DE102012112253A1 - Method for improving performance of event-based distributed analysis system, involves distributing changed distribution suggested by event detectors on computing node if fitness value is met with predesignated decision criterion - Google Patents

Abstract

The method involves determining a measure of efficiency of an analysis system indicating fitness value and determining a proposal for a modified distribution of event detectors (22a-22g) to computing nodes (20a-20c). The fitness value is compared with a predetermined decision criterion. A measure for efficiency of indicating fitness value of the analysis system is determined. Changed distribution suggested by the event detectors is distributed on the computing node if the fitness value is met with a predesignated decision criterion. Independent claims are also included for the following: (1) a power conditioner for improving performance of an event-based distributed analysis system (2) a computer program comprising a set of instructions for improving performance of event-based distributed analysis system.

Description

Embodiments of the present invention relate to apparatus, methods, and computer programs for improving performance of an event-based distributed analysis system.

Event-based processing is a technique of computer science. It is suitable for operating and expanding flexible, scalable systems with autonomous, heterogeneous components. The fields of application are manifold. From automatic information distribution to network monitoring in IT security and software interoperability modules to mobile and ubiquitous systems and sensor networks.

The event-based approach, generally speaking, is a solution to the problem of limited scalability and flexibility of classic so-called middleware. The concept of middleware serves to mediate between heterogeneous systems. As the size and dynamics of a system grow, tight coupling, such as polling request / reply architectures, is a major drawback. A more appropriate solution should provide asynchronous and decoupled methods. Instead of the polling associated with request / reply, an autonomous pushing is desired, which conceptually corresponds approximately to a publish / subscribe. Event-based processing accomplishes this. The components, called event detectors, communicate with each other via notifications that signal that an event has occurred. If a detector relies on a special notification, it can subscribe to it. The so-called middleware has the task of transparently communicating between the producer ("producer") and the consumer ("consumer") of the notifications ("noti fi cation"). That is, a producer has no knowledge about its consumers, and possibly vice versa, in contrast to the polling mode.

This middleware is also referred to below as "EventCore". The messages or notifications generated by the event detectors or the event detectors are subsequently called events.

In an exemplary application, an event processing system is used for distributed evaluation of the positional data stream of a sports event location system. Thousands of positions or position data are processed per second. More than 140 wireless sensors transmit 200 positions per radio, some even 2000. In total, this results in more than 50,000 positions per second. A goal of the evaluation of the positional data stream is to automatically detect certain interactions of the players in a football game that are equipped with such sensors and thus, for example, to provide analyzes to a reporter or to automate soft camera shots. In order to achieve the latter goal in particular, events should be determined or calculated approximately in real time.

To generate the position data stream itself, a wireless sensor network of different technology may be used to locate, for example, the players of a sporting event and / or other objects such as balls or the like. Localization in this context means the determination of a geographical position, whereby the "tracking" means to perform the localization in short time intervals in order to be able to determine the position or other kinematic properties of the observed object observed and temporally tracked. The position data analyzed by means of the event-based processing approach can thus be used to observe or characterize players or other objects in a sporting event, such as a soccer game, an American football game, rugby, tennis or the like. By analyzing the position data of the players and / or the game devices, it becomes possible to derive statistical information about the entire sporting event. These can, for example, affect an entire game or individual players.

Although the precise determination of the pure position data is of secondary importance for the subsequent considerations for the evaluation of the same by means of an event-based system, it goes without saying that these can be obtained on the basis of a wide variety of technologies. For example, the position information may be obtained by evaluating a wireless signal or a magnetic field. In order to generate these, transmitters and / or receivers, generally speaking sensors, can be attached to the objects to be observed. For this purpose, corresponding receivers or transmitters can be arranged, for example, at predetermined positions around the playing field or the area of interest. For example, the evaluation of signal strengths, signal propagation times and / or phases can be used to generate a sensor data stream that indicates the geographical position of individual players or objects at different times. Such For example, the position data telegram may be provided with a timestamp indicating when the object was at the observed location. As additional or derived information, for example, other kinematic information, such as the speed, the acceleration, and so on, can be obtained, supplementing the positions given in the form of X, Y, and Z coordinates, for example. In the following considerations, this type of information, that is, the position information and / or the corresponding kinematic data supplied by the sensor system, are referred to as raw sensor data or as primitive events on which events or derived events are based.

