Information Technology Reference
In-Depth Information
reevaluated on the entire database each time new events are added. Second, even
for oine processing (as done in our experiments), the query evaluation proce-
dure does not take advantage of the temporal ordering of events. This deficiency
is most evident when evaluating the SQL query for (P2).
In contrast to PostgreSQL, STREAM is designed for online event processing.
However, temporal reasoning in STREAM is limited. In particular, CQL's only
temporal construct collects all event tuples within a specified time range relative
to the current time. It roughly corresponds
2
to the
I
operator in MFOTL
Ω
,
where
I
is of the form [0
,t
) with
t
. We cannot select only tuples from
a time window that is strictly in the past. It is therefore not clear how to handle
temporal properties of the form
∈
N
∪{∞}
I
. It is also not clear how to handle
nested temporal operators as this also requires handling time windows that do
not contain the current time point. Finally, it is also not obvious how to check
that certain event patterns happen at every time point in a given time window.
Consider, e.g., the policy stating that a user may not make large withdrawals
if he is continuously in an over-withdrawn state during the last seven days. In
MFOTL
Ω
, the policy is naturally expressed as
∀
I
ϕ
with 0
/
∈
u.
[0
,
8)
(
out-debt
(
u
)
S
in-debt
(
u
))
→¬∃
¬
a.withdraw
(
u,a
)
∧
a
1000
.
Note that the subformula
out-debt
(
u
)
S
in-debt
(
u
) can be encoded in CQL by
requiring for each user
u
that at the current time the total number of
out-debt
(
u
)
events is smaller than the total number of
in-debt
(
u
) events. We have used such
an encoding for (P2). We remark that the addition to (P1) of the since sub-
formula in (P2) has a larger impact on STREAM's performance than on our
tool.
While MFOTL
Ω
has a richer tool set than CQL to express temporal patterns,
STREAM's performance is consistently better than our tool's. Nevertheless, the
differences are not as large as one might expect for a prototype implementation.
Our prototype has not yet been systematically optimized. We expect substan-
tial performance improvements by carefully adapting data structures and query
evaluation techniques used in databases and stream processing.
¬
5Con lu on
Existing logic-based policy monitoring approaches offer little support for aggre-
gations. To rectify this shortcoming we extended metric first-order temporal logic
with expressive SQL-like aggregation operators and presented a monitoring algo-
rithm for this language. Our experimental results for a prototype implementation
of the algorithm are promising. The prototype's performance is in the reach of
optimized stream-processing tools, despite its richer input language and its lack
of systematic optimization. As future work, we will investigate performance
2
CQL's time model differs from that of MFOTL
Ω
. In CQL, there is no notion of time
point and query evaluation is performed for each timestamp
τ ∈
N
.Furthermore,
CQL has a multi-set semantics.
