DELAYED PROPAGATIONS FOR SLIDING WINDOW AGGREGATIONS VIA DISORDERED FLOWS

Abstract

A computer-implemented method for calculating data aggregations in a sliding window over disordered data streams received by a distributed system (10) of data-generating components by delaying the passing of values, wherein the method is implemented in a processor (902) connected to a memory (904) storing a data structure comprising a hierarchical arrangement of nodes, wherein nodes on the same horizontal layer are associated with the same operator, the same initial value, and the same metric constraint, wherein the method comprises: Received, at a first aggregation node (20) of a plurality of aggregation nodes in a first time window on a first horizontal layer of the data structure, a final value from a first node in a lower layer of nodes below the plurality of aggregation nodes, wherein the final value comprises a data value and a timestamp, and wherein the first node is within a capture range of each of the plurality of aggregation nodes in the first time window; Creating a subaggregation of the first aggregation node (20) using the final value if no existing subaggregation of the first aggregation node (20) exists, or combining the final value with the existing subaggregation of the first aggregation node (20) to create the subaggregation of the first aggregation node (20) if the existing subaggregation of the first aggregation node (20) exists; iteratively passing the subaggregation of the first aggregation node (20) to the remaining aggregation nodes of the plurality of aggregation nodes in the first time window sequentially, with for each subsequent node of the remaining aggregation nodes a provisional value of the aggregation node being updated by the value of the subaggregation; Determine for each subsequent node whether the pass should be delayed; and Delaying the transfer of the subaggregation to the next aggregation node in response to the determination that the transfer should be delayed.

Description

CROSS-REFERENCE TO RELATED REGISTRATIONS

[0001] The present application claims priority from US Provisional Patent Application No. 63 / 230,074, filed on August 6, 2021, entitled “DELAYED PROPAGATIONS FOR SLIDING-WINDOW AGGREGATIONS OVER OUT-OF-ORDER STREAMS”. SPECIALIZATION

[0002] The present disclosure relates to a method, a system and a computer-readable medium for delayed transmission for data aggregation in a sliding window over out-of-sequence data streams. BACKGROUND

[0003] Data—often generated by machines these days, for example by the devices and components of IT systems—is (or often must be) processed and analyzed in real time. In the Internet of Things (IoT), for instance, various devices continuously generate data that is immediately analyzed by services in the cloud or directly at network edge nodes. The processed data may then be forwarded to data consumers who combine it with data from other sources or use it to make decisions.

[0004] Such data is often processed by stream processing frameworks, machines, or services like Apache Flink (see https websites: <<flink.apache.org> >; <<de.wikipedia.org / wiki / Apache_Flink> >; <<azure.microsoft.com / en-us / services / stream-analytics / > >; and <<en.wikipedia.org / wiki / Azure_Stream_Analytics> >), the data online in the form of data or They process event streams. Their applications are numerous and include system monitoring, system verification and troubleshooting, intrusion, surveillance, fraud detection, data mining as in advertising and e-commerce, and many others.

[0005] Analyses in these application areas often involve some form of real-time data aggregation via a sliding window; see M. Stonebraker, U. Cetintemel, and S. Zdonik: “The 8 requirements of real-time stream processing,” SIGMOD Record 34(4), 2005. A simple example of sliding window data aggregation is the continuous counting of bids in an online auction during the last hour. Sliding window data aggregations are state-dependent computations. A state essentially consists of the currently active / incomplete time windows with their preliminary aggregation values. A newly received stream element can create new time windows, triggering the updating of multiple preliminary aggregation values ​​and completing the aggregation of multiple time windows.However, maintaining the state can be computationally intensive, and state updates can quickly become a bottleneck, especially in real-time applications with high data rates.

[0006] Efficient data stream processing becomes even more difficult when stream elements are not received in the order they were generated. Analysis results can depend on the order in which the stream elements are processed. Network delays and retransmissions of network packets are one reason why stream elements might be out of order. Caching and reordering stream elements delays the analysis result, thus impacting the output latency of the processed data stream. Furthermore, caching and reordering can lead to significant memory and computational overhead, which can quickly become another bottleneck.

[0007] D. Basin, F. Klaedtke, and E. Zalinescu, in their article "Runtime verification over out-of-order streams," published in ACM Transactions on Computational Logic, 21(1):5, 2020, describe a graph-based data structure for monitoring system behavior during out-of-order event streams. Optimizations of this graph-based data structure are described in F. Klaedtke's "Method for operating a monitoring entity," US 10725887 B2. However, the described monitoring approach limits the analysis results to Boolean values. In essence, it restricts the ability to check whether a specific value is true or false at a given time. Consequently, aggregations are also limited to Boolean values.

[0008] Document US 2021 / 0124746A1 describes a method for processing and aggregating data streams with unordered data elements in a sliding window. The data is inserted into segments according to their timestamps, missing elements are detected, and segments are merged seamlessly. Within the segments, subaggregations are formed and continuously updated using associative operators. For efficient execution, data structures such as skip lists are used, enabling parallel and incremental data aggregation.

[0009] Document US 2018 / 0039672A1 describes a method and device for answering queries based on partial aggregations of continuous data streams generated by network elements within a communication network. For this purpose, a template with parameters is received that determines which data is collected and how it is aggregated. Based on the template, a query is generated, and subaggregations are formed from the received data, each of which is timestamped and stored. The query is continuously applied to the most recent subaggregations, forming cumulative aggregations, and the results are transmitted to a controller to make adjustments in the network.

[0010] Document 2017 / 0132285A1 discloses a computer-implemented method for processing and aggregating unordered data streams in a sliding window. It describes the reception of time-stamped data streams from distributed data sources and the processing of this data by continuous query operators in a system with buffer management and hierarchically structured aggregation operations. Processing takes place in a processor with memory, using a buffer to chronologically order incoming data and to compute aggregations across sliding windows. The system further provides for the dynamic adjustment of the transmission and processing of values ​​to achieve quality-controlled aggregation using subaggregations and delay mechanisms.

[0011] Document US 2016 / 0285711A1 discloses a computer-implemented method for processing and aggregating data streams and batch data in a distributed system using time-based, floating, or otherwise defined windows. Incoming data is time-stamped, grouped into fixed, floating, or session-based windows, and aggregated within these windows. The system includes functions for determining the event time, grouping by keys and time intervals, and controlling the output of aggregated results based on triggers, such as watermark timers. Aggregation is performed by aggregation functions, with intermediate results held in memory and refined as subsequent data points arrive.

[0012] Document US 2020 / 0210430A1 discloses a computer-implemented method for processing and aggregating timestamped fact data in floating time windows. The data is partitioned by join keys in a distributed data processing system, sorted chronologically within the partitions, and then aggregated. It describes the creation of subaggregations by identifying and merging, for each observation event, those fact records whose timestamps fall within the corresponding time window. Furthermore, the document demonstrates the use of a hierarchical data representation and processor and memory resources to perform the aggregation steps, including the iterative processing of multiple observation records per join key. SUMMARY