The tracking of objects in a sports event or in a game such as football with reasonable accuracy so easily generates an extremely high number of sensor data. By way of example, tracking football may be considered as requiring, if an accuracy of approximately 3 cm is required, to determine the position of the ball 2,000 times per second, assuming that the ball has a maximum speed of 150 km / s. h can reach. In addition to this high number of samples per second, the position of the players must still be determined with appropriate time resolution, so that, for example, in the case of a football match, a team equipped with a reasonable number of sensors will readily produce the already mentioned 50,000 position data or raw data telegrams per second can. Analyzing this data in approximate real-time can prevent, by an event-based approach, that any element determining such an event in the analytic network must have access to all positional data collected at a time.

The events or events themselves can be complex and generated on the basis of dependency hierarchies. For example, a ball must first be in the vicinity of a player before a shot detector can begin its work and make further calculations. Real-time demands and hierarchical dependencies result in new tasks. For example, the latency of the network connecting the EventCores should be as low as possible, otherwise the delays will spread through the hierarchy. In addition, the calculation nodes themselves must not be overloaded by detectors, as this increases the latency in the event generation itself and in extreme cases, the entire system could be blocked.

Apart from this so-called "event broker congestion", in which individual compute nodes are overloaded, so-called "network congestion" can also occur. If its bandwidth is or becomes a limiting factor, the latency of the system also increases. The timing of the event detection then shifts backwards and may also lead to problems and overhead in managing the order of incoming events in event detectors of higher hierarchical levels.

In a homogeneous gigabit cluster network, "event broker congestion" and "latency minimization" can play a central role. But as soon as, for example, smartphones are added via Wireless LAN (WiFi) as a calculation node, the data rate of the network can also become an important problem or even a limiting factor.

By the above-described complex dependency of the individual events on each other and by different events to be detected in the course of a game, for example, when analyzing a sports event, a special requirement profile arises. While in other scenarios, given a given number of computational nodes, the distribution of the individual event detectors to the computational nodes can be optimally determined in advance by an a priori knowledge of the occurrence probabilities of individual events, this is not possible when analyzing a positional data stream of a sporting event.

Thus, using an event-based distributed analysis system, the performance of the system may vary or decrease with increasing delay, for example, by increasing the overall latency of the system, that is, the time that elapses until a statement about a desired event can be made. This can be caused, for example, by the fact that the network traffic between individual nodes or between individual compute nodes causes the network to be overloaded and thereby significantly increases the signal propagation times or the detection times, if the statistical dependencies between the individual event detectors do not are predictable or change over time.

There is therefore a need to improve the performance or the stability of an event-based, distributed analysis system.

This object is achieved by devices, methods and computer programs with the features of the independent claims.

Embodiments of the present invention make this possible for an event-based distributed analysis system in which a plurality of event detectors each detecting the occurrence of an event can be executed on a plurality of different computing nodes connected via a network. To facilitate this, in accordance with some embodiments of the present invention, first, for a given distribution of the plurality of event detectors to the plurality of compute nodes, a fitness value is determined that indicates a measure of performance of the analysis system. Furthermore, a proposal for a changed distribution of the plurality of event detectors to the plurality of computational nodes and a further fitness value is determined for the proposed modified distribution. A subsequent comparison of the further fitness value with a predetermined decision criterion makes it possible to make a statement about the performance of an event-based analysis system based on the proposed distribution of the event detectors on the computation nodes for the instantaneous statistical dependence between the event detectors. Inasmuch as the further fitness value satisfies the predetermined decision criterion, the plurality of event detectors are distributed to the plurality of compute nodes according to the proposed modified distribution. That is, if the proposed changed distribution satisfies a criterion dictated by the fitness value definition and the decision criterion representing the performance of the analysis system, the plurality of event detectors are distributed to the plurality of compute nodes according to the proposed changed distribution.

