An overview of process query systems

Sensors produce large streams of raw events while instrumenting environments such as computer systems, communications networks, physical spaces, and human organizations. Extracting meaningful and actionable information from these events, however, remains a challenge. Process query systems, a new algorithmic and software paradigm, offer a powerful and generic way to address event-processing challenges. Our ability to instrument different environments has increased dramatically in recent years. Computer systems and networks now routinely include various performance monitors, firewalls, intrusion-detection systems, and application-logging agents. Researchers can deploy sensor networks in physical environments to record acoustic, seismic, infrared, video, electromagnetic, and other types of measurements. These networks also can monitor and extensively archive communications and financial and social transactions among large communities of people and organizations. We now have a tremendous amount of data coming at us; the question remains what to do with it. Generally speaking, the underlying purpose of instrumenting environments is to better understand “what is going on, ” formally known as situational awareness. In the context of computer security, situational awareness typically means knowing which monitored systems are under attack and the nature of those attacks. For a physical sensor network within a building or extending across a geographic region, this might mean being cognizant of certain objects and activities, such as a fire, people, animals, or vehicles and their location. In industrial and manufacturing systems, situational awareness means detecting infrastructure failures and diagnosing their causes.