SEQ operation in Node 3 and the OR operation in Node 7, the precedent event in the SEQ operation is included in the OR operation. OR operation in Node 7, the precedent event in the SEQ operation is included in the OR operation. Thus, the SEQ operation in Node 3 and the OR operation in Node 7 can be combined to represent Thus, the SEQ operation in Node 3 and the OR operation in Node 7 can be combined to represent

Sensors 2018, 18, 3084

8 of 16

Sensors In 2018, x FOR PEER REVIEW the18,similar operation OS(3,7),

8 of the 16 as presented in Table 2, in the SEQ operation in Node 3 and 8 of 16 event in the SEQ operation is included in the OR operation. OS(3,7), as SEQ shown in Figure The 3virtual operator OS(3,7)inisNode stored7 in 3, whoseto number is Thus, the operation in 5. Node and the OR operation canNode be combined represent OS(3,7), as shown in Figure 5. The virtual operator OS(3,7) is stored in Node 3, whose number is E E E lower, and Node 7 is deleted. Since events , and are related in the virtual operator 4 OS(3,7) 5 6 OS(3,7), as shown in Figure 5. The virtual operator is stored in Node 3, whose number is lower, EEOIT, E5 and E6 an lower, and 7 isassigned deleted. events andonce areevent related inmatches the OS(3,7), virtual operator 4 ,are OS(3,7), three are toSince theEOB of the that the operation and Node 7Node isbits deleted. Since events , E and E related in the virtual operator three bits 5 6 4 OS(3,7), three bits are assigned to the OB of the EOIT, and once an event that matches the operation condition occurs, the OB is checked before the transfer to the parent node. are assigned to the OB of the EOIT, and once an event that matches the operation condition occurs, condition OB isthe checked before transfer to the parent node. the OB is occurs, checkedthe before transfer to thethe parent node. Sensors 2018, 18, x FOR PEER REVIEW OR operation in Node 7, the precedent

Figure 5. Creation of virtual operator OS(3,7). Figure5.5.Creation Creationofofvirtual virtualoperator operatorOS(3,7). OS(3,7). Figure

The SS operation is related to two SEQ operations. Assuming that two SEQ operations are SSEoperation operation is related tototwo operations. Assuming thatthat two SEQ operations are E3are ;as E5 The SS twoSEQ SEQ operations. Assuming two SEQ E3 ; E5 The and that shall occur first in both of the two SEQoperations operations 3 ; E1 , thenisErelated 3 is an operation and E ; E , then E is an operation that shall occur first in both of the two SEQ operations as shown in 3 3 1 E3 ; E1 , then E3 is an operation that shall occur first in both of the two SEQ operations as E3 ; E5 and shown in Figure 6a. Thus, virtual operator SS(1,2) is created for the two SEQ operations, as shown in Figure 6a. Thus, virtual operator SS(1,2) is created for the two SEQ operations, as shown in Figure 6b. shown Thus, virtual operator SS(1,2) is5 ,created fornext the two SEQ operations, as shown in Figure in 6b.Figure If E3 6a. occurs first followed by E then the execution request is given to the 1 or E If E3 occurs first followed by E1 or E5by , then the Enext execution request is given to the parenttonode E E Figure 6b. If occurs first followed or , then the next execution request is given the 3 5 parent node stored in the PA of the EOIT. 1 stored in the PA of the EOIT. parent node stored in the PA of the EOIT.

(a) Two SEQ operators. (a) Two SEQ operators.

(b) SS(1,2) (b) SS(1,2) Figure 6. Creation of virtual operator SS(1,2). Figure 6. Creation of virtual operator SS(1,2). Figure 6. Creation of virtual operator SS(1,2).