It goes without saying that, according to the embodiments of the invention, not only a single fitness value for a single proposed changed distribution can be determined during an iteration of performance improvement. Rather, for each iteration for a plurality of proposed modified distributions of the event detectors to the plurality of computational nodes one fitness value can be determined which is compared with the remaining fitness values and with the fitness value for the current or the given distribution, before a decision on one possible redistribution of the event detectors is made.

Further advantageous embodiments and further developments are the subject of the dependent claims.

A fitness value in the sense of the above-described method can contain a statement about any size of one or all components of the system that affects a performance of the event-based distributed analysis system. According to some embodiments, the fitness value includes information about a computational load caused by the event detectors on the individual compute nodes to prevent the overload of a single compute node from rendering the system inoperable or degrading the performance of the system.

According to a further embodiment, the fitness value comprises information about a utilization of the network connections of the network, by means of which the computing nodes of the analysis system are connected, in order to be able to prevent a standstill or an increased latency of the analysis system by an overload of the network.

According to further embodiments of the invention, the fitness value comprises information about a signal propagation time of the events transmitted over the network in order to prevent the latency of the overall system from increasing so much that the desired information is no longer provided in the required period of time can be. The information about the signal propagation time may depend, for example, on the configuration of the entire system. In particular, events which have to be transmitted from one computing node to another computing node, since the event detectors which communicate with one another run on different computing nodes, lead to an increase in the signal propagation time or the latency of individual events and / or of the overall system.

Some embodiments of the invention may use a fitness value that describes one of the parameters described above to optimize the performance of the analysis system for that particular parameter. In alternative embodiments or definitions of fitness values, it is also possible to incorporate information about several or all of the abovementioned parameters into the calculation or determination of the fitness value, for example depending on the relative Weighting of the individual aspects to simultaneously improve the performance of the analytical system with respect to all of the above parameters.

According to some embodiments of the invention, the fitness value is determined to be increased at an event transmitted between individual event detectors on the same compute node, since then typically there is no increase in signal propagation time due to transmission in the network and, moreover, no additional network load is generated. This statement applies when the definition of the fitness value is such that a high fitness value reflects a more favorable system configuration. In alternative embodiments, the definition or determination of the fitness value may also be such that a low fitness score reflects better system performance.

While according to some embodiments of the invention, the decision criterion is satisfied when the further fitness value is greater than the fitness value, the decision criterion according to further embodiments is only satisfied if the further fitness value is greater than a sum of the fitness value and a load factor, which is a measure of one includes preliminary performance degradation in distributing the plurality of event detectors to the plurality of compute nodes according to the proposed modified distribution. These exemplary embodiments can thus take into account the fact that a redistribution of the event detectors initially results in an additional network load or latency.

According to some embodiments of the present invention, the proposal for redistributing the event detectors to the compute nodes is determined using a heuristic, for example using an algorithm from the group of genetic algorithm, "cuckoo search", modified cuckoo search, particle swarm and hybrid "cuckoo search "/ Particle swarm algorithm. The selection of one of the mentioned algorithms can, depending on the boundary conditions, lead to a rapid convergence of the method or to a rapid finding of an optimal solution for the distribution of the event detectors to the computational nodes.

In applying the method to improve the performance of an event-based analysis system to analyze events occurring during a sporting event, events may be either primitive events directly based on position data of a sensor network or derived events based on primitive events.

In accordance with some embodiments, to obtain the information necessary to determine a fitness value for the given distribution and also for the proposed distributions, each of the event detectors and / or the compute node will provide information about the number of event detectors to each of the event detectors other event detectors transmitted events determined. Additionally or alternatively, according to alternative embodiments, information about an amount of data that the respective event detector has transmitted to each of the other event detectors is received to possibly further improve information or prognosis of the network load that has occurred.

According to some embodiments of the invention, for distributing the plurality of event detectors to the plurality of compute nodes in accordance with the proposed modified distribution, a control message generating a distribution of the plurality of computation is generated by a performance enhancer or a process running on an independent entity Event detectors on the plurality of compute nodes according to the proposed modified distribution causes. This may make it possible to perform the method for improving the performance on a component independent of the other components of the analysis system, for example a CPU or a software running in an independent process.

