LAMF: Framework for Complex Event Processing in ... - IEEE Xplore

LAMF: Framework for Complex Event Processing in Wireless Sensor Networks 1

Yongxuan Lai1 , Wenhua Zeng1 , Ziyu Lin2 , Guilin Li1

School of Software, 2 School of Information Science and Technology Xiamen University, 422 Simingnan Road, Siming District, Xiamen, China Email: {laiyx, whzeng, ziyulin, glli}@xmu.edu.cn

Abstract—In wireless sensor networks the nodes periodically sense the environment, and huge amount of raw data are injected into the network. In order to extract useful information from the network, yet at the same time to incur least energy consumption, complex event processing techniques are highly required. In this paper we propose a framework for complex event processing in wireless sensor networks. Our framework is based on the layered network, and transforms the complex events into sub-events that are suitable to be detected by nodes within regional areas. As a middleware, our framework is easy to extend, and various complex event processing algorithms could be embedded into the framework. Index Terms—LAMF; complex event processing; middleware; sensor network

I. I NTRODUCTION Wireless sensor networks (WSNs) are increasingly used to monitor and query the physical world [1], [2]. Such networks consist of many typically battery-powered sensor nodes with limited CPUs and memory. The distributed nodes sense the physical world nearby and generate data (tuples) periodically (see Figure 1). So in theory, through the deployment of sensor network users may “measure” the physical world directly at any time and any place. Researchers are excited about this trait of the WSNs, and they have proposed various WSN applications, e.g. monitoring[3], [4], surveillance, databasealike storage and querying[2], and etc. However, the tuples generated at sensing node are primitive, reductant, and uncertain in nature. On one hand, multiple nodes would discover and sense the same phenomenal at multiple sensing cycles (or epoches), and some readings maybe distorted and erroneous. On the other hand, collecting all the tuples to a central processing node (e.g. base station) is nearly impossible for the resource-constraint network because large number of transmissions among nodes would exhaust the energy of the nodes. So two general technics have been proposed to efficiently extract useful information from the huge amount of data in the WSNs: in-network processing and complex event processing. The former is to do the processing within the network as far as possible, avoiding transmitting the raw data outside the network. Applications such as aggregation, top-k querying, and joining [5] belongs to this kind of technic. The latter is to transform the raw data into meaningful and useful events that are to be reported to the users. As the events have a much smaller size compared with the raw data, yet contain the

978-1-4244- 7618-3 /10/$26.00 ©2010 IEEE

Fig. 1.

Illustration of a wireless sensor network.

information needed by users, the complex event detection and processing is of great significance for the WSN applications. There have been various event detection applications proposed in the WSNs, e.g. for detecting eruptions of volcanoes [6], forest fires, coal mine gas leakages [4], and for the habitat monitoring of the animals [3]. In this paper, we consider complex event processing(CEP) a fundamental block that various applications could build upon. We make the CEP block as a middleware in the protocol stack, and propose a LAyered Middleware Framework (LAMF ) for complex event processing in wireless sensor networks. The rest of the paper is structured as follows. Section II surveys some related works of this paper. Section III introduces some concepts and definitions related to the complex event processing. Then section IV presents the LAMF framework in detail, and section V gives a case study using the framework to process a complex event. Finally, section VI concludes the paper. II. RELATED WORK Event detection or monitoring is an essential application in wireless sensor networks, and indeed, a very broad topic. Here we first briefly survey the recent event detection algorithms, and then introduce some event processing frameworks in the WSNs. References [4] specify common types of events as patterns in contour maps, and abstracts the spatiotemporal patterns of sensory data. The event detection process is then viewed

as the contour map matching between the events and the data. Reference [7] abstracts the events as varying predicates over any number of conditions. These predicates, also viewed as filter conditions, are stored in tables and then distributed within multiple nodes throughout the network. So the event detection is done through joining the filters to the sensory readings, outputting the detection result. Reference [6] studies the issue of tracking the correlations among sensor data within a time window to detect events of interest. It views the event detection as the process of window self-join, and proposes the two-phase self-join scheme to evaluate the self-join queries in sensor networks. In [8], the events are viewed as data points that correspond to interesting or unusual patterns in the underlying phenomenon that the network monitors. It then uses symbolic aggregate approximation (SAX) to convert raw sensor readings to symbolic representations, and then uses a distance metric for string comparison to detect the events. Reference [9] uses a division-based technique to detect global events. It divides a global event into regional events for the ease of monitoring, and also takes advantage of the temporal correlations of sensing data to gain energy efficiency. Then in [10], the authors summarize various types of events and define generic composite event semantics, which extend traditional event composition with data aggregation in wireless sensor networks. Besides the event processing algorithms, there also have some proposed frameworks that could be use for the processing of composite events. Cougar[11] employs threshold-based detection logic and encapsulates it into a set of asynchronous functions provided for users. The sensors sense data and then transmit data matching the function to the base-station. TinyDB [2] defines the event by a composition of various specified attribute thresholds. The sensors send data satisfying the thresholds, which is then aggregated within the network on its way to the base station. StonesDB [12] defines the event detection task as similarity queries and classification queries. These frameworks mentioned above are able to detect the events, but their main task is for query processing or data storage. The proposed LAMF framework differs from these systems in that the main task is for complex event processing and various extension and optimization could be embedded into the framework. III. C OMPLEX E VENT D ETECTION A. Event Model We first define the event model considered in the wireless sensor network. A primitive event is the occurrence of a state transition at a certain point of time, where the time is called timestamp of the event. Multiple primitive events would compose a composite event through some operators. Operators define the relationship of the primitive events within a composite event. Given some kind of operators, multiple composite events may compose a high-level composite event. The composite event therefor is also called the complex event. In this paper, we consider some operators similar to the operators defined in [10]. We argue that these operators are