Since the same operation is performed with regard to the same events in the redundant Since the is performed with to regard to the same events operation in the redundant operations, thesame eventoperation query tree is restructured perform only a single for two operations, the event query tree is restructured to perform only a single operation for two

Sensors 2018, 18, 3084

9 of 16

SensorsSince 2018, 18, FOR PEER REVIEWis performed with regard to the same events in the redundant operations, 9 of 16 thex same operation

the event query tree is restructured to perform only a single operation for two operations. If the query operations. If the query is modified to perform a single operation for the redundant operations, the is modified to perform a single operation for the redundant operations, the next execution operation next execution operation should be processed individually. For example, although Nodes 2 and 8 are should be processed individually. For example, although Nodes 2 and 8 are redundant operations redundant operations in Table 3, the execution operation that follows Node 2 is different from that in Table 3, the execution operation that follows Node 2 is different from that following Node 8. following Node 8. Thus, addresses of all nodes where the next operation will be performed should Thus, addresses of all nodes where the next operation will be performed should be stored. Nodes 2 be stored. Nodes 2 and 8 in Table 3 are redundant operations where the SEQ operation is performed and 8 in Table 3 are redundant operations where the SEQ operation is performed with regard to E1 with regard to E1 and E3 . SO(2,8) is created for the redundant operation, as shown in Figure 7. and E3 . SO(2,8) is created for the redundant operation, as shown in Figure 7. Nodes 2 and 8, where the Nodes 2 and 8, whereisthe redundant performed, are expressed as a singleofnode, and the redundant operation performed, areoperation expressedisas a single node, and the information parent nodes information of parent nodes of Nodes 2 and 8 is added to perform the next operations individually. of Nodes 2 and 8 is added to perform the next operations individually.

Figure7.7.Complex Complexquery querytree treethat thatcombines combinesredundant redundantoperations. operations. Figure

3.5. Complex Event Detection 3.5. Complex Event Detection Afterthe theevent eventquery querytree treeisisreconstructed reconstructedusing usingthe thesimilar similarand andredundant redundantoperations, operations,complex complex After events are detected through continuous comparison between the input stream data and query tree. events are detected through continuous comparison between the input stream data and query tree. The general generalcomplex complexevent eventdetection detectionprocess processisissimilar similarto tothat thatof of RCEDA RCEDA except exceptfor for the the processing processing The procedure for similar and redundant operations. Once primitive events are generated through sensors, procedure for similar and redundant operations. Once primitive events are generated through the hashthe table is searched to delivertothe primitive events to events the event query treequery wheretree the where operations sensors, hash table is searched deliver the primitive to the event the are performed for the primitive events. If the conditions performed in the event query tree are operations are performed for the primitive events. If the conditions performed in the eventgeneral query operators, all processes areallthe same asare those If the operationIfto beoperation performed tree are general operators, processes thedone samein asRCEDA. those done in RCEDA. the to is bea virtual operator, the event occurrence is setoccurrence up, and when event satisfies the that condition occurs, performed is a virtual operator, the event is setanup, andthat when an event satisfies the the next execution request is given to the parent node stored in the PA of the EOIT. If the operation to condition occurs, the next execution request is given to the parent node stored in the PA of the EOIT. be performed is a redundant operation, the next execution request is given to multiple parent nodes If the operation to be performed is a redundant operation, the next execution request is given to after the parent currentnodes operation. multiple after the current operation. When a primitive eventoccurs, occurs,the thelocation locationof ofthe theevent eventquery querytree treewhere wherethe theoperation operationwill willbe be When a primitive event performedwith withregard regardto tothe theprimitive primitiveevent eventshould shouldbe beidentified. identified.To Todo doso, so,aahash hashtable tableisiscreated. created. performed The hash table is composed of a list of the addresses of the event query tree where the operation The hash table is composed of a list of the addresses of the event query tree where the operation is is performed with regard primitive events.Once Once primitiveevent eventoccurs, occurs,the thehash hashtable tableisis performed with regard to to thethe primitive events. a aprimitive searchedand andthe theprimitive primitiveevent eventisisdelivered deliveredto tothe theaddress addresswhere wherethe theoperation operationisisperformed performedwith with searched regard to the primitive event, and whether the next execution is performed or not is determined regard to the primitive event, and whether the next execution is performed or not is determined throughthe theoperation. operation.Figure Figure88shows showsthe theprocess processto toaccess accessthe theevent eventquery querytree treethrough throughthe the hash hash through tablewhen whenaaprimitive primitiveevent eventoccurs. occurs.Let Letususassume assumethat thata aprimitive primitiveevent eventEE1 occurs. occurs.To To identify identifythe the table 1 address of the event query tree where the operation related to E1 occurs in the hash table, the hash address of the event query tree where the operation related to E1 occurs in the hash table, the hash table is searched, and the primitive event is delivered to Node 2, where the virtual operator OA(1,6) table is searched,operations and the primitive event is delivered to Node 2, where the virtual operator OA(1,6) and redundant are performed. and redundant operations are performed.