[0013] One aspect of the present disclosure provides a computer-implemented method for computing data aggregations in a sliding window over disordered data streams received by a distributed system of data-generating components by delaying value propagation. The method is implemented in a processor connected to a memory containing a data structure with a hierarchical arrangement of nodes, where nodes on the same horizontal layer are associated with the same operator, the same initial value, and the same metric constraint. The method comprises receiving, at a first aggregation node of a plurality of aggregation nodes in a first time window on a first horizontal layer of the data structure, a final value from a first node in a lower layer of nodes below the plurality of aggregation nodes.wherein the final value comprises a data value and a timestamp, and wherein the first node is within a capture range of each of the plurality of aggregation nodes in the first time window, creating a subaggregation of the first aggregation node using the final value if no existing subaggregation of the first aggregation node exists, or combining the final value with the existing subaggregation of the first aggregation node to create the subaggregation of the first aggregation node if the existing subaggregation of the first aggregation node exists, iteratively passing the subaggregation of the first aggregation node to the remaining aggregation nodes of the plurality of aggregation nodes in the first time window sequentially,where for each next node of the remaining aggregation nodes, a preliminary value of the aggregation node is updated by the value of the subaggregation, determining for each next node whether the propagation should be delayed, and delaying the propagation of the subaggregation to a next aggregation node in response to the determination that the propagation should be delayed. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The subject matter of this disclosure is described in more detail below with reference to the exemplary figures. All features described and / or illustrated here can be used individually or in various combinations. The features and advantages of different embodiments will become clear by reading the following detailed description with reference to the accompanying drawings, which illustrate the following: Fig. 1 illustrates a system model according to an embodiment of the present invention; Fig. 2 illustrates a disordered data stream (the data stream element e appears before e' in the data stream, although its timestamp is greater than the timestamp of e'), according to an embodiment of the present invention; Fig. Figure 3 illustrates a sliding window in a data stream in which the data stream elements are ordered (and without missing data elements), according to an embodiment of the present invention; Fig. 4A illustrates a graph-based data structure; Fig. Figure 4B illustrates an optimized graph-based data structure; Fig. Figure 5 illustrates examples of graph updates from Fig. 4B, which is at the top in Fig. 5 is shown according to different embodiments of the present invention; Fig. Figure 6 illustrates an aggregation node according to an embodiment of the present invention; Fig. Figure 7 illustrates the value transmission (without delay) according to an embodiment of the present invention; Fig. Figure 8 illustrates the value transmission (with delays) according to an embodiment of the present invention; Fig. Figure 9 illustrates the prioritization of transfers according to an embodiment of the present invention; Fig. Figure 10 illustrates partial aggregations with inverses according to an embodiment of the present invention; Fig. 11 illustrates partial aggregations according to an embodiment of the present invention; Fig. Figure 12 shows Listing 1: Subaggregations according to an embodiment of the present invention; Fig. Figure 13 shows Listing 2: Subaggregations (continued) according to an embodiment of the present invention; and Fig. Figure 14 illustrates a processing system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0015] The present disclosure provides a method for the efficient aggregation of data elements from a disordered data stream over a sliding window. The method delays the value aggregation for specific time windows and computes subaggregations that can be reused for multiple time windows.

[0016] An advantage of embodiments of the present disclosure is that arbitrary data types can be provided in aggregations such as maps (without being restricted to Boolean values, as was the case in the prior art). Furthermore, no restriction to other basic types, such as integers, is necessary.

[0017] Embodiments of the present disclosure also ensure that aggregations can be calculated more quickly (compared to what was possible before the invention). In the prior art, every relevant time window for a newly received data stream element can be updated. Since embodiments of the present disclosure delay the propagation, fewer time windows are updated when a new data stream element is received. Furthermore, embodiments of the present disclosure reduce the recalculations of partially aggregated values, which also leads to performance improvements.

[0018] Embodiments of the present disclosure extend the graph-based data structure to non-Boolean values ​​and enable the computation of aggregations with non-Boolean values ​​over a sliding window on out-of-order data streams. Furthermore, aspects of the present disclosure include delays in passing a data value for an aggregation if the respective aggregation is not yet complete because an earlier or later data value is also missing. The delayed passes are collected and partially aggregated for later efficient passing. Delaying and collecting passes for multiple time windows accelerates the computation of data value aggregation.

[0019] According to one embodiment of the present invention, a computer-implemented method for calculating data aggregations in a sliding window over data streams received from a distributed system of data-generating components is provided by delaying the propagation of values. The method is implemented in a processor connected to a memory that stores a data structure comprising a hierarchical arrangement of nodes, where nodes on the same horizontal layer are associated with the same operator, initial value, and metric constraint. The method comprises receiving, at a first aggregation node of a plurality of aggregation nodes in a first time window on a first horizontal layer of the data structure, a final value from a first node in a lower layer of nodes below the plurality of aggregation nodes.wherein the final value comprises a data value and a timestamp, and wherein the first node is within a capture range of each of the plurality of aggregation nodes in the first time window, creating a subaggregation of the first aggregation node using the final value if no existing subaggregation of the first aggregation node exists, or combining the final value with the existing subaggregation of the first aggregation node to create the subaggregation of the first aggregation node if the existing subaggregation of the first aggregation node exists, iteratively passing the subaggregation of the first aggregation node to the remaining aggregation nodes of the plurality of aggregation nodes in the first time window sequentially,wherein for each next node of the remaining aggregation nodes a preliminary value of the aggregation node is updated by the value of the subaggregation, determining for each next node whether the propagation should be delayed, and delaying the propagation of the subaggregation to a next aggregation node in response to the determination that the propagation should be delayed.

[0020] According to one embodiment, the method further includes, if a status of an aggregation node in the plurality of aggregation nodes is final, sending a final value of the aggregation node to a node on a layer above the first horizontal layer.

[0021] According to one embodiment, the final value of the first node has a value type selected from the group consisting of Boolean, Integer, Strings, Floating Point Numbers, Vector and Map.

[0022] According to one embodiment, determining for a next node whether the propagation should be delayed includes determining whether the next node is waiting for a value from a predecessor node on the same horizontal layer as the first node.

[0023] According to one embodiment, the method further comprises resuming the transmission of a delayed subaggregation at a later time in response to the receipt of a value from another node on the lower layer by the node where the delay occurred.

[0024] According to one embodiment, a partial aggregation is stored as a balanced search tree or an ordered array.

[0025] According to one embodiment, the method further includes discarding a delayed propagation of the partial aggregation at an aggregation node if it is determined that the aggregation node is no longer within the time window of the first aggregation node.

[0026] According to one embodiment, a network device is provided in a distributed system, comprising one or more processors and memory for storing instructions and a data structure comprising a hierarchical arrangement of nodes, wherein nodes on the same horizontal layer are associated with the same operator, the same initial value, and the same metric constraint, wherein the instructions, when executed by the one or more processors, cause the network device to implement a method for calculating aggregations in a sliding window over disordered data streams received from data-generating components of the distributed system by delaying the propagation of values. The method includes receiving,at a first aggregation node of a plurality of aggregation nodes in a first time window on a first horizontal layer of the data structure, a final value from a first node in a lower layer of nodes below the plurality of aggregation nodes, wherein the final value comprises a data value and a timestamp, and wherein the first node is within a capture range of each of the plurality of aggregation nodes in the first time window, creating a subaggregation of the first aggregation node using the final value if no existing subaggregation of the first aggregation node exists, or combining the final value with the existing subaggregation of the first aggregation node to create the subaggregation of the first aggregation node if the existing subaggregation of the first aggregation node exists,the iterative propagation of the subaggregation of the first aggregation node to the remaining aggregation nodes of the plurality of aggregation nodes in the first time window in sequence, whereby for each subsequent node of the remaining aggregation nodes a preliminary value of the aggregation node is updated by the value of the subaggregation, determining for each subsequent node whether the propagation should be delayed, and delaying the propagation of the subaggregation to a subsequent aggregation node in response to the determination that the propagation should be delayed.

[0027] According to one embodiment, the memory further stores instructions which, when executed by the one or more processors, cause the network device, when a status of an aggregation node in the plurality of aggregation nodes is final, to send a final value of the aggregation node to a node on a layer above the first horizontal layer.

[0028] According to one embodiment, the instructions for determining whether the next node should delay the transmission include instructions for determining whether the next node waits for a value from a predecessor node on the same horizontal layer as the first node.

[0029] According to one embodiment, the final value of the first node has a value type selected from the group consisting of Boolean, Integer, Strings, Floating Point, Vector and Map.

[0030] According to one embodiment, the memory further stores instructions which, when executed by the one or more processors, cause the network device to resume the transmission of a delayed subaggregation at a later time in response to the node at which the delay occurred receiving a value from another node at the lower layer.

