An Efficient Data Analysis Framework for Online Security Processing

Figure 8

The merging procedure in Reducer. For coming event, if it is a new stream item, we invoke the multiattribute index scanning procedure to add the item ID to the event list. Otherwise, if the coming event is an intermediate result from Mapper, we inspect the event list; if we find the ID, we inspect all query clusters to find satisfied queries and output the query ID.