Sensors 2018, 18, 3084 Sensors 2018, 18, x FOR PEER REVIEW

10 of 16 10 of 16

Figure 8. Figure 8. Hash table.

Since the the similar operations are are expressed expressed as as aa single Since similar operations single virtual virtual operator, operator, the the existing existing RCEDA RCEDA processing procedure cannot be used. Thus, the virtual operator employs the EOIT to process processing procedure cannot be used. Thus, the virtual operator employs the EOIT to process multiple operations, which are in similar or inclusion relationships. Figure 9 shows the complex multiple operations, which are in similar or inclusion relationships. Figure 9 shows the complex event detection detection process process with with regard regard to Let us us assume assume that that two two complex complex events, events, event to virtual virtual operators. operators. Let Q1 : W ITH I N ( E ∨ E , 1 sec ) and Q2 : W ITH I N ( E ∧ E , 0 sec, 3 sec )) , are registered. The two 2 1 Q1 : WITHIN( E1  E21,1sec)2 and Q 2 : WITHIN( E1  E2 ,0 sec,3 sec)) , are registered. The two complex events complex events have different time attributes, but the OR and AND operations are performed with have different time attributes, but the OR and AND operations are performed with regard to regard to primitive events E and E . Thus, OA is created with regard to two complex events, E and primitive events E1 and E21 . Thus,2 OA is created with regard to two complex events, E1 and1 E2 , E2 , as shown in Figure 9a. The OR operation has a time attribute of 1 s and the AND operation as shown in Figure 9a. The OR operation has a time attribute of 1 s and the AND operation has 0–3 s has 0–3 s time attributes. Let us assume that new primitive events e20 , e15 and e27 occur sequentially. 0 5 time attributes. Let us assume that new primitive events e2 , e1 and0 e27 occur sequentially. Here, j Here, ei means that event type i occurs at time j. Once the first event, e2 , occurs as shown in Figure 9b, j e20 within that event type Once the first , occurs1 s. asThe shown in Figure j . one, i occurs aeibitmeans that represents the occurrence of at E2time is set to because e0 event, occurred OR operation 2

satisfies even only a single Thus, when the OB of the within EOIT is1 arrayed as E2 is occurs. e20 occurred 9b, a bit the thatcondition represents the ifoccurrence of event set to one, because s. The OR “01”, the next execution request is given to Parent Node 4, where the next operation will be performed. operation satisfies the condition even if only a single event occurs. Thus, when the OB of the EOIT is When theassecond event e15 execution occurs as shown 9c,Parent the occurrence of E1 isthe set next to one, becausewill the arrayed “01”, the next requestinisFigure given to Node 4, where operation OR operation that performs a process every 1 s occurred within 1 s. Since the previously occurred be performed. When the second event e15 occurs as shown in Figure 9c, the occurrence of E1 is set e20 is outside the 0–3 s range, which is the condition of the AND operation, the occurrence of E2 is to one, because the OR operation that performs a process every 1 s occurred within 1 s. Since the set to zero. Thus, the OB of the collective events becomes “10”. When the OB of the EOIT is “10”, e20 is previously occurrednode thethe 0–3next s range, whichrequest is the condition ofNode the AND operation, the the next execution is outside 10. Thus, execution is given to 10. When the last 7 occurrence of Eas2 shown is set toinzero. Thus, the occurrence OB of the collective When the OB of event e2 occurs Figure 9d, the of E2 is setevents to one,becomes because“10”. the OR operation that 5 performs a process s occurred within s. Since previously occurred within the EOIT is “10”, theevery next 1execution node is 10.1 Thus, thethe next executiongenerated request ise1given to Node 10. 7 0–3 s, which is the condition of the AND operation, the occurrence of E is set to one. Thus, the OB of 1 When the last event e2 occurs as shown in Figure 9d, the occurrence of E2 is set to one, because the final event becomes “11”. The next execution request is given to Nodes 4 and 9 because both E the OR operation that performs a process every 1 s occurred within 1 s. Since the previously1 and E2 occur.5 e1 occurred within 0–3 s, which is the condition of the AND operation, the occurrence of generated E1 is set to one. Thus, the OB of the final event becomes “11”. The next execution request is given to

Nodes 4 and 9 because both E1 and E2 occur.