Some embodiments of the present invention will now be explained in more detail below with reference to the attached figures. Show it:

1 : An example of the relative dependencies of the events produced by different event detectors in a football game;

2 : An example of an event-based analysis system;

3 : A schematic block diagram of an embodiment of a method for improving performance of an event-based analysis system;

4 : A graphic illustration of a relative dependence of different event detectors to illustrate the mathematical representation of their dependence;

5 : An example of different dependencies between eight event detectors of an example configuration of an event-based distributed analysis system;

6 : An example of two distributions of in 5 shown event detectors on two different computational nodes;

7 : An illustration of the optimal distribution of event detectors in relation to the latency of the system 5 and 6 configurations shown on the two compute nodes;

8th : An example of a simulation that improves the performance of the 5 to 7 schematically illustrates event-based analysis system when using an embodiment of the method according to the invention;

9 : An illustration to understand a genetic algorithm;

10 : An illustration for a better understanding of a "cuckoo search"algorithm;

11 : A graphic illustration of a dependence between different event detectors;

12a -D: a plurality of graphs illustrating the approximation of the fitness value to a theoretical maximum for different heuristics for determining a changed distribution of Eregnisdetektoren; and

13 : An embodiment of a performance enhancer for improving performance of an event-based analysis system.

Exemplary embodiments will now be described with reference to the accompanying figures. It should be understood in advance that the figures are not necessarily drawn to scale and that in order to highlight certain features or properties, certain components may be artificially emphasized using a different line width or hatching.

It is explicitly pointed out that further exemplary embodiments should not be restricted by the specific implementations shown in the following figures. In particular, the fact that certain functionalities are described in the following figures with respect to specific entities, specific functional blocks or specific devices should not be construed to be or even need to be distributed in other embodiments in the same manner. In other embodiments, certain functionalities associated with subsequently separate components or units may be grouped together in a single component or in a single functional element, or as functionalities unified in a single element may be implemented in separate functional units or by a plurality of separate components.

It is further to be understood that when a particular element or component is referred to, coupled to, or connected to another element, it is not necessarily meant to be directly, directly connected, coupled or attached to the other component this should be connected. If this is meant, it is explicitly pointed out by describing that the element is directly connected, directly coupled or directly connected to the further element. This means that there are no intervening, an indirect coupling or connection or connection mediating further elements. In addition, in the following figures, identical reference numerals designate identical, functionally identical or functionally similar components, which can therefore be exchanged substitutionally between the different exemplary embodiments described below. Therefore, for a detailed description of such a component, which is shown in a figure, the description of the corresponding component or component in another figure can be used.

Before the discussion that follows, it should be noted that although an embodiment of a method for improving the performance of an event-based analysis system with respect to an application in a football game will be discussed in the following sections, there are others Of course, embodiments of the methods may be readily used in other application scenarios for event-based analysis systems.

It should also be noted that the following terms the improvement of performance and optimization are used largely synonymous and should be understood.

1 shows for better general understanding an example of a dependence between event detectors in a system for analyzing the events in a football game. Based on a stream of primitive events 2 , Which essentially contain information about a position of an object and possibly additionally about further kinematic variables of the object, may for example be a first event detector 4 a derived event 6 determine when the ball has changed direction. This event may be from a second event detector 8th be received. A third event detector 10 can be another event 12 detect that indicates that a particular player is near the ball. Unless the second event detector 8th in a predetermined temporal correlation both of the aforementioned events 6 and 12 detected, this may indicate that the event detector 10 assigned player hit the ball.

2 schematically shows a highly simplified example of an event-based distributed analysis system in which seven event detectors are executed on three different compute nodes. The three compute nodes 20a to 20c are over a network 22 connected with each other. Although in 2 an Ethernet with a schematically illustrated central switch 24 is shown as a network in which the individual compute nodes each directly to the switch 24 It should be understood that in alternative embodiments, any other types of networks may be used to interconnect the compute nodes, and in particular, over different network technologies in a heterogeneous system.

