2007-03-15-Italy-Tutorial-nonotes [Lecture seule]

zzzzzzzzProcessing Data Streams:An (Incomplete) TutorialJohannes GehrkeDepartment of Computer Sciencejohannes@cs.cornell.eduhttp://www.cs.cornell.eduStandard Pub/SubPublish/subscribe (pub/sub) is a powerful paradigm Publishers generate data Events, publicationsSubscribers describe interests in publicationsQueries, subscriptionsAsynchronous communicationDecoupling of publishers and subscribersMuch commercial software …1zzzzzzzzLimitation of Standard Pub/SubScalable implementations have very simple query languagesSimple predicates, comparing message attributes to constantsE.g., topic=‘politics’ AND author=‘J. Doe’Individual events vs. event sequencesMany monitoring applications need sequence patterns Stock tickers, RSS feeds, network monitoring, sensor data monitoring, fraud detection, etc.Example: RSS Feed MonitoringOnce CNN.com posts an article on Technology, send me the first post referencing (i.e., containing a link to) this article from the blogs to which I subscribeSend postings from all blogs to which I subscribe, in which the first posting is a reference to a sensitive site XYZ, and each later posting is a reference to the previous.2zzzzzzzzExample: System Event Log MonitoringIn the past 60 seconds, has the number of failed logins (security logs) increased by more than 5? (break-in attempt)Have there been any failed connections in the past 15 minutes? If yes, is the rate increasing?Have there ...