important for the wireless sensor network, and other operators may easily extended based on them. ∙ Conjunction A+B: Event A and B occur in any order. ∙ Disjunction 𝐴 ∣ 𝐵: Event 𝐴 or 𝐵 occurs. ∙ Sequence A;B: Event 𝐴 occurs before 𝐵. ∙ Spatial Restriction 𝐴𝑆 : Event 𝐴 occurs within a spatial area S. ∙ Temporal Restriction 𝐴𝑇 : Event 𝐴 occurs within a temporal interval 𝑇 . 𝑛 ∙ Occurrence 𝐴 : Event A occurs more than 𝑛 times. 𝑟 ∙ Spatial Portion 𝐴𝑆 : Within a spatial restriction 𝑆, event A occurs in more than than ∣𝑆∣ ∗ 𝑟 nodes, where 𝑟 ≤ 1.0 and ∣𝑆∣ denotes the number of nodes in 𝑆. 𝑟 ∙ Temporal Portion 𝐴𝑇 : Within a temporal restriction 𝑇 , events A occurs in more than than ∣𝑇 ∣ ∗ 𝑟 epoches, where 𝑟 ≤ 1.0 and ∣𝑇 ∣ denotes the number of epoches in 𝑇 . Operator is a key factor for composite events. For example, 𝔸 = 𝐴10 𝑟𝑜𝑜𝑚 is a composite event that denotes there are more 0.5 denotes than 10 𝐴 events in the room. Similarly, 𝔹 = 𝐵ℎ𝑎𝑙𝑙 that event 𝐵 occurs in more than 50 percent of the nodes in the 0.5 0.8 hall. Then the event (𝐴10 𝑟𝑜𝑜𝑚 ; 𝐵ℎ𝑎𝑙𝑙 )3𝑚𝑖𝑛 could be rewritten as , which denotes that during the epoches within 𝔻 = (𝔸; 𝔹)0.8 3𝑚𝑖𝑛 a time interval of 3 minutes, event 𝔸 occurs before 𝔹 in more than 80 percent of the epoches. Different from the operators defined in [10], we argue that the occurrence and portion are useful and important operators in wireless sensor network. As the sensor network is resourceconstraint in nature, the sensing nodes are usually unprecise when sensing the environment. Some data is missing and some data is distorted. Yet a phenomenon is usually detected by multiple nodes in the field, and detected multiple times within a time interval. So events that appear in multiple nodes and multiple epoches are considered more interesting and useful for the applications in the sensor network. These kinds of events are to be captured by the occurrence and portion operators. B. Complex Event Processing The complex event processing (CEP) is to process the complex events. CEP has been well studied in centralized systems such as the active database [13], data stream systems [14]. In the scenario of the wireless sensor network, CEP usually has the following three steps: ∙ Defining: The complex event is defined as monitoring tasks in the network. The tasks are then downloaded and stored in the network; ∙ Matching: As the nodes periodically sense the environment, large volume of data are injected into the network. Nodes would analyze, filter and aggregate primitive events, then transform these events into complex composite events of higher level. In this step the correlations between events are considered, and an event matching process among different nodes is needed to enhance the power of complex event processing; ∙ Handling: Once a complex event is identified, CEP would trigger the predefined operations to handle this

Fig. 2.

