Combining Proactive and Retroactive Processing for Distributed Complex Event Detection

Complex Event Detection (CED) is a key capability for many monitoring applications such as intrusion detection, sensor-based activity/phenomenon tracking, and network/infrastructure monitoring. Existing CED solutions commonly assume centralized availability and proactive processing of all relevant events, and thus incur significant overhead in distributed settings. In this paper, we present and evaluate efficient distributed CED techniques that reduce event detection and transmission costs through a combination of proactive and retroactive processing strategies. The key idea is to generate CED plans that leverage the temporal and spatial windowing constraints associated with complex events to determine a multi-step acquisition order of constituent events that minimizes expected communication costs while meeting application-defined latency bounds for event detection. We demonstrate the utility of the proposed technique using extensive experimentation on a variety of work-