[0031] According to one embodiment, a partial aggregation is stored in memory as a balanced search tree or as an ordered array.

[0032] According to one embodiment, the memory further stores instructions which, when executed by the one or more processors, cause the network device to discard a delayed propagation of the partial aggregation at an aggregation node if it is determined that the aggregation node is no longer within the time window of the first aggregation node.

[0033] According to one embodiment, a tangible, non-transitory, computer-readable medium is provided which contains instructions which, when executed by one or more processors, alone or in combination, provide the execution of a method for calculating aggregations in a sliding window over disordered data streams received from a distributed system of data-generating components by delaying the propagation of values, wherein the method comprises defining a data structure in a memory unit coupled to the one or more processors, wherein the data structure comprises a hierarchical arrangement of nodes, with nodes on the same horizontal layer being associated with the same operator, the same initial value, and the same metric constraint, receiving,at a first aggregation node of a plurality of aggregation nodes in a first time window on a first horizontal layer of the data structure, a final value from a first node in a lower layer of nodes below the plurality of aggregation nodes, wherein the final value comprises a data value and a timestamp, and wherein the first node is within a capture area of ​​each of the plurality of aggregation nodes in the first time window, creating a subaggregation of the first aggregation node using the final value if no existing subaggregation of the first aggregation node exists, or combining the final value with the existing subaggregation of the first aggregation node to create the subaggregation of the first aggregation node if the existing subaggregation of the first aggregation node exists,the iterative propagation of the subaggregation of the first aggregation node to the remaining aggregation nodes of the plurality of aggregation nodes in the first time window in sequence, whereby for each subsequent node of the remaining aggregation nodes a preliminary value of the aggregation node is updated by the value of the subaggregation, determining for each subsequent node whether the propagation should be delayed, and delaying the propagation of the subaggregation to a subsequent aggregation node in response to the determination that the propagation should be delayed. System model

[0034] Aspects of the present disclosure are explained in connection with an underlying system model 10, which is presented in Fig. Figure 1 illustrates this. System 10 can be composed of several components. These components could be, for example, software components of a cloud-based IT system, IoT devices, or a combination of both. Some of the system components produce data. Such a component is called a data producer. For example, an IoT sensor might measure the temperature every second. The device's measurements are continuously sent to a platform 15, such as a network device in a distributed system or network of components. The platform, in turn, hosts a service for processing and analyzing the data from the data producers. That is, the service receives and processes a data stream from the data producers. The data processing typically involves some form of data aggregation.Aggregation can, for example, involve calculating the average temperature over a specific period, along with the minimum and maximum temperatures within that period. The processed, potentially aggregated data then forms a data stream that is continuously sent to a data consumer, who can only collect, further process, or make decisions and / or take actions based on the processed data. For instance, if the average temperature is too high, the data consumer can activate a cooling unit, reduce the workload of a component, or shut down a component.

[0035] The stream elements of data streams do not necessarily have to be received in the order in which they are generated. That is, the stream elements can be received by the platform in a different order. One reason for unordered stream elements is network latency. Furthermore, lost network packets can lead to indefinite delays, if not retransmission. To determine the order of the stream elements, it is assumed that each stream element contains a timestamp. The timestamp is the creation time of the stream element. Timestamps are linearly ordered. Often, these timestamps originate from physical clocks. Fig. Figure 2 shows an example where each stream element contains a timestamp and a data element. In this example, the stream element e' appears out of sequence within the data stream because its timestamp (2) is earlier than the timestamp (7) of the previous stream element e. Aggregations via sliding windows

[0036] Data aggregation combines the data elements of multiple stream elements. Typically, the combination includes the data elements from stream elements received over a specific period. Such periods are often specified by sliding windows. Sliding windows are time windows that move with the data stream, provided the data stream elements are in the correct order. Fig. Figure 3 shows an example where the τ timestamps are the timestamps of the first stream element of a time window, and the κ timestamps are the timestamps of the last stream element of a time window. Time windows can be specified, for example, by a duration along with a direction (forward or backward) or by special start and end tags. It should be noted that time windows can overlap, as shown in Fig. As shown in Figure 3, data elements that occur in multiple time windows contribute to multiple aggregations. Furthermore, the number of stream elements within the time windows can vary. It is even possible for a time window to be empty, meaning it contains no stream elements.

[0037] A simple example of data aggregation is counting failed login attempts within the last hour from a device in an IT system, where the data stream consists of timestamped, logged system events. The count can be triggered by specific audit events or performed periodically, e.g., every ten minutes. If the stream elements are not received in the exact order they are generated, even in this simple example, it becomes difficult to accurately and efficiently count the failed login attempts within a specific time window. In particular, stream elements that arrive late should not be excluded when calculating the aggregation using a sliding window.

[0038] Aggregations are generally defined via an underlying monoid. That is, the data elements come from a set D with an associative operator ⊗:D × D→D, which combines the data elements, and an identity element e ∈ D. Since ⊗ is associative, it is irrelevant how the parentheses are arranged in a term like d1⊗d2⊗...⊗d n The order of the elements matters, however, if ⊗ is not commutative. Examples of monoids are the integers with addition + and 0 as the identity element, and the n × n matrices for n ≥ 1 with matrix multiplication and the identity matrix. See K. Tangwongsan, M. Hirzel, S. Schneider, and K.-L. Wu: “General incremental sliding-window aggregation”, Proceedings of the VLDB Endowment, 8(7), 2015 for further examples.

[0039] A graph-based data structure is described in D. Basin, F. Klaedtke and E. Zalinescu: “Runtime verification over out-of-order streams”, ACM Transactions on Computational Logic, 21(1):5, 2020 and some of its optimizations are described in F. Klaedtke: “Method for operating a monitoring entity”, US 10725887 B2.

[0040] Fig. 4A and Fig. Figure 4B shows examples of a graph-based data structure and an optimized graph-based data structure. The nodes of the graph-based data structure are grouped into segments. Each segment corresponds to either a point in time or a gap. The points in time are linked to the timestamps of the received stream elements, and the gaps to non-overlapping, non-empty time intervals spanning multiple points in time, which serve as placeholders for points in time that can be added to the graph-based data structure in the future. The segments are ordered in ascending order according to their timestamps and time intervals and stored in a doubly linked list. The nodes are stored horizontally in layers. Each layer corresponds to a node type, e.g., the nodes of a specific temporal subformula from the given specification. The nodes of each layer are also stored in a doubly linked list.This means that each node has horizontal links of the same type to its predecessor and successor. Since the segments and nodes are ordered according to their timestamps and time intervals, the nodes can be compared according to their temporal position. In particular, the "nearest" node to any other node is well-defined according to a specific condition.

[0041] Furthermore, each node can also have vertical links. In D. Basin, F. Klaedtke, and E. Zalinescu: “Runtime verification over out-of-order streams,” ACM Transactions on Computational Logic, 21(1):5, 2020, each node has links to the nodes to which it passes its (Boolean) value when it is final. There is also a corresponding back-link for each of these links. For simplicity, it is assumed that the nodes of a layer L can receive values ​​from at most some of the nodes of a single lower layer L', and that the nodes of a layer L (if it is not the top layer) pass their values ​​to some nodes of a single upper layer L''. Note that the nodes of some layers derive their values ​​directly from the data elements of the received data streams.

[0042] In one embodiment, explicit links are stored in memory. In contrast, implicit links are not stored in memory but are derived from the explicit links (along with the node's timestamp / gap and metric constraints). For example, the graph-based data structure described in F. Klaedtke: "Method for operating a monitoring entity," US 10725887 B2, explicitly stores only some of the vertical links. The remaining vertical links are implicit and are derived as needed from both the explicit vertical links and the horizontal links. This has the advantage that fewer links need to be updated when the graph-based data structure is updated (e.g., by deleting a node when values ​​are passed upwards or by splitting a segment when a new stream element is received).Furthermore, less storage space is required for the graph-based data structure. In particular, it is sufficient to explicitly store the following vertical links. A node has an explicit outgoing vertical link to the nearest node to which a value is passed. For all outgoing links from nodes N1,...,N. n N has a single backlink to a node N. It is sufficient to consider the vertical link from N to node N. n to store which is the most distant node with an explicit outgoing vertical link to node N, assuming that N1,...,N n are ordered according to their intervals. Note that there is no backlink if there are no nodes with an explicit outgoing link to N. If a node receives values ​​from nodes in multiple different lower layers, it has backlinks for each layer.