The event detectors 22a and 22b be in the given distribution of event detectors on the compute node 20a executed, the event detectors 22c and 22d on the compute node 20b and the event detectors 22e to 22g on the compute node 20c , For example, a configuration degrading the performance of the system may occur when too many event detectors are executed on a single compute node, so that it is overloaded and can only provide the results with a time delay due to CPU overload. Another scenario in which system performance or degradation may occur is when too many events have to be transmitted over the network between the individual event detectors. If this results in an overload of the network or a single connection in the network, this also leads to an increased processing time or even a breakdown of the system. Even without congestion of the network, unfavorable performance degrading situations may occur, as any message transmitted over the network, or any event transmitted over the network from one event detector to another event detector, will propagate a run time or signal propagation time over the network needed. For example, based on 1 illustrated hierarchical dependence of the event detectors means that in extreme cases, these different signal occurrences add up to a possibly unacceptable large total latency.

As already mentioned, the word optimization should be used below to denote that process in which an optimal or performance-improving distribution of the event detectors or event detectors to the computers or computational nodes in the network is calculated. This may be necessary because, in extreme cases, suboptimal distributions can render the results of the calculations useless. Apart from the prevention of worst-case scenarios, a good division of labor can also improve the efficiency of the system. Due to the real-time requirement of the system, data dependencies among the detectors require the lowest possible latencies in the calculation and delivery of results. If event messages arrive too late at a detector, for example, the internal administration effort and thus possibly the computational load also increases.

If two dependent detectors are running on the same computer, the event notifications or events can be transmitted locally and do not need to be sent over the network. Overloading of the network and the processors must therefore be avoided and the latencies between the dependent detectors minimized.

• • Die maximale Anzahl der Eventdetektoren pro Gerät, um die Überlastung des Prozessors zu vermeiden,
• • die Anzahl der versendeten Events, die die Netzwerklast repräsentieren, und
• • die Netzwerklatenz der Geräte.

Specifically, an optimization algorithm can work on the basis of the following information:

• • The maximum number of event detectors per device to avoid overloading the processor
• • the number of sent events representing the network load, and
• • the network latency of the devices.

The probability of the events to be recognized are generally unpredictable, ie a priori unknown. An event is, for example, that a soccer player kicks a ball and scores a goal. When the soccer player, ball and goal positions deliver values that are close enough to each other in the correct order, events are generated and sent. This knowledge is important for the choice of the calculation time. The most sensible thing here is to constantly monitor and redistribute, since unpredictable load distributions and latencies can change.

The dependencies of the event detectors with each other correspond to a directed graph, which in special cases can also include loops. Several tens of thousands of positions per second reach the detectors listening on the multicast address associated with the event. These detectors determine on the data basis whether or not their event to be published has occurred. If yes, then you send a data packet (event) to the network yourself.

Part of the task is thus to group the detectors based on their dependencies on the individual compute nodes in such a way that as few packets as possible are sent out of the groups. The group size is appropriate to avoid overloading individual nodes, increasing latency. The already discussed 1 shows an example of such a dependency between possible groups for a group size of two. Besides the three possibilities shown 14a . 14b and 14c In order to run two event detectors on a respective computational node, theoretically there is also the possibility to run each detector on its own node, or all on a single node. In the first case, the reason would be an extremely high CPU utilization by each detector, in the second case a low in favor of minimal latencies and network traffic.

Since each detector can run on each node, and heterogeneous nodes are allowed, there are node ^{detectors of} different combinations. As a result, the search space grows exponentially with the size of the dependency graph to a base that matches the number of machines or compute nodes available in the cluster. For example, a typical dependency graph of the event detection system at football matches may consist of 482 event types (multiple per detector) and should be executed in a cluster of 12 hosts of two quad-core CPUs, for a total of 96 compute nodes.

