In this paper, we study the problem of complex event detection (CED) in a monitoring environment that consists of potentially a large number of distributed event sources (., hardware sensors or software receptors). CED is becoming a fundamental capability in many domains including network and infrastructure security (., denial of service attacks and intrusion detection [22]) and phenomenon and activity tracking (., fire detection, storm detection, tracking suspicious behavior [23]). More often than not, such sophisticated (or “complex”) events ”happen” over a period of time and region. Thus, CED often requires consolidating over time many ”simple” events generated by distributed sources. Existing CED approaches, such as those employed by stream processing systems.