[0043] At the in Fig. In the graph-based data structure shown in 4B, each node has a constant number of outgoing links, whereas in the one shown in Fig. In the graph-based data structure shown in Figure 4A, a node has, in the worst case, a linear number of outgoing links. A constant number of outgoing links means that the number of outgoing links is constant. In one embodiment, for example, a node (1) has two horizontal outgoing links (predecessor and successor) unless the node is the first or last node in the list, and (2) has a single vertical outgoing link unless the node is a top-level node. Note that in special cases, a node may have even fewer links. For example, if the node is the first node in the list, the link to its predecessor is zero. It is important to note that these links are the explicit links mentioned / explained above.It should be noted that storing a single link in memory is significantly cheaper than storing a list of links in memory. It should also be noted that this graph-based data structure contains even slightly fewer links than the one described in F. Klaedtke: “Method for operating a monitoring entity”, US 10725887 B2. Finally, the values ​​stored at the nodes are not limited to Boolean values ​​as described in D. Basin, F. Klaedtke, and E. Zalinescu: “Runtime verification over out-of-order streams”, ACM Transactions on Computational Logic, 21(1):5, 2020. The node values ​​can be of any data type, e.g., integers, floating-point numbers, vectors, and mappings.

[0044] The basic updates to graph-based data structures can include (1) adding a time point, (2) removing a gap, and (3) propagating values. Adding a time point involves splitting a gap containing the time stamp, and replacing the gap segment with the resulting segments and their nodes. The nodes in the new segments inherit their values ​​from the nodes of the segment being split. It's also important to note that propagating values, removing a gap, or splitting a segment removes irrelevant nodes from the graph-based data structure. Shrinking a gap is another example of an update to the graph-based data structure.

[0045] Fig. Figure 5 shows examples of graph updates from Fig. 4B, which is at the top in Fig. Figure 5 illustrates this process. First, the gap (4.2, 4.3) is removed from the graph. Second, a new time with the timestamp 4.0 is added to the graph. To add this new time, the interval (3.14, 4.2) containing the timestamp 4.0 is split, creating new segments. Third, the node in the lower layer within segment {4.0} passes its value upwards, and the node is removed, updating the values ​​of the nodes to which the value is passed. It should be noted that this example does not cover all cases. For instance, multiple gaps could be removed, multiple values ​​could be passed, splitting a gap does not always result in three new segments, nodes without an outgoing connection can be removed from the graph, nodes without an incoming node (explicit or implicit) are complete and pass their value, and so on. Aggregation node

[0046] In the present disclosure, a new type of node, namely an aggregation node, is introduced. Each of these nodes can be associated with an aggregation over a time window determined by an associative operator ⊗:D × D→D, an initial value z ∈ D, and a metric restriction given by an interval I. The interval I, together with the interval of a node segment, determines the node's time window for the aggregation. For example, if the segment corresponds to a time point with timestamp τ, then the time window can be τ + I, and if the segment corresponds to a gap with time interval J, then the time window can be J + I. Intuitively speaking, τ and J are shifted by I and include all segments that intersect with the time window. A segment with time interval K can be (i) contained in J + I (i.e., K ⊆ J + I), (ii) partially contained in J + I (i.e.,(i) K ∩ (J + I) ≠ Ø, but not K ⊆ J + I), and (iii) be disjoint to J + I (i.e., K ∩ (J + I) = Ø). In case (i), the input node of the segment with time interval K is contained in the time window, and in case (iii), the input node of the segment with time interval K is not contained in the time window. In case (ii), at least one of the segments must be a gap, and it is "floating" whether the input node of the segment with time interval K is contained in the time window or not.

[0047] In one embodiment, aggregation nodes on the same horizontal layer are connected with the same initial properties, e.g., operator, initial value, and metric constraint. It should be noted that, as described above, the time windows have been restricted to include only stream elements with the same or larger timestamps. Extending this to include time windows that also or exclusively include stream elements with smaller timestamps is easily achievable. In particular, aggregations with bidirectional time windows can be split into two aggregations with unidirectional time windows.

[0048] Fig. Figure 6 shows an example of an aggregation node 20 and fields of the node according to an embodiment of the invention. In one embodiment, an aggregation node 20 can have the fields prev, next, out, and in. The fields prev, next, out, and in of an aggregation node 20 represent the explicit horizontal and vertical connections of the graph-based data structure. The field value of an aggregation node 20 can store the values ​​that have been passed to the node so far. The passed-in values ​​can be combined into a single value, e.g., by an association operator ⊗; initially, the value is z. It should be noted that the value is not necessarily a Boolean value; the value type depends on the aggregation. The value can be, e.g., an integer, a mapping, a floating-point value, etc. Furthermore, the value can be a preliminary value.For example, the value can be provisional if not all values ​​have yet been transferred to the aggregation node within the node's time window. Additionally, in one embodiment of the invention, an aggregation node 20 contains the fields "pending" and "delayed" for pending and delayed transfers. • Pending propagations are propagations from a point in time that satisfies the metric condition of the aggregation, but the metric condition is not valid; that is, the point in time may or may not be part of the aggregation's time window. Each pending propagation includes a timestamp and a value. An aggregation node can only have pending propagations if the node's segment corresponds to a gap. • Delayed passes are passes that have not yet been fully completed. In particular, passes at this node have been paused. Similar to pending passes, each delayed pass includes a timestamp and a value.

[0049] Both pending and delayed transfers are ordered according to their timestamps. They can be stored, for example, in arrays or balanced search trees.

[0050] In the Go programming language, an aggregation node can be implemented, for example, as a structure type (struct) with the following fields: In one embodiment, the explicit links of a node are implemented as pointers. It's important to note that a pointer to a link can be null if no explicit link exists; for example, if the node is the head of the doubly linked list of aggregation nodes, then its `prev` field will be null. Furthermore, the types of the (vertical) incoming and outgoing nodes depend on the types of the nodes in the respective layer. Alternatively, an interface type for nodes with an API for operations on nodes could be used. Additionally, an aggregation node type holds a pointer to the segment in which the node resides (the owner field). By tracking this pointer, the timestamp or interval of the node can be determined, depending on whether the node is in a segment that represents a point in time or a gap. Passing on of values

[0051] Fig. 7 and Fig. Figure 8 illustrates the propagation of the value from a node N to the aggregation nodes of an upper layer according to one embodiment of the invention. For the propagation of the value of N, N should preferably be located in a segment that represents a point in time with a timestamp. Otherwise, the segment containing N is a gap segment. Propagating the value of N would not be practical, since the gap, which serves as a placeholder, could later be removed or divided into multiple segments. Furthermore, the value of N should ideally not be provisional when the value of N is propagated.

[0052] A forwarding process without delayed forwarding is in Fig. Figure 7 is shown, which is first described because it contributes to understanding the transfer when the transfer can be delayed, and is then described. The dashed box in Fig. 7 contains all aggregation nodes that are within the range of N, i.e., those that have node N in their time window. In other words, N has outgoing vertical connections precisely to the nodes in the dashed box, with the connection to the nearest node S being explicit; the other connections are implicit and in Fig. 7 not shown. In general, the capture range of a node determines the furthest node to which the node passes its value. The capture range can be specified, for example, by a minimum or maximum timestamp. For node N in Fig. 7. This value is min({tau}-I) or min(JI), where I is the metric constraint of the aggregation and tau / J is the timestamp / gap of node N. It should also be noted that min(X) denotes the minimum of the set X. Recall that an aggregation node aggregates the values ​​of nodes on a lower layer within a specific time window. The time window of an aggregation node is given by the node's timestamp tau or gap J and the metric constraint of the aggregation, i.e., an interval I. The capture area of ​​a node is defined from the perspective of a node in the lower layer; that is, it specifies which nodes the value is passed to. In contrast, the time window of a node is defined from the perspective of a node in the upper layer; that is, it specifies the nodes from which values ​​are *received*.

