An Efficient Data Analysis Framework for Online Security Processing

Figure 2

Online execution of cloud stream querying. We divide the querying of coming stream item into two phases: Map phase and Reduce phase. For every coming stream item, we first divide the item into key/value pairs according to the attributes. Then, in the Map phase, we dispatch key/value pairs to different LCN-Indexes to search the satisfied predicates. All these intermediate satisfied predicates are shuffled to Reducer according the stream ID. Last, in the Reduce phase, we use efficient algorithm to merge all intermediate results to compute all satisfied queries and output.