Sensors 2018, 18, 3084

11 of 16

Sensors 2018, 18, x FOR PEER REVIEW

11 of 16

(a) OA

(b)

e20

e5 (c) 1 Figure 9. Cont.

Sensors 2018, 18, x FOR PEER REVIEW

12 of 16

Sensors 2018, 18, 3084

12 of 16

Sensors 2018, 18, x FOR PEER REVIEW

12 of 16

(d)

e27

e27 (d)query Figure 9. Complex event processing procedure. Figure 9. Complex event query processing procedure.

Figure 9. Complex event query processing procedure. 4. Performance Evaluation 4. Performance Evaluation To prove the superiority of the proposed method, performance evaluation was conducted 4. Performance Evaluation To with provethe theexisting superiority of the proposed method, performanceevaluation evaluationenvironment, was conducted compared RCEDA method [33]. For the performance Intel To prove the superiority of the proposed method, performance evaluation was conducted compared with the existing RCEDA method [33]. For the performance evaluation environment, Core i3-2100 processor and six-gigabyte memory were used, and the operating system was compared with the existing RCEDA method [33].memory For the performance evaluation environment, Intel Intel Core i3-2100 processor and six-gigabyte were used, and the operating system was Microsoft Windows. The modules for CEP were implemented by Java. Arbitrarily, 5000 to 40,000 Microsoft Windows. The modules for CEP were implemented by Java. Arbitrarily, 5000 to Core i3-2100 processor and six-gigabyte memory and according the operating was primitive events were created, and processing timeswere were used, compared to thesystem number of 40,000 primitive events created, processing times were compared to the number of Microsoft Windows. Thewere modules forand CEP were implemented by Java. according Arbitrarily, 5000 to 40,000 events, ratio of similar operations, and ratio of redundant operations. events, events ratio of were similarcreated, operations, ratio of redundant operations. primitive andand processing were compared according to the number of The processing time was compared with thetimes existing RCEDA method according to the number The processing was compared with the existingoperations. RCEDA method according to the number events, ratio of similar time operations, and ratio of redundant of primitive events through the created data. Figure 10 shows the comparison results of processing ofThe primitive eventstime through the created with data.the Figure 10 shows the comparison results of processing was compared existing RCEDA method according to processing the number time according to the number of primitive events. The processing efficiency of the proposed method time according to the number of primitive events. The processing efficiency of the proposed method of primitive events through the created data. Figure 10 shows the comparison results of processing became better than that of the existing method as the number of primitive events increased, andthe the became bettertothan that of the method as The the number of primitive events time according the number ofexisting primitive events. processing efficiency of theincreased, proposedand method proposed method showed higher processing speed, by 58% on average, than that of the existing proposed showed processing speed, by 58% of onprimitive average, than that of the existing became bettermethod than that of thehigher existing method as the number events increased, and the method. The existing method performed calculations of events that had similar operations method. The existing method performed calculations of events that had similar operations individually, proposed method showed higher processing speed, by 58% on average, than that of the existing individually, themethod proposed method grouped similar to reducecomputation, the repeated whereas thewhereas proposed grouped similar operations to operations reduce the repeated method. The existing method performed calculations of events that had similar operations computation, therebybetter exhibiting betterefficiency processing than processing them individually. thereby exhibiting processing thanefficiency processing them individually. individually, whereas the proposed method grouped similar operations to reduce the repeated computation, thereby exhibiting better processing efficiency than processing them individually.

Figure Eventprocessing processingtime timeaccording according to to the the number Figure 10.10. Event numberof ofevents. events.

Figure 10. Event processing time according to the number of events.