[0053] The value of N is propagated along its outgoing explicit vertical connection to node S and then upwards along the horizontal connections on the upper layer until a node is reached that is too far from N, i.e., N is no longer in the time window of the aggregation node, or the horizontal predecessor connection is zero, i.e., N is at the top of the layer. Fig. In node 7, this node is the predecessor of node T (or zero). For all nodes between S and T, their preliminary aggregation value is updated according to the passed-on value. Nodes S or T might be located in segments that are gaps or have gaps, and the segment of N might not be fully contained within its time window. In this case, according to one embodiment of the invention, the timestamp of the segment of N and the value of N are added to the pending passes, which are performed later for descending nodes originating from splitting segments. A pending pass can also be dropped if its timestamp is no longer partially contained within the time window of the aggregation node.

[0054] Furthermore, N is removed from the graph-based data structure. The aggregation nodes between S and T that no longer have any explicit or implicit vertical links and no pending passes (i.e., N was their last remaining input) are complete, meaning they finalize their value and pass their value further up the hierarchy.

[0055] In a delayed transfer process, one example of which is in Fig. As shown in Figure 8, a pass-through can be delayed during the iterative visit of the aggregation nodes, starting at S and proceeding towards T. The pass-through can be delayed at any of the nodes between S and T. For example, passes to nodes in specific segments can be delayed. The following strategy for delaying the pass-through is defined or set as shown in Figure 8. Fig. Figure 8 shows where propagation is delayed at node S'. S' is determined by going to the predecessor node of N, N', and then tracing its explicit outgoing vertical connection. That is, S' is the first visited node waiting for a value from another node that precedes N. If N has no predecessor, propagation is not delayed. Propagation is also not delayed if node S' is not between S and T. Furthermore, S and S' can be the same aggregation node. In this case, propagation from N is delayed directly at S.

[0056] The values ​​of nodes S through D are updated according to the passed-over value. S can be—as above—a node in a segment, and the segment of N may not be entirely within S's time window. In this case, the pass is added to S's pending passes instead of updating S's value. Similarly, if D equals T and N's segment is not entirely within T's time window, the pass is added to D's pending passes.

[0057] Some of the delayed propagations from S can also be propagated further. Specifically, the delayed propagations δ at S that satisfy the following conditions are propagated along with the value of N: δ has a timestamp between (i) the timestamp of N and (ii) the timestamp or interval of the input to the aggregation node S next to N (if present). Note that the timestamp or interval mentioned in (ii) exists if N.next is not zero and N.next.out points to S. Otherwise, δ has a timestamp after the timestamp of N and can also be propagated further.

[0058] During the iteration through the nodes (of S and D), the aforementioned delayed propagations from S that are no longer within the time window of the currently visited aggregation node are discarded. The value and pending propagations of the currently visited aggregation node are updated accordingly. At node S', the remaining propagations are added to the node's delayed propagations. Furthermore, the aggregation nodes between S (exclusively) and D have no delayed propagations according to the defined delayed propagation strategy, as they have no explicit incoming vertical connection.

[0059] Assuming that all time windows contain O(n) nodes, a propagation without delayed propagation always visits a linearly large number of nodes and performs a linearly large number of value updates. With delayed propagation, only O(n) nodes are visited and, in the worst case, updated for the propagated value. However, if delayed propagation is performed separately later, little is gained, since we may visit and update the nodes (or their descendants resulting from gap splitting) later. The following describes how delayed propagation at an aggregation node can be efficiently combined so that, according to one embodiment of the invention, they can be performed together.

[0060] When combining delayed passes, it is advantageous to prioritize the passes. An example is in Fig. Figure 9 shows nodes N1 and N2 passing their values ​​upwards along the explicit outbound link to the same aggregation node S. Priority queues can be used so that N2 passes its value before N1. Nodes with larger timestamps should be given priority as the time windows extend to the right across stream elements. This results in N2's pass being immediately delayed, combined, and executed along with N1's pass. That is, when both passes are combined, they are essentially executed at once, rather than sequentially. Partial aggregations

[0061] According to one embodiment, instead of updating the value of an aggregation node separately for each value passed to the node, including delayed passes, passes can be combined into subaggregations, and the subaggregations can be used when passing values. Subaggregations are stored at aggregation nodes as delayed passes, for example, in the form of a balanced search tree or an ordered array. In one embodiment, the following operations can be performed on subaggregations: P.Add(t,v): Adding the passes with the timestamp t and the value v to the subaggregation P. P.Drop(t): Remove the value with the timestamp t or after t from the subaggregation P. P.Append(Q): Appending the subaggregation Q to the subaggregation P.

[0062] In addition, the following two functions can be used for subaggregations: P.Key(): Returns the key of the subaggregation P. P.Value(): Returns the value of the subaggregation P.

[0063] An important aspect of a subaggregation (according to one embodiment of the invention) is the timestamp of the first propagation in the subaggregation. When a value is propagated from a node along its explicit outgoing connection to an aggregation node, as in Fig. When the process is mapped from node N to node S, a determination is made as to whether the delayed propagation at S is "blocked" by N. These delayed propagations are stored and combined into a subaggregation. The new propagation is added to this subaggregation using the Add operation (if no such subaggregation exists, a new one is created that contains the propagation). The subaggregation is then propagated to the remaining aggregation nodes until it is "blocked" or all other aggregation nodes have been visited. During iteration through the aggregation nodes, the Drop operation can be used to remove irrelevant propagations from the subaggregation. The Value function can be used to update the values ​​of the aggregation nodes.When a subaggregation is "blocked", the subaggregation is added to the current aggregation node using a key function, and the append operation can be used.

[0064] Efficient implementations of subaggregations are described below. A special case is considered where the monoid with domain D and the operation ⊗ also has an inverse function. -1 :D→D has. If, for example, ⊗ is addition over the integers, then -d is the inverse of d ∈ D. For this special case, a partial aggregation stores the passes in a queue (first in, first out). Furthermore, the combination of the values ​​of the passes is retained as a value, as in Fig. 10 is shown. The value of the subaggregation is updated accordingly when passes are added or removed.

[0065] As an example, consider an implementation that stores the passes in doubly linked lists with pointers to the beginning and the end. • Whenever a forward is added (P.Add), it is placed at the beginning of the list (see Fig. 10). In addition, the value of the subaggregation P is updated with the value v of the added pass, i.e., the value of the subaggregation P is set to v⊗P.Value(). • If a pass is dropped (P.Drop), it will be removed from the list at the end (see Fig. 10) If the value of the subaggregation P is updated with the inverse value v of the propagation, the value of the subaggregation P is also changed to P.Value()⊗v -1The method is set to remove all passes for the given timestamp t from P. Starting at the end of the list, iterates through the passes until it encounters a pass with a lower timestamp. The values ​​of the visited passes are combined, the value of the subaggregation is updated accordingly with the inverse value, and the passes are removed from the list.

[0066] In addition, P.Value() returns the value of the subaggregation P, P.Key() returns the timestamp of the first element in the propagation disk of P, and P.Append(Q) updates the value of P with the value of Q and appends the list of propagations of Q to the list of propagations of P.

[0067] For the variant where the list of appends is ordered by timestamp, it is assumed that an added append has a more recent timestamp. Similarly, a comparable assumption is made when appending appends. To implement P.Append efficiently, P.Append(Q) "steals" the list from Q and assumes that Q will no longer be used afterward. These assumptions are satisfied when passing values ​​to an aggregation node as described above.

