Real-time multi-pattern detection over event streams

A method comprising:

• receiving, as input, a data stream representing events;
• receiving, as input, a plurality of complex event patterns (CEPs), each representing an occurrence of a respective CEP in said data stream, wherein each of said CEPs comprises (a) a set of conditions reflecting relations among said events, and (b) a set of attributes associated with each of said events;
• and
• calculating an optimal multi-pattern evaluation plan corresponding to said plurality of CEPs, wherein said multi-pattern evaluation plan is created by:
• (i) generating an initial evaluation plan,
• (ii) applying a search method to calculate modified versions of said initial evaluation plan,
• (iii) assigning a score to each of said modified versions based on a cost function, and
• (iv) selecting one of said modified versions having a highest said score as said optimal multi-pattern evaluation plan.

A computer program product comprising a non-transitory computer-readable storage medium having program instructions embodied therewith, the program instructions executable by at least one hardware processor to:

• receive, as input, a data stream representing events;
• receive, as input, a plurality of complex event patterns (CEPs), each representing an occurrence of a respective CEP in said data stream, wherein each of said CEPs comprises (a) a set of conditions reflecting relations among said events, and (b) a set of attributes associated with each of said events;
• and
• calculate an optimal multi-pattern evaluation plan corresponding to said plurality of CEPs, wherein said multi-pattern evaluation plan is created by:
• (i) generating an initial evaluation plan,
• (ii) applying a search method to calculate modified versions of said initial evaluation plan,
• (iii) assigning a score to each of said modified versions based on a cost function, and
• (iv) selecting one of said modified versions having a highest said score as said optimal multi-pattern evaluation plan.