Sensors 2018, 18, x FOR PEER REVIEW

13 of 16

Sensors 2018, 18, x FOR PEER REVIEW

13 of 16

Sensors 2018, 11 18, 3084 Figure shows

of 16the the processing time according to the ratio of similar operations.13 In Figure 11 shows the processing time according to queries the ratio of similar In and the experiment, approximately 40 identical complex event were used inoperations. the existing experiment, approximately 40 identical complex event queries were used in the existing and proposed methods. As the ratio of similar operations increased, the existing method showed a Figure 11 shows the processing time according to the ratio of similar operations. In the experiment, proposed methods. time, As the ratio ofthesimilar operations existing processing method showed a constant processing whereas proposed methodincreased, exhibited athe decreasing time. In approximately 40 identical complex event queries were used in the existing and proposed methods. constant processing time, whereas the proposed method exhibited a decreasing processing time. In addition, the processing performance of the the proposed higher when the ratio of similar As the ratio of similar operations increased, existingmethod methodwas showed a constant processing time, addition, the processing performance of the proposed method was higher when the ratio ofmethod similar operations was 30% to 50% compared to when it was 10 to 20%. Since the proposed whereas the proposed method exhibited a decreasing processing time. In addition, the processing operations wasprocessed to 50% compared to higher when it was 10ratio to 20%. Since the was proposed method combined and similar operations as a single virtual operation, which not considered performance of30% the proposed method was when the of similar operations was 30% to combined and processed similar operations as a single virtual operation, which was not considered in 50% the existing method, it reduced computational load compared to the existing method. Thus, compared to when it was 10 to 20%. Since the proposed method combined and processedthe in the existing method, reduced computational load to13.2% the existing method. Thus,time the above results verified the virtual proposed methodwhich was compared on faster processing similar operations as that aitsingle operation, wasaverage not considered in thein existing method, above results verified that the compared proposed to method was method. on average 13.2% fasterresults in processing time compared tocomputational the existing method. it reduced load the existing Thus, the above verified that compared to themethod existing method. the proposed was on average 13.2% faster in processing time compared to the existing method.

Figure 11. Processing time according to a ratio of similar operations. Figure Processingtime timeaccording according to to aa ratio ratio of Figure 11.11.Processing of similar similaroperations. operations.

Figure 12 shows the comparison results of the processing time according to 10 ratios of Figure 12 shows the comparison results of the processing time according to 10 ratios of redundant Figure operations 12 shows in thethe comparison of among the processing time event according to using 10 ratios of redundant level 1 treeresults structure the complex queries, 40,000 operations in the level 1 tree structure among the complex event queries, using 40,000 events. redundant operations in the level 1 tree structure among the complex event queries, using 40,000 events. The proposed total computation by conducting a singleoperation redundant The proposed methodmethod reducedreduced the totalthe computation by conducting a single redundant events. Theand proposed method reduced the total computation by conducting a with singlethe redundant operation using the result in all other redundant operations, in contrast existing and using the result in all other redundant operations, in contrast with the existing method. operation and using the result in all other redundant operations, in contrast with the existing method. Thus, the proposed had a processing time on18.8% average 18.8% than of the Thus, the proposed methodmethod had a processing time on average faster thanfaster that of thethat existing method. Thus, the proposed method had a processing time on average 18.8% faster than that of the existing method, as the ratio of redundant operations increased in the complex event queries. method, as the ratio of redundant operations increased in the complex event queries. existing method, as the ratio of redundant operations increased in the complex event queries.

Figure 12.Processing Processingtime timeaccording according to to aa ratio Figure 12. ratio of of redundant redundantoperations. operations. Figure 12. Processing time according to a ratio of redundant operations.

Sensors 2018, 3084PEER REVIEW Sensors 2018, 18,18, x FOR

1414 of of 16 16

The performance evaluation was conducted to prove that the proposed method requires less The performance evaluation was conducted to prove that the proposed method requires less computation than that of the existing method by using a virtual operator. In the performance computation than that of the existing method by using a virtual operator. In the performance evaluation, evaluation, event detection was compared between the existing and proposed methods using virtual event detection was compared between the existing and proposed methods using virtual operators operators located in level 1 (except for parent nodes that had no virtual operators) using 40,000 located in level 1 (except for parent nodes that had no virtual operators) using 40,000 events in the events in the complex query 13 tree. Figure showsofthe number of detected events 10 ss,and 20 s, complex event queryevent tree. Figure shows the13 number detected events at 10 s, 20 s, 30 at s, 40 30 50 s, s40with s and 50 to s with regard to operations invirtual level 1, where are the present. virtual As operators are regard operations located in level 1, located where the operators shown in present. As shown in the figure, computational load was minimal between 10 and 20 s, but after 30 the figure, computational load was minimal between 10 and 20 s, but after 30 s, the proposed method s, theshowed proposed method muchthan faster than that of the existing method. much faster showed computation thatcomputation of the existing method.

