A Declarative Framework for Matching Iterative and Aggregative Patterns against Event Streams Darko Anicic 1 , Sebastian Rudolph 2 , Paul Fodor 3 , and Nenad Stojanovic 1 1 FZI Research Center for Information Technology, Germany 2 AIFB, Karlsruhe Institute of Technology, Germany 3 State University of New York at Stony Brook, USA Abstract. Complex Event Processing as well as pattern matching against streams have become important in many areas including financial services, mobile devices, sensor-based applications, click stream analysis, real-time processing in Web 2.0 and 3.0 applications and so forth. How- ever, there is a number of issues to be considered in order to enable effective pattern matching in modern applications. A language for de- scribing patterns needs to feature a well-defined semantics, it needs be rich enough to express important classes of complex patterns such as iterative and aggregative patterns, and the language execution model needs to be efficient since event processing is a real-time processing. In this paper, we present an event processing framework which includes an expressive language featuring a precise semantics and a corresponding ex- ecution model, expressive enough to represent iterative and aggregative patterns. Our approach is based on a logic, hence we analyse deductive capabilities of such an event processing framework. Finally, we provide an open source implementation and present experimental results of our running system. 1 Introduction Pattern matching against event streams is a paradigm of processing continu- ously arriving events with the goal of identifying meaningful patterns (com- plex events). For instance, occurrence of multiple events form a complex event pattern by matching certain temporal, relational or causal conditions. Com- plex Event Processing (CEP) has recently aroused significant interest due to its wide applicability in areas such as financial services (e.g., dynamic tracking of stock fluctuations, surveillance for frauds and money laundering etc.), sensor- based applications (e.g., RFID monitoring), network traffic monitoring, Web click analysis etc. While the pattern matching over continuously arriving events has been well studied [1,10,5,6,9], so far the focus was mostly on the high-performance and the pattern language expressivity. A common approach for stream query process- ing has been to use select-join-aggregation queries [5,6,9]. While such queries can specify a wide range of patterns, they are unable to express Kleene clo- sure. Kleene closure can be used to extract from the input stream a finite yet N. Bassiliades et al. (Eds.): RuleML 2011 - Europe, LNCS 6826, pp. 138–153, 2011. c  Springer-Verlag Berlin Heidelberg 2011