Friday, November 07, 2008

CEP versus ESP - an academic exersise

I had a little mail conversation with Diplom-Informatiker Gerald G. Koch of the University of Stuttgart (Germany) on how in academia the difference between CEP and ESP is defined. I think it is interesting to share his explanation with the community (which he allowed me to, of course).


  • ESP = Event Stream Processing
  • CEP = Complex Event Processing
ESP has some specific characteristics:
  1. Events are assumed to be ordered in the stream
  2. A stream contains one or a small, previously known number of event types
  3. When correlating several event streams, it is assumed that events appearing in both streams in parallel also occurred at (nearly) the same time
  4. Aggregation on streams aims on finding trends or abrupt changes in trends
  5. ESP yields incomplete results, because the window is a constraint arbitrarily set on the event history, so that not all patterns that actually occurred may be detected.

CEP, on the other hand, works on complete event histories and check the history upon each arrival of a new event for patterns (well, at least theoretically; in practice, one would keep some knowledge in separate structures and try and complete or reinitiate those structures upon arrival of new events). An important distinction to ESP is that CEP works on "event clouds" - so events are not ordered regarding any relation (temporal, spatial, semantic).

A problem of both approaches is their non-determinism (different event instances may match a pattern). In CEP, you can use policies in order to make pattern detection deterministic (e.g., select only the most recent pattern, or all possible patterns even if they intersect). In ESP, applying policies is not appropriate because of its incompleteness.

However, these are theoretical problems and most probably are not the foremost focus for currently deployed systems.


Thanks, Gerald!


Opher Etzion said...

Hi Jack. Another distinction is that typically CEP works "event-at-a-time" and ESP "set-at-a-time", see my posting here:

While the theory is interesting, I think that in practice, we'll see hybrid models, as each of them has its own benefits.



Kate Summerville said...

CEP seems very interesting. How does one decipher the events in the cloud that they are presented? Or am I missing a key element here?

Rob 'Blu' Ray Williams said...

@Kate A more systemic example of CEP involves a car, some sensors and various events and reactions. Imagine that a car has several sensors—one that measures tire pressure, one that measures speed, and one that detects if someone sits on a seat or leaves a seat.