n

Anzahl der Detektor bzw. der Ereignisetektoren

m

Anzahl der Hosts bzw. Rechenknoten

x_i,k, x ∈ {0, 1}

Detektor i ist Host k zugeordnet

t_i,j

Anzahl der Events, die von Detektor i zu Detektor j geschickt werden

l_i,j

Latenz zwischen Host i und j

p_i

Ressourcenauslastung (CPU, evtl. Speicher ..) durch Detektor i

P_k

Verfügbare Ressourcen von Host k

M

Konstante obere Grenze der Detektoranzahl je Host

c₁, c₂

Gewichtungskonstanten

Taking into account the potentially degrading effects, the optimization problem for improving performance can be expressed in general terms as mixed-integer nonlinear programming (MINLP). This means there are both binary and integer variables. Integer Programming belongs to the class of NP-Complete Problems. If, as described above, CPU load, data transfer and latency are to be minimized, the required variables or variables can be defined as follows:

n

Number of detectors or event detectors

m

Number of hosts or compute nodes

x _{i, k} , x ∈ {0, 1}

Detector i is assigned to host k

t _{i, j}

Number of events sent from detector i to detector j

l _{i, j}

Latency between host i and j

p _i

Resource utilization (CPU, possibly memory ..) by detector i

P _k

Available resources from host k

M

Constant upper limit of the number of detectors per host

c ₁ , c ₂

weighting constants

In the following, for simplicity's sake, it is assumed that the data volumes in the transmission of a single event are constant, and the signal transit time between the individual computational nodes or hosts is fixed in time. In addition, as an alternative to an explicit calculation or an explicit observation of the computational load on the individual computational nodes, a maximum permitted number of event detectors per computational node is assumed in the subsequent simplistic consideration of the problem without restricting the general public.

The formulation as MINLP is as follows.

The first sum sums up the events t _{i, j} transmitted in the network between detector i and j:

The second sum adds up the latency l. Find the minimum sum with respect to different values for x _{i, j} . The first constraint is:

It limits the number of detectors of the same type that are allowed to run simultaneously in the network to one. Due to the simplifications in terms of the workload, instead of the constraint:

The superseded constraint would force the con fi gurations of detectors on the computers to a given level of available resources per computer. The new constraint simplifies this insofar as only a maximum limit M of active detectors on the computer has to be taken into account.

Before a specific example for the representation of the possible solutions as well as a corresponding fitness function is discussed in more detail, it is explained by means of 3 once again schematically shows an embodiment of a method for improving a performance of a schematically event-based distributed analysis system.

In an evaluation step 42 For example, for a given distribution of the plurality of event detectors to the plurality of compute nodes, a fitness value is determined indicative of a measure of performance of the analysis system.

In a search step 44 a proposal is made for a changed distribution of the plurality of event detectors to the plurality of compute nodes.

In a new evaluation step 46 another fitness value is determined for the changed proposed distribution.

In a comparison step 48 the further fitness value is compared with a predetermined decision criterion. In a distribution step 50 the plurality of event detectors is distributed to the plurality of compute nodes in accordance with the proposed changed distribution insofar as the further fitness value satisfies the predetermined decision criterion. As in 3 The method can also be carried out successively in several iterations, with an actual redistribution in the distribution step 50 only after a predetermined number of iterations.

In the following presentation of a concrete implementation or a concrete example, the presentation of the possible solutions is described first. Based on this, the heuristics common fitness function is presented, which evaluates the solutions during the procedure or calculates a fitness value for each possible solution.

The representation of solutions (of possible distributions of the event detectors) used as integer vector X → abstracts from the level of the actual names of the detectors and enables efficient processing due to the compact storage.

Each line i in X → corresponds to an event detector or an event detector. The entry x _i is a number associated with a host or compute node running an EventCore.

A solution vector X → = {0, 0.5} ^T thus means that the event detectors or the detectors # 1 and # 2 run on the EventCore 0 and the detector # 3 is assigned to the EventCore 5. The dependencies among the detectors are modeled similarly:

For each detector, the index of successor and predecessor detectors is stored.

der in 4 gezeigten Abhängigkeit zwischen den Ereignisdetektoren 0, 1 und 2.The first detector, represented by the first vector of the matrix N, has the n-many successors x _{0, i} .

the in 4 shown dependency between the event detectors 0, 1 and 2.