Figure 13. The number of detected events.

Figure 13. The number of detected events.

5. Conclusions 5. Conclusions In this paper, we proposed a complex event-processing method for sensor streams in the IoT In this paper, proposed a complex event-processing for sensor streams in the IoT environment. Thewe basic CEP method has a problem of increasingmethod overall computation since it processes environment. The basic CEP method has a problem of increasing overall computation since similar and redundant operations individually with regard to common primitive events. In the it proposed method, characteristics of the operators usedwith to perform events are analyzed, processes similar andthe redundant operations individually regard complex to common primitive events. and similar and redundant operations are detected. Similar operations are processed as a single In the proposed method, the characteristics of the operators used to perform complex events are virtual operation, and redundant operations are combined into aSimilar single operation process complex analyzed, and similar and redundant operations are detected. operationstoare processed as a events. Thus, the proposed method can shorten processing time because it does not perform redundant single virtual operation, and redundant operations are combined into a single operation to process comparison operations or inspections the same events. The processing performancetime evaluation on processing complex events. Thus, the proposed on method can shorten because it does not time was conducted according to the event processing time and ratios of similar and redundant perform redundant comparison operations or inspections on the same events. The performance operations, the results showed that the proposed method improved processing time evaluation onand processing time was conducted according to the event processing timecompared and ratiostoof that ofand the redundant existing method. As sensor data is created alongthat withthe expansion of IoT-based services, similar operations, andbigthe results showed proposed method improved research is needed to process large amounts of sensor stream data. In future works, we will conduct processing time compared to that of the existing method. As sensor big data is created along with CEP distributed processing methods for processing large sensor stream data. In addition, we will expansion of IoT-based services, research is needed to process large amounts of sensor stream data. implement the proposed method for actual open CEP systems and perform performance evaluations In future works, we will conduct CEP distributed processing methods for processing large sensor as workloads change. stream data. In addition, we will implement the proposed method for actual open CEP systems and perform as workloads change. Authorperformance Contributions:evaluations Conceptualization, K.B., D.K. and J.Y.; Methodology, K.B. and D.K.; Validation, D.K.; Data Curation, D.K.; Writing—Original Draft Preparation, K.B.; Writing—Review & Editing, J.Y.

Author Contributions:This Conceptualization, K.B., and J.Y.; Methodology, K.B.ofand D.K.; Validation, D.K.; Acknowledgments: work was supported byD.K. the National Research Foundation Korea (NRF) grant funded byCuration, the Korea D.K.; government (MSIP) (No. 2016R1A2B3007527), by the MSIT (Ministry of&Science, Data Writing—Original Draft Preparation, K.B.; Writing—Review Editing,ICT), J.Y. Korea, under the ITRC (Information Technology Research Center) support program (IITP-2018-2013-1-00881) supervised by

the IITP (Institute for Information communication Technology and by the ICT R&D program of Acknowledgments: This work was&supported by the National Promotion) Research Foundation of Korea (NRF) grant MSIT/IITP. Development High2016R1A2B3007527), Performance Visual Bigby Data Platformof forScience, Large-Scale funded by the[B0101-15-0266, Korea government (MSIP)of(No. theDiscovery MSIT (Ministry ICT), Realtime Data Analysis]. Korea, under the ITRC (Information Technology Research Center) support program (IITP-2018-2013-1-00881) supervised by the IITP (Institute for Information & communication Technology Promotion) and by the ICT R&D program of MSIT/IITP. [B0101-15-0266, Development of High Performance Visual Big Data Discovery Platform for Large-Scale Realtime Data Analysis].

Sensors 2018, 18, 3084

15 of 16

Conflicts of Interest: The authors declare no conflict of interest.

References 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13.

14.

15. 16. 17.

18. 19.

20. 21.