Stack layers of the sensor node.

event. For example, when a composite event is detected, it would be reported to the user, or a meaningful operation may be performed by the actuated nodes. A complex event usually involves a set of nodes that maybe distributed in different locations, so transmissions and scheduling are required in CEP. This brings up the energy efficiency of the network. Also, CEP defines the event monitoring task as continuous querying tasks, so various monitoring and surveillance applications could build upon it. C. Event Driven Architecture The sensor nodes are emitting continuously data into the network, and many applications, e.g. monitoring, detection, and surveillance, are closely related with events. This brings about an architecture called “Event Driven Architecture”(EDA) to efficiently support this kind of applications. EDA provides an architectural concept for dealing with event streams using CEP as the event processing model[15]. The LAMF framework proposed in this paper belongs to this kind of EDA architecture. IV. LAMF F RAMEWORK A. Overview In the LAMF framework, the complex event processing is a fundamental block in the sensor network. From Figure 2 we can see that event detection framework LAMF is a middleware layer between the routing layer and application layer. LAMF schedules the transmissions among nodes, and makes execution plans for the detection tasks issued from the applications. As illustrated in Figure 3, there are three layers in the framework: the base station, the proxy, and the ordinary nodes. An complex event is composed of multiple sub-events. Accordingly, a functional component is composed of multiple sub-components distributed within different layers. Then the subcomponents within a layer would cooperate to detect the sub-events. Finally, the sub-events are gathered at the base station and the final event detection task could be evaluated. In the following subsections, we would introduce the components in detail. B. Components in Base Station There are four components in the base station: the event analyzer, the event planning engine, the event manager, and the composite event detector. When the base station receives

Fig. 3.

Overview of the LAMF framework.

the event monitoring tasks (expressed by the event processing languages) issued from the users, the event analyzer would first do some analyzing tasks, e.g. syntax checking of the composite event. Then the event planning engine would split the complex event into some low level events, extract the operators of the event, and generate a plan for the event processing. The plan is actually composed of sub-tasks, which are defined as some low-level events (also called sub-events). The sub-plans are then forwarded into the network and processed in the proxies. Finally, when the sub-events are reported to the event manager at the base station, the sub-events are stored and indexed. The composite event detector would check whether the final requirements for the monitoring task are satisfied according to the operators of the event detecting task. If the targeted events are detected, the base station would trigger the predefined operations. C. Components in Proxy There are three components in the proxy: the sub-event dispatching engine, the sub-event manager, and the sub-event detector. The event dispatching engine receives sub-tasks from the base station, it may further split the task according to the operators of the sub-events. Then the subtasks are dispatched to the nodes in the target areas. The sub-event manager is responsible for the index structure and storage for the primitive or low-level sub-events. Note that sub-events maybe primitive events or composite events transformed from them, so the subevent manager has to manager events of different levels and of different tasks. And having the sub-events stored in the subevent manager, the sub-event detector is then able to detect sub-events according to the operators at various levels. D. Components in Ordinary Node The ordinary nodes in the LAMF have a component called simple event detector. It is responsible for detecting the primitive or low-level events that could be processed in a single node.

E. Extensibility of the framework Note that there is a CEDA (Composite Event Detecting Algorithm) module in all layers of the network. CEDA is the algorithmic module for the matching of complex events, which belongs to the event detector component. CEDA has the sub-events, primitive events, and operators as the input, and it would use counting, filtering, aggregation, and other operators or algorithms for the event matching. If the conditions for a composite event are satisfied, the CEDA module would transform the sub-events or primitive events into a composite event of higher level. Based on basic algorithms LAMF provides, users are able to define their own algorithms for the event detection tasks. In other words, users could easily extend the LAMF framework through the designing of the CEDA block for various types of complex event processing and detection. V. C ASE S TUDY USING LAMF Now let us take a look at the composite event mentioned in section III: 0.5 0.8 𝔻 = (𝐴10 𝑟𝑜𝑜𝑚 ; 𝐵ℎ𝑎𝑙𝑙 )3𝑚𝑖𝑛 The 𝐴 event denotes darkness, e.g. the amount of light is below some threshold. So 𝔸 = 𝐴10 𝑟𝑜𝑜𝑚 represents that the room is dark: more than 10 nodes in the room detect the darkness around them. The 𝐵 event denotes quietness, e.g. 0.5 the amount of sound is below some threshold. So 𝔹 = 𝐵ℎ𝑎𝑙𝑙 represents that the hall is quiet: more than 50 percent of the whole nodes in the hall detect the quietness around them. So the composite event ℂ = (𝔸; 𝔹) has the following meaning: the room is sensed to be dark, and then the hall is sensed to be quiet. By adding the temporal portion operator, the event is then transformed into the target composite event: 𝔻 = ℂ0.8 3𝑚𝑖𝑛 . Event 𝔻 means that during the epoches within 3 minutes, event ℂ occurs more than 80 percent of the epoches. Event 𝔻 is a composite event of high-level semantics. For example, the users who issue event 𝔻 is actually to check whether the following statement is true: “The conference is over and participants have left”. So when the base station receives the monitoring task of 𝔻 event, the event analyzer would analyze and check the correctness of the event, and then the event planning engine would split the 𝔻 into two level of sub-events: ℂ as the level 0, and 𝔸 and 𝔹 as the level 1 sub-events. The level 1 subevents are then forwarded into the proxies located in the 𝑟𝑜𝑜𝑚 and ℎ𝑎𝑙𝑙. If there are no proxies predefined in this area, the planning engine would select a proxy for the regional area. Then the sub-event dispatching engine in the proxy would dispatch the sub-event into the ordinary nodes, where the simple event detector would gather the data and detects the primitive events, e.g. events 𝐴 and 𝐵. These primitive evens are then sent to the sub-event manager in proxy for storage and indexing. The sub-event detector would continuously execute the occurrence operator of 𝔸 and the spatial portion operator of 𝔹. If there are sub-events detected, e.g. 𝔸 denoting the room is dark, the sub-events would be sent to the base station, where the event manager would store and index these sub-events.