The number of received events is entered separately per event detector in a table, the latency is written into a simple array per host or compute node.

The calculation of the fitness of the different solutions is performed extremely often in evolutionary algorithms or heuristics, and should therefore be calculated efficiently.

wobei t_i,j die Anzahl der innerhalb eines Beobachtungszeitraumes vom Rechenknoten i zum Rechenknoten j übertragenen Ereignisse angibt,
a_i,j = 1 wenn der Ereignisdetektor i und der Ereignisdetektor j auf demselben Rechenknoten laufen, 0 sonst;
b_i,j = 0 wenn der Ereignisdetektor i und der Ereignisdetektor j auf demselben Rechenknoten laufen, 1 sonst;
l_i,j = ein die zusätzlich Latenz bei der Übertragung eines Ereignisses vom Rechenknoten des Ereignisdetektors i zu dem Rechenknoten des Ereignisdetektors j angebender Faktor; und
c₁ und c₂ statistische Gewichte sind.The problem-adapted fitness function has the following form for the solution vector X →:

where t _{i, j} indicates the number of events transmitted from the computing node i to the computing node j within an observation period,
a _{i, j} = 1 if the event detector i and the event detector j are running on the same computational node, 0 otherwise;
b _{i, j} = 0 if the event detector i and the event detector j are running on the same compute node, 1 otherwise;
l _{i, j} = a factor indicating the additional latency in the transmission of an event from the computational node of the event detector i to the computational node of the event detector j; and
c ₁ and c _{2 are} statistical weights.

The constants c ₁ and c ₂ weight the transmitted data and the latencies between the hosts. If a CPU load is to be detected explicitly, then you can extend the function f (X →). So far, the maximum of the detectors or event detectors per host or computational node is specified and deducted when exceeding a so-called penalty value from the fitness value. The amount of fitness increases as more detectors receive their events locally from their producer, with the number of event transmissions avoided over the network, and decrease as more events are subscribed to by other detectors (on latency hosts). For example, the weighting of the three criteria, network load, CPU load, and network latency, can be interpreted to mean that the number of detectors per host has the most weight. The second most important is the network load, which is considered stronger than the latency as the packet rate increases.

The fitness function can be represented in the form of a pseudocode, for example:

The above algorithm of the fitness function examines or determines a fitness value for a possible solution. For each entry of the configuration vector config, two cases are distinguished, on the one hand, that the predecessor detector is located on the same host, or on another. The con fi guration vector con fi g is the representative of a solution vector X →. All predecessors of the detector number i are analyzed in the vector prev. If one of them has the same entry in con fi g, then they are assigned to the same host. The peculiarity that is additionally included in the code is that there can be special dependencies. In the so-called secure subscriptions (sec), the receiver B confirms to the transmitter A that the event has arrived. This creates more traffic, which is also considered.

Based on 5 to 8th is illustrated below how an embodiment of the present invention results in that the performance of an event-based analysis system can be improved. To simulate a dynamic analysis system, subsequent event detectors are implemented, which have different active dependencies over time. In this way a change of the load distribution is simulated. A previously optimal distribution can be so suboptimal. The goal is to show that the module is able to con fi gure ever better distributions in terms of global network load.

Specifically, two computers are created in a simulation environment, which are interconnected via Ethernet. Both execute an EventCore, which in turn starts four event detectors each. One of these event detectors sends a total of 1500 events every 200ms and is the root element of a dependency chain that is in 5 is shown. The phases I and II of different dependency alternate every 500 sent by the detector 0. Events off. Specifically, detectors 1 and 4, after receiving 500 events from detector 0, send out other events, thus changing the course of the processing chain. After 1000 received events from detector 0 both detectors 1 and 4 return to their original mode.

For the simulation, there is no global, externally readable map of the dependencies of the detectors, which is why the method is based on the detectors activated in the network and their subscriptions or their dependencies. For this, all known EventCores are successively asked about their currently active detectors via a TCP connection. After that, a similar mechanism retrieves the number of events sent per event ID. Since it is now known how many events have been sent, one can draw conclusions about the number of received packets at the subscribing detectors. If all active detectors are known, then the dependencies of the detectors are resolved via local data structures of the EventCore. The heuristic then searches for a better distribution based on the current distribution and the information provided. If one is found, then the detectors are migrated to the more favorable con fi guration.

6 shows by different hatching the distribution of the different event detectors 1 to 7 on the two computational nodes A and B at the beginning of each phase.

How out 6 As can be seen, the initial distribution of the detectors on the event cores A and B was chosen as inefficient as possible in order to demonstrate the adaptability of the method. 6 shows the groups or the distribution of the event detectors 0 to 7 on the computing nodes A and B, with which the EventCores are respectively started. In this con fi guration, each event must be transmitted over the network to another EventCore to get to its Subscriber. Here, no location can be exploited on the EventCores.

In 7 the optimal distributions are shown with a maximum group size of 4. Only the event of the detector 0 has to be forwarded to the other group of the test setup, the remaining data packets are distributed locally by the respective EventCore.

To test the method in this experimental set-up, the CS / PSO algorithm described below for determining a proposed change of the distribution of event detectors 0 to 7 to computing nodes A and B was set to 10,000 iterations. With this problem size, this corresponded in the test system to a running time of the method of about one second. After each run of the procedure (each calculation) and a possible redistribution, 4 seconds were waited before a new data collection (in the polling procedure) is started. In this period, which is just over 5 seconds, counters run in each EventCore and register new event transmissions. On the basis of these counters, the method or a performance improver implementing the method can start new calculations following the data collection.

8th shows in the y-axis the input and output of all event transmissions of the entire network. The transmissions of all network interfaces are summarized to show at a glance the global load caused by the transmission of the events. The test lasted 300 seconds and every 100 seconds the Event processing system (EPS) switched between phases I and II. The graph 60 stands for the static and the graph 62 for the distribution made dynamically by the exemplary embodiment of the method. The graph 64 FIG. 12 shows the network load for each optimal distribution of the event detectors 0 through 7 on the compute nodes A and B, which is regularly achieved by the method for improving performance. It can be seen, in particular, that after a short transitional period, which is due to the above-mentioned structural prerequisites, a better or optimal con fi guration is achieved.

The redistribution at second 100 is in 8th shown in detail on the right. There is also the transitional period visible. The graph 66 (Polling) in the right hand representation of 8th illustrates the data transfers that occur when querying the counter readings and when relocating the detectors between the EventCores. The polling for querying the various counter counts of the EventCores takes place regularly, so also by 100 second. So this polling still provides the numerical values of the dependencies from phase I. A calculation of the fitness function based on these data therefore initially gives no indication of the need for re-sorting the event detectors. The con fi guration is therefore stable until the next interrogation from the 105th second.

The slightly lower amount of event transmissions in this phase is due solely to the different active dependencies between the event detectors. The polling from second second 105 now provides a mix of meter readings from both phases, which affects the calculated distribution, which applies from the 110th second. Only the query for the 112th second provides the numerical values that apply purely to the distribution of the second phase. The optimum minimum is reached from the 116th second.

After the previous considerations based on the 5 to 8th have shown that the performance of an event-based distributed analysis system can be significantly improved by means of embodiments of inventive method, will be discussed below some possible methods how a proposal for a modified distribution of the plurality of event detectors can be determined on the plurality of computational nodes.

The problem of finding new possible configurations or new possible distributions of the plurality of event detectors on the plurality of computational nodes can be solved by constantly observing the problem with, for example, a heuristic algorithm. In the sections that follow, various methods are presented that can be used to determine a proposed change in the distribution of the plurality of event detectors to the plurality of computational nodes, which may be heuristic search algorithms, for different configurations of the analysis system to be tested Find available search space.

Although a brief overview of various heuristics is given below without any claim to completeness, it is of course also possible to use other implements in further exemplary embodiments of the invention.

One possibility is the use of a genetic algorithm. Genetic algorithms are based, as the name suggests, on evolution. Specifically, the things that drive evolution at its core, DNA and the survival of the fi ttest. Over many generations mutations develop in the development of solution sequences. Weaker elements die in the course of selection