Atzori, L.; Iera, A.; Morabito, G. The internet of things: A survey. Comput. Netw. 2010, 54, 2787–2805. [CrossRef] Raja, S.P.; Rajkumar, T.D.; Raj, V.P. Internet of things: Challenges, issues and applications. J. Circuits Syst. Comput. 2018, 27, 1–16. [CrossRef] Bandyopadhyay, D.; Sen, J. Internet of things: Applications and challenges in technology and standardization. Wirel. Pers. Commun. 2011, 58, 49–69. [CrossRef] Whitmore, A.; Agarwal, A.; Xu, L.D. The internet of things—A survey of topics and trends. Inf. Syst. Front. 2015, 17, 261–274. [CrossRef] Gubbi, J.; Buyya, R.; Marusic, S.; Palaniswami, M. Internet of things (IoT): A vision, architectural elements, and future directions. Future Gener. Comput. Syst. 2013, 29, 1645–1660. [CrossRef] Xu, L.D.; He, W.; Li, S. Internet of things in industries: A survey. IEEE Trans. Ind. Inform. 2014, 10, 2233–2243. [CrossRef] Marjani, M.; Nasaruddin, F.; Gani, A.; Karim, A.; Hashem, I.A.T.; Siddiqa, A.; Yaqoob, I. Big IoT data analytics: Architecture, opportunities, and open research challenges. IEEE Access 2017, 5, 5247–5261. Zanella, A.; Bui, N.; Castellani, A.P.; Vangelista, L.; Zorzi, M. Internet of things for smart cities. IEEE Internet Things J. 2014, 1, 22–32. [CrossRef] Yasumoto, K.; Yamaguchi, H.; Shigeno, H. Survey of real-time processing technologies of IoT data streams. J. Inf. Process. 2016, 24, 195–202. [CrossRef] Raza, S.; Wallgren, L.; Voigt, T. SVELTE: Real-time intrusion Detection in the internet of things. Ad Hoc Netw. 2013, 11, 2661–2674. [CrossRef] Manco, G.; Ritacco, E.; Rullo, P.; Gallucci, L.; Astill, W.; Kimber, D.; Antonelli, M. Fault Detection and explanation through big data analysis on sensor streams. Expert Syst. Appl. 2017, 87, 141–156. [CrossRef] Xiao, F.; Zhan, C.; Lai, H.; Tao, L.; Qu, Z. New parallel processing strategies in complex event processing systems with data streams. Int. J. Distrib. Sens. Netw. 2017, 13, 1–15. [CrossRef] Zhao, Z.; Martin, P.; Jones, A.; Taylor, I.J.; Stankovski, V.; Salado, G.F.; Suciu, G.; Ulisses, A.; Laat, C. Developing, provisioning and controlling time critical applications in cloud. In Proceedings of the Advances in Service-Oriented and Cloud Computing: Workshops of ESOCC, Oslo, Norway, 27–29 September 2017; pp. 169–174. Malek, Y.N.; Kharbouch, A.; Khoukhi, H.E.; Bakhouya, M.; Florio, V.; Ouadghiri, D.E.; Latré, S.; Blondia, C. On the use of IoT and big data technologies for real-time monitoring and data processing. Procedia Comput. Sci. 2017, 113, 429–434. [CrossRef] Perera, C.; Zaslavsky, A.B.; Christen, P.; Georgakopoulos, D. Context aware computing for the internet of things: A survey. IEEE Commun. Surv. Tutor. 2014, 16, 414–454. [CrossRef] Rashid, B.; Rehmani, M.H. Applications of wireless sensor networks for urban areas: A survey. J. Netw. Comput. Appl. 2016, 60, 192–219. [CrossRef] Dao, M.; Pongpaichet, S.; Jalali, L.; Kim, K.; Jain, R.; Zettsu, K. A real-time complex event discovery platform for cyber-physical-social systems. In Proceedings of the International Conference on Multimedia Retrieval, Glasgow, UK, 1–4 April 2014; p. 201. Diallo, O.; Rodrigues, J.J.P.C.; Sene, M. Real-time data management on wireless sensor networks: A survey. J. Netw. Comput. Appl. 2012, 35, 1013–1021. [CrossRef] Choochotkaew, S.; Yamaguchi, H.; Higashino, T.; Shibuya, M.; Hasegawa, T. EdgeCEP: Fully-distributed complex event processing on IoT edges. In Proceedings of the International Conference on Distributed Computing in Sensor Systems, Ottawa, ON, Canada, 5–7 June 2017; pp. 121–129. Zhu, W.; Cao, J.; Raynal, M. energy-efficient composite event detection in wireless sensor networks. IEEE Commun. Lett. 2018, 22, 177–180. [CrossRef] Rizvi, S.; Jeffery, S.R.; Krishnamurthy, S.; Franklin, M.J.; Burkhart, N.; Edakkunni, A.; Liang, L. Events on the edge. In Proceedings of the ACM SIGMOD International Conference on Management of Data, Baltimore, MD, USA, 14–16 June 2005; pp. 885–887.