The composite event detector at the base station receives the sub-events, e.g. 𝔸 and 𝔹. It then triggers the detection process of event ℂ. If event ℂ occurs, the detector would execute the temporal portion operator to account the number of this event within a sliding window of 3 minutes. And finally, if there are more than ∣3𝑚𝑖𝑛∣ ∗ 0.8 ℂ events happen within the window, the target detection task 𝔻 is reported to the users. The arrows in Figure 3 illustrate the control and data flow of the CEP process that is distributed within three layers of the network. VI. C ONCLUSION In this paper, we have proposed a framework called LAMF for complex event processing in wireless sensor networks. LAMF is based on the layered network, and splits the complex event detection task into sub-tasks that could be monitored by nodes within regional areas. Users are then able to build applications upon the LAMF framework, and easily extend the framework by embedding various complex event processing algorithms into the CEDA block. We are going to implement and embed the existed complex event processing algorithms into the LAMF framework and verify their performances. R EFERENCES [1] D. Cruller, D. Estrin, and M. Sivastava, “Overview of sensor networks,” Computer(Long Beach, CA), vol. 37, no. 8, pp. 41–49, 2004. [2] S. Madden, M. Franklin, J. Hellerstein, and W. Hong, “TAG: a Tiny AGgregation Service for Ad-Hoc Sensor Networks,” Proceedings of OSDI, 2002. [3] A. Cerpa, J. Elson, D. Estrin, et al. “Habitat monitoring: application driver for wireless communications technology,” ACM SIGCOMM Computer Communication Review, vol. 31, no. 2 supplement, pp. 20– 41, 2001. [4] W. Xue, Q. Luo, L. Chen, and Y. Liu, “Contour map matching for event detection in sensor networks,” Proceedings of ACM SIGMOD, pp. 145–156, 2006. [5] M. Stern, E. Buchmann, and K. Bohm, “Towards Efficient Processing of General-Purpose Joins in Sensor Networks,” Proceedings of ICDE, 2009. [6] X. Yang, H. Lim, T. Ozsu, and K. Tan, “In-network execution of monitoring queries in sensor networks,” Proceedings of ACM SIGMOD, pp. 521–532, 2007. [7] D. Abadi, S. Madden, and W. Lindner, “REED: robust, efficient filtering and event detection in sensor networks,” Proceedings of VLDB, pp. 769–780, 2005. [8] M. Zoumboulakis and G. Roussos, “Escalation: Complex event detection in wireless sensor networks,” in 2nd European conference on Smart sensing and context, pp. 270–285, 2007. [9] Y. Lai, Y. Chen, and H. Chen, “Continuous monitoring of global events in sensor networks,” International Journal of Sensor Networks, vol. 7, no. 1, pp. 95–105, 2010. [10] E. Yoneki and J. Bacon, “Unified semantics for event correlation over time and space in hybrid network environments,” On the Move to Meaningful Internet Systems, pp. 366–384, 2005. [11] Y. Yao and J. Gehrke, “The cougar approach to in-network query processing in sensor networks,” ACM SIGMOD Record, vol. 31, no. 3, pp. 9–18, 2002. [12] Y. Diao, D. Ganesan, G. Mathur, and P. Shenoy, “Re-thinking data management for storage-centric sensor networks,” Proceedings of CIDR, 2007. [13] N. Gehani, H. Jagadish, and O. Shmueli, “Composite event specification in active databases: Model & implementation,” Proceedings of VLDB, pp. 327–327, 1992. [14] E. Wu, Y. Diao, and S. Rizvi, “High-performance complex event processing over streams,” Proceedings of ACM SIGMOD, p. 418, 2006. [15] D. Luckham, The power of events. Addison-Wesley, 2002.