Implementation Using Interval-Based Semantics

Snoop is an event specification language developed for expressing primitive and composite events that are part of Event-Condition-Action (or ECA) rules. Snoop also supports complex event expressions using a set of event operators, such as And, Or, Sequence, Not etc. A detection-based (using the end time of an event occurrence on the time line) semantics was provided for all the operators in various contexts (such as Cumulative and Continuous) and were implemented in Sentinel an active object-oriented DBMS. An event was defined to be an instantaneous, atomic (happens completely or not at all) occurrence of interest and the time of occurrence of the last event in an expression was used as the time of occurrence for the entire event expression. The above detection-based semantics does not recognize multiple compositions of some operators especially Sequence in the intended way. In order to recognize all the Snoop operators in all the contexts in the intended way, the semantics need to include start time as well as end time for a composite event (i.e., interval-based semantics). In this paper, we formalize the occurrence of Snoop event operators and expressions using interval-based semantics for the recent context. The algorithms for the detection of events using interval-based semantics introduce some challenges, as not all the events are known (especially their starting points). We present a few representative algorithms to detect some operators conforming to the interval-based semantics. Finally, we comment on their implementation in the context of Sentinel.