[0068] The amortized worst-case complexity of the operations is O(1) for this implementation of subaggregations. Key observations include that (i) the value of P.Value() is not recalculated and (ii) P.Drop(t) performs at most linearly many ⊗ operations with respect to the added and undropped passes of P.Add(t,t) or P.Append(Q).

[0069] We will now consider an example of a general case where the monoid does not necessarily have an inverse function. Instead of a single queue, two arrays or lists are used to store the passes. Additionally, values ​​for subaggregations are stored to allow for quick removal of passes. An example of the corresponding struct type in the Go programming language might look like this: where "front" and "back" are slices, i.e., arrays with dynamic sizes. The passes at the front of the slice are ordered in descending order by their timestamps, and the passes at the back of the slice are ordered in ascending order. This allows for the rapid addition of new passes to the front slice and the removal of passes from the back slice. The implementation of the functions and operations for partial aggregations can be as follows, where k is the length of P.front and ℓ is the length of P.back, assuming, without loss of generality, that the partial aggregation P contains at least one pass, i.e., that both k and ℓ cannot be 0. • P.Key() returns P.front[k -1] if k > 0, and otherwise P.back[0].ts. • P.Value() returns P.val if ℓ = 0, and otherwise P.val⊗P.back[ℓ - 1] .comb. • P.Add(t,v) adds the propagation to the end of P.front and updates P.val accordingly, i.e., P.front is set to append(P.front,propagation{t,v}) and P.val to v⊗P.val. • P.Append(Q) combines the two front slices of P and Q; that is, P.front is set to slice Q.front, which is extended by slice P.front. P.val is set to P.val ⊗ Q.val, and P.back is set to Q.back. It is assumed here that slice P.back is empty. Since P "steals" the slices from Q, it is also assumed that Q is no longer used afterward. • P.Drop(t) updates the front and back slices of P as follows. • If k > 0 and P.front[0].ts does not exist before t: P.back is set to the empty slice. The propagations stored in P.front and after t are moved to P.back in reverse order. The corresponding comb values ​​in the entries of the slice P.back are set accordingly. Finally, P.front is set to the empty slice and P.val is set to the neutral element of the monoid. Otherwise, a binary search is performed in P.back to find the smallest index i where the entry has a timestamp not prior to t. The corresponding propagations in P.back are then dropped, i.e., P.back is set to P.back[:i].

[0070] Fig. Figure 11 shows a data structure of a partial aggregation with front and back slices according to one embodiment of the invention. Note that delayed propagations can also be deleted directly from the front slice. In this case, the back slice is first cleared, and the remaining entries from the front are moved to the back slice. An example of the above operations in the Go programming language can be found in Listings 1 and 2 in [reference missing]. Fig. 12 or Fig. 13, where the monoid is added to type PartialAggregation and the values ​​and timestamps are of type Machine-Integer for simplicity.

[0071] A similar assumption can be made as in the special case, e.g., that an added propagation has a smaller timestamp than the propagations already stored. Also as in the special case, the amortized worst-case complexity of the operations is 0(1). Other implementations for partial aggregations with similar complexity bounds are possible. For example, doubly linked lists can be used instead of slices. However, slices often offer slightly less overhead because they store their elements in successive memory locations. Another implementation is based on a tree-like data structure and a greedy approach to combining values, as described in D. Basin, F. Klaedtke, and E. Zalinescu: “Greedily computing associative aggregations on sliding windows,” Information Processing Letters, 115(2), 2015.Based on the described data structure and procedure, the number of `<` operations performed can be further reduced. This is of interest when `<` is a costly operation and the cost of maintaining the tree-like data structure is low compared to `<`. Finally, neither the greedy approach with its tree-like data structure described in D. Basin, F. Klaedtke, and E. Zalinescu: “Greedily computing associative aggregations on sliding windows” Information Processing Letters, 115(2), 2015, nor the “TwoStack” solution mentioned in K. Tangwongsan, M. Hirzel, and S. Schneider: “Optimal and general out-of-order sliding-window aggregation” in Proceedings of the VLDB Endowment, 12(10), 2020, applies in the case where data stream elements can appear out of order in data streams. Splitting or dividing gaps

[0072] According to one embodiment, upon receiving a new data stream element, a gap containing the timestamp of the data stream element in the graph-based data structure can be split. Splitting a gap can be performed as described in D. Basin, F. Klaedtke, and E. Zalinescu: “Runtime verification over out-of-order streams,” in ACM Transactions on Computational Logic, 21(1):5, 2020, and F. Klaedtke: “Method for operating a monitoring entity,” US 10,725,887 B2. The explicit vertical connections of the nodes should preferably be adjusted, while no adjustments are required for the implicit vertical connections. The pending and delayed propagations of the aggregation nodes should also preferably be adjusted. Furthermore, splitting a gap can trigger the propagation of values, possibly including some of the delayed propagations, and the deletion of irrelevant nodes. Eliminating gaps

[0073] According to one embodiment of the present invention, a gap can be removed from the graph-based data structure if it is known that the gap contains no time points. Such information can be received by means of so-called watermark messages, which inform the stream processor that all stream elements up to a specific time point have been received. Alternatively, sequence numbers can also be used to determine whether all stream elements were received within a specific time period. See D. Basin, F. Klaedtke, and E. Zalinescu: “Runtime verification over out-of-order streams”, in ACM Transactions on Computational Logic, 21(1):5, 2020.

[0074] As with the partitioning of a vulnerability, the elimination of a vulnerability can be carried out as described in D. Basin, F. Klaedtke, and E. Zalinescu: “Runtime verification over out-of-order streams,” in ACM Transactions on Computational Logic, 21(1):5, 2020, and F. Klaedtke: “Method for operating a monitoring entity,” US 10,725,887 B2. Pending and delayed propagations should again preferably be adapted.

[0075] As described above, the present disclosure improves and extends the graph-based data structure described in D. Basin, F. Klaedtke, and E. Zalinescu: “Runtime verification over out-of-order streams,” in ACM Transactions on Computational Logic, 21(1):5, 2020, and the optimized version thereof described in F. Klaedtke: “Method for operating a monitoring entity,” US 10,725,887 B2. For example, the present disclosure describes how values ​​can be efficiently aggregated over sliding windows by (1) delaying passes to aggregation nodes, (2) collecting the delayed passes to the node as subaggregations, and (3) passing the subaggregations to multiple nodes, correctly preserving the subaggregations during the passes. The values ​​of the stream elements are combined by an association operator and can be received in out-of-order order.

[0076] A similar situation to that described in the present disclosure is also considered in F. Klaedtke: “Efficient stream processing with data aggregations in a sliding window over out-of-order data streams”, US 2021 / 0124746 A1. In this disclosure, stream elements that do not have gaps between them are grouped, and their values ​​are aggregated together if the respective stream elements completely cover a time window. Such grouping also retains the aggregations for the leftmost and rightmost time windows that are completely covered by the grouping. These aggregations can be used to calculate the aggregated values ​​of the complete time windows within the grouping resulting from the merging of two adjacent groupings.

[0077] The setting of aggregation values ​​from unordered streams is also discussed in J. Traub, PM Grulich, A. Rodriguez Cuellar, S. Breß, A. Katsifodimos, T. Rabl, and V. Markl: “Scotty: General and efficient open-source window aggregation for stream processing systems,” in ACM Transactions on Database Systems, 46(1):1, 2021. The underlying idea of ​​Traub et al.'s work is the grouping of stream elements into “slices” and the separate value aggregation for each slice. These slice aggregations are then used to calculate the aggregation of the stream elements within a time window. That is, once all stream elements in a time window have been received, the slices within that time window are selected, and the slice aggregations are summed. This makes sense because Traub et al. assume that a slice is either entirely contained within a time window or not contained within that time window at all.A slice can be contained in multiple time windows, so slice aggregation is used multiple times in such cases. The architecture proposed by Traub et al. consists of components for initializing slices, updating slices when new stream elements are received, and calculating the aggregated values ​​from the slices. It should be noted that managing slices involves overhead. This overhead can become significant if, for example, there are many small slices, which is the case when time windows frequently overlap.