Sensors 2018, 18, 3084

22.

23. 24. 25.

26.

27. 28.

29.

30. 31.

32.

33. 34. 35. 36. 37. 38.

16 of 16

Lin, X.; Meng, Z.; Xu, C.; Wang, M. A practical performance model for hadoop mapreduce. In Proceedings of the International Conference on Cluster Computing Workshops, Beijing, China, 24–28 September 2012; pp. 231–239. Azzedin, F. Towards a scalable HDFS architecture. In Proceedings of the International Conference on Collaboration Technologies and Systems, San Diego, CA, USA, 20–24 May 2013; pp. 155–161. Hua, X.; Wu, H.; Li, Z.; Ren, S. Enhancing throughput of the hadoop distributed file system for interaction-intensive tasks. J. Parallel Distrib. Comput. 2014, 74, 2770–2779. [CrossRef] Wang, F.; Liu, S.; Liu, P.; Bai, Y. Bridging physical and virtual worlds: complex event processing for rfid data streams. In Proceedings of the International Conference on Extending Database Technology, Munich, Germany, 26–31 March 2006; pp. 588–607. Mohania, M.K.; Swamini, D.; Gupta, S.K.; Bhowmick, S.S.; Dillon, T.S. event composition and detection in data stream management systems. In Proceedings of the International Conference on Database and Expert Systems Applications, Copenhagen, Denmark, 22–26 August 2005; pp. 756–765. Gu, Y.; Yu, G.; Li, C. Deadline-aware complex event processing models over distributed monitoring streams. Math. Comput. Model. 2012, 55, 901–917. [CrossRef] Ottenwälder, B.; Koldehofe, B.; Rothermel, K.; Hong, K.; Ramachandran, U. RECEP: Selection-based reuse for distributed complex event processing. In Proceedings of the ACM International Conference on Distributed Event-Based Systems, Mumbai, India, 26–29 May 2014; pp. 59–70. Appel, S.; Frischbier, S.; Freudenreich, T.; Buchmann, A.P. Event stream processing units in business processes. In Proceedings of the International Conference on Business Process Management, Beijing, China, 26–30 August 2013; pp. 187–202. Jayasekara, S.; Kannangara, S.; Dahanayakage, T.; Ranawaka, I.; Perera, S.; Nanayakkara, V. Wihidum: Distributed complex event processing. J. Parallel Distrib. Comput. 2015, 79–80, 42–51. [CrossRef] Gyllstrom, D.; Wu, E.; Chae, H.; Diao, Y.; Stahlberg, P.; Anderson, G. SASE: Complex event processing over streams. In Proceedings of the Conference on Innovative Data Systems Research, Asilomar, CA, USA, 7–10 January 2007; pp. 407–411. Wu, E.; Diao, Y.; Rizvi, S. High-performance complex event processing over streams. In Proceedings of the ACM SIGMOD International Conference on Management of Data, Chicago, IL, USA, 27–29 June 2006; pp. 407–418. Wang, F.; Liu, S.; Liu, P. Complex RFID event processing. VLDB J. 2009, 18, 913–931. [CrossRef] Landt, J. The history of RFID. IEEE Potentials 2005, 24, 8–11. [CrossRef] Want, R. An introduction to RFID technology. IEEE Pervasive Comput. 2006, 5, 25–33. [CrossRef] Bok, K.; Yoo, J. RFID based indoor positioning system using event filtering. J. Electr. Eng. Technol. 2017, 12, 335–345. [CrossRef] Bok, K.S.; Yeo, M.H.; Lee, B.Y.; Yoo, J.S. Efficient complex event processing over RFID streams. Int. J. Distrib. Sens. Netw. 2012, 8, 1–9. [CrossRef] Suhothayan, S.; Gajasinghe, K.; Narangoda, I.L.; Chaturanga, S.; Perera, S.; Nanayakkara, V. Siddhi: A second look at complex event processing architectures. In Proceedings of the ACM Workshop on Gateway Computing Environments, Seattle, WA, USA, 18 November 2011; pp. 43–50. © 2018 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).