[0078] In contrast to the two aforementioned works, the partial aggregations in the present disclosure have low overhead and integrate seamlessly into the graph-based data structure of D. Basin, F. Klaedtke, and E. Zalinescu: “Runtime verification over out-of-order streams,” in ACM Transactions on Computational Logic, 21(1):5, 2020, and F. Klaedtke: “Method for operating a monitoring entity,” US 10,725,887 B2. For example, the partial aggregations according to the present disclosure are independent of the size of the time windows and are updated in real time. Another difference between the embodiments of the present disclosure is the direct support for composability. It should be recalled that the graph-based data structure can be structured horizontally in layers and vertically in segments.It is easy to combine and even nest aggregations by having multiple layers for the combinations and aggregations. The vertical links define the dependencies and determine where the values ​​must be passed on. It's also important to note that gaps are explicitly represented as segments. This has the advantage that, in certain cases, a value from a node in a gap, if known or inferred, can be passed upwards. This, in turn, can lead to an aggregation result being output earlier for a given time window.

[0079] Advantageous embodiments of the present disclosure include: 1) Delaying value updates to the preliminary aggregation value of a time window and combining multiple delayed value updates into a single value update for the time window; and / or 2) Real-time adaptation of a value update, consisting of multiple delayed value updates for a time window, to individual value updates for adjacent time windows. The adaptations involve adding and omitting delayed value updates and combining two such value updates. The delayed value updates are stored in an ordered manner such that (a) those at the boundaries (i.e., the first and last) can be accessed quickly, and (b) the delayed value updates are supplemented by partial (prefix and suffix) aggregations of the delayed value updates.

[0080] The technical improvements advantageously lead to better worst-case complexities and thus to performance and scalability improvements in the processing of data streams, especially in the calculation of out-of-order aggregations over data streams with large sliding windows or high data rate rates.

[0081] Embodiments of the present disclosure support aggregations with an underlying associative operator. The requirement for associative operators is common and widespread in stream processing when aggregating data; that is, associative operators already have broad applications. This is advantageous compared to the prior art, which is more restrictive, i.e., it only supports commutative operators.

[0082] In certain embodiments, a check to see if the values ​​of an incomplete time window meet a certain “monotonic” condition is not provided, since delayed transmissions may not be included in the aggregated value.

[0083] Implementations of the present disclosure can be used to differentiate IoT (Internet of Things) platform businesses (e.g., FIWARE). Stream processing can be an integral part of applications that collect and analyze data from IoT devices.

[0084] Embodiments of the present disclosure can be implemented to improve the security of IoT platforms and Security Operations Centers (SOCs) that analyze data streams.

[0085] Further relevant information (discussing a similar setting) can be found in J. Traub, PM Grulich, A. Rodriguez Cuellar, S. Breß, A. Katsifodimos, T. Rabl, and V. Markl, “Scotty: General and efficient open-source window aggregation for stream processing systems,” ACM Transactions on Database Systems, 46(1):1, 2021 (“Traub et al.”). With overlapping time windows, the approach of the present disclosure should scale better than that of Traub et al. and thus lead to better performance in computing aggregations over unordered (i.e., out-of-order) data streams.

[0086] One aspect of the present disclosure provides a method for computing aggregations in a sliding window over disordered data streams by delaying value propagation. The method comprises one or more of the following steps: 1) The status of a node becomes final, e.g., due to a newly received data stream element or because the node has received a value from a node at a lower layer; 2) The node initiates the propagation of its final value along its outgoing vertical connection to the nearest aggregation node on the upper layer. In particular, the propagation (i.e., the propagated value) can be added to an existing subaggregation of the aggregation node. The subaggregation can contain or consist of the delayed propagations at that aggregation node. 3) The aggregation nodes within the capture area of ​​the forwarding node are processed iteratively until the forwarding ends or is stopped; 4) When passing data to an aggregation node, the provisional value of the aggregation node is updated by the value of the subaggregation. When the aggregation node is complete, its value becomes final, and the aggregation node either outputs its value or passes it to a node at a higher layer. Passing on at that layer continues with the next aggregation node, dropping the irrelevant passes in the subaggregation and combining the subaggregation with the subaggregation of the next node; and / or 5) If a transfer at an aggregation node is delayed, the transfer can be resumed at a later time, e.g. together with a value received from another node on the lower layer.

[0087] As a person with ordinary technical knowledge would understand, all methods, devices, elements, units, and means described in this application could be implemented in software or hardware elements, or any combination thereof. All steps performed by the various units described in this disclosure, as well as the described functions intended to be performed by the various units, are to be understood as meaning that the respective unit is adapted or configured to perform the respective steps and functions.Even if, in the following description of exemplary embodiments, a particular functionality or step to be performed by external units is not reproduced in the description of a specific detailed element of that unit performing that particular step or functionality, these methods and functionalities can be implemented in appropriate software or hardware elements or any combination thereof.

[0088] With reference to Fig. 14. A processing system 900 may comprise one or more processors 902, a memory 904, one or more input / output devices 906, one or more sensors 908, one or more user interfaces 910, and one or more actuators 912. The processing system 900 may be representative of any computer system disclosed herein.

[0089] The 902 processors can comprise one or more different processors, each with one or more cores. Each of the different processors can have the same or a different architecture. The 902 processors can include one or more central processing units (CPUs), one or more graphics processing units (GPUs), integrated circuits (e.g., application-specific integrated circuits (ASICs)), digital signal processors (DSPs), and the like. The 902 processors can be mounted on a common substrate or on several different substrates.

[0090] The 902 processors are configured to perform a specific function, procedure, or operation (e.g., they are configured to enable the execution of a function, procedure, or operation), at least if one of the individual processors is capable of performing operations that embody the function, procedure, or operation. The 902 processors can perform operations that embody the function, procedure, or operation by, for example, executing code stored in memory 904 (e.g., interpreting scripts) and / or forwarding data through one or more ASICs. The 902 processors, and thus the 900 processing system, can be configured to automatically execute all the functions, methods, and operations disclosed herein. Therefore, the 900 processing system can be configured to perform each (e.g.,all) of the protocols, devices, mechanisms, systems and procedures described here are implemented.

[0091] For example, if the present disclosure states that a method or device performs task “X” (or that task “X” is performed), such a statement should be understood to mean that the processing system 900 is configured to perform task “X”. The processing system 900 is configured to perform a function, method, or operation, at least if the processors 902 are configured to do the same.

[0092] Storage 904 can include volatile memory, non-volatile memory, and any other medium capable of storing data. Each of these storage types can comprise multiple different storage devices located in various locations, each with a distinct structure. Storage 904 can also include remote storage (e.g., a cloud).

[0093] Examples of Memory 904 include non-transitory, machine-readable media such as RAM, ROM, flash memory, EEPROM, any type of optical storage medium such as DVD, Blu-ray® Disc, magnetic storage, holographic storage, HDD, SSD, any medium that can be used to store program code in the form of instructions or data structures, and the like. All methods, functions, and operations described herein may be fully embodied in tangible and / or non-transitory machine-readable code (e.g., interpretable scripts) stored in Memory 904.

[0094] Input / output devices 906 can include any component for data traffic, such as ports, antennas (i.e., transceivers), printed circuit boards, and the like. Input / output devices 906 can enable wired communication via USB®, DisplayPort®, HDMI®, Ethernet, and the like. Input / output devices 906 can enable electronic, optical, magnetic, and holographic communication with a suitable memory 906. Input / output devices 906 can enable wireless communication via WiFi®, Bluetooth®, cellular networks (e.g., LTE®, CDMA®, GSM®, WiMax®, NFC®), GPS, and the like. Input / output devices 906 can include wired and / or wireless communication paths.

[0095] Sensors 908 can acquire physical measurements of the environment and report them to the processors 902. The user interface 910 can include displays, physical buttons, speakers, microphones, keyboards, and the like. Actuators 912 can enable the processors 902 to control mechanical forces.

[0096] The Processing System 900 can be distributed. For example, some components of the Processing System 900 may reside in a remote hosted network service (e.g., a cloud computing environment), while other components of the Processing System 900 may reside on a local computer system. The Processing System 900 can have a modular architecture, where specific modules can perform a variety of the functions in Fig.The 9 features / functions shown are present. For example, I / O modules can include volatile memory and one or more processors. Another example is that individual processor modules can include read-only memory and / or local caches.

[0097] Although the subject matter of this disclosure has been illustrated and described in detail in the drawings and the preceding description, such illustrations and descriptions are to be regarded as illustrative or exemplary and not as limiting. All statements made herein that characterize the invention are likewise to be regarded as illustrative or exemplary and not as limiting. It is self-evident that changes and modifications can be made by those skilled in the art within the scope of the above description, which may include any combination of features from different embodiments described above.

Claims

[1] A computer-implemented method for calculating data aggregations in a sliding window over disordered data streams received by a distributed system (10) of data-generating components by delaying the passing of values, wherein the method is implemented in a processor (902) connected to a memory (904) storing a data structure comprising a hierarchical arrangement of nodes, wherein nodes on the same horizontal layer are associated with the same operator, the same initial value, and the same metric constraint, wherein the method comprises: Received, at a first aggregation node (20) of a plurality of aggregation nodes in a first time window on a first horizontal layer of the data structure, a final value from a first node in a lower layer of nodes below the plurality of aggregation nodes, wherein the final value comprises a data value and a timestamp, and wherein the first node is within a capture range of each of the plurality of aggregation nodes in the first time window; Creating a subaggregation of the first aggregation node (20) using the final value if no existing subaggregation of the first aggregation node (20) exists, or combining the final value with the existing subaggregation of the first aggregation node (20) to create the subaggregation of the first aggregation node (20) if the existing subaggregation of the first aggregation node (20) exists; iteratively passing the subaggregation of the first aggregation node (20) to the remaining aggregation nodes of the plurality of aggregation nodes in the first time window sequentially, with for each subsequent node of the remaining aggregation nodes a provisional value of the aggregation node being updated by the value of the subaggregation; Determine for each subsequent node whether the pass should be delayed; and Delaying the transfer of the subaggregation to the next aggregation node in response to the determination that the transfer should be delayed. [2] Method according to claim 1, further comprising that, when a status of an aggregation node of the plurality of aggregation nodes is final, a final value of the aggregation node is sent to a node on a layer above the first horizontal layer. [3] Method according to claim 1 or 2, wherein the final value of the first node has a value type selected from the group consisting of Boolean, Integer, Strings, Floating Point Numbers, Vector and Map. [4] Method according to any one of claims 1 to 3, wherein determining for a next node whether the transmission should be delayed includes determining whether the next node is waiting for a value from a predecessor node on the same horizontal layer as the first node. [5] Method according to any one of claims 1 to 4, further comprising resuming the transmission of a delayed partial aggregation at a later time in response to the reception of a value from another node on the lower layer by the node where the delay occurred. [6] Method according to any one of claims 1 to 5, wherein a partial aggregation is stored as a balanced search tree or an ordered array. [7] Method according to any one of claims 1 to 6, further comprising rejecting a delayed propagation of the partial aggregation at an aggregation node when it is determined that the aggregation node is no longer within the time window of the first aggregation node (20). [8] Network device in a distributed system (10), wherein the network device comprises: one or more processors (902); and a memory (904) that stores instructions and a data structure comprising a hierarchical arrangement of nodes, wherein nodes on the same horizontal layer are associated with the same operator, the same initial value, and the same metric constraint, wherein the instructions, when executed by the one or more processors (902), cause the network device to implement a method for calculating aggregations in a sliding window over disordered data streams received from data-generating components of the distributed system (10) by delaying the passing of values, wherein the method comprises: Received, at a first aggregation node (20) of a plurality of aggregation nodes in a first time window on a first horizontal layer of the data structure, a final value from a first node in a lower layer of nodes below the plurality of aggregation nodes, wherein the final value comprises a data value and a timestamp, and wherein the first node is within a capture range of each of the plurality of aggregation nodes in the first time window; Creating a subaggregation of the first aggregation node (20) using the final value if no existing subaggregation of the first aggregation node (20) exists, or combining the final value with the existing subaggregation of the first aggregation node (20) to create the subaggregation of the first aggregation node (20) if the existing subaggregation of the first aggregation node (20) exists; iteratively forwarding the subaggregation of the first aggregation node (20) to the remaining aggregation nodes of the plurality of aggregation nodes in the first time window sequentially, with for each subsequent node of the remaining aggregation nodes a provisional value of the aggregation node being updated by the value of the subaggregation; Determine for each subsequent node whether the pass should be delayed; and Delaying the transfer of the subaggregation to the next aggregation node in response to the determination that the transfer should be delayed. [9] Network device according to claim 8, wherein the memory (904) further stores instructions which, when executed by the one or more processors (902), cause the network device, when a status of an aggregation node of the plurality of aggregation nodes is final, to send a final value of the aggregation node to a node on a level layer above the first horizontal layer. [10] Network device according to one of claims 8 or 9, wherein the final value of the first node has a value type selected from the group consisting of Boolean, Integer, Strings, Floating Point Numbers, Vector and Map. [11] Network device according to one of claims 8 to 10, wherein the instructions for determining for a next node whether the transmission should be delayed include instructions for determining whether the next node is waiting for a value from a predecessor node on the same horizontal layer as the first node. [12] Network device according to any one of claims 8 to 11, wherein the memory (904) further stores instructions which, when executed by the one or more processors (902), cause the network device to resume the transmission of a delayed partial aggregation at a later time in response to the reception of a value from another node at the lower layer by the node at which the delay occurred. [13] Network device according to one of claims 8 to 12, wherein a partial aggregation is stored in memory (904) as a balanced search tree or an ordered array. [14] Network device according to any one of claims 8 to 13, wherein the memory (904) further stores instructions which, when executed by the one or more processors (902), cause the network device to discard a delayed propagation of the partial aggregation at an aggregation node when it is determined that the aggregation node is no longer within the time window of the first aggregation node. [15] A physical, non-transitory, computer-readable medium containing instructions which, when executed by one or more processors (902), alone or in combination, provide for the execution of a method for calculating aggregations in a sliding window over disordered data streams received from a distributed system (10) of data-generating components by delaying the transmission of values, the method comprising: Defining a data structure in a memory unit coupled to the one or more processors (902), wherein the data structure comprises a hierarchical arrangement of nodes, with nodes on the same horizontal layer being associated with the same operator, the same initial value and the same metric constraint; Received, at a first aggregation node (20) of a plurality of aggregation nodes in a first time window on a first horizontal layer of the data structure, a final value from a first node in a lower layer of nodes below the plurality of aggregation nodes, wherein the final value comprises a data value and a timestamp, and wherein the first node is within a capture range of each of the plurality of aggregation nodes in the first time window; Creating a subaggregation of the first aggregation node (20) using the final value if no existing subaggregation of the first aggregation node (20) exists, or combining the final value with the existing subaggregation of the first aggregation node (20) to create the subaggregation of the first aggregation node (20) if the existing subaggregation of the first aggregation node (20) exists; iteratively forwarding the subaggregation of the first aggregation node (20) to the remaining aggregation nodes of the plurality of aggregation nodes in the first time window sequentially, with for each subsequent node of the remaining aggregation nodes a provisional value of the aggregation node being updated by the value of the subaggregation; Determine for each subsequent node whether the pass should be delayed; and Delaying the transfer of the subaggregation to the next aggregation node in response to the determination that the transfer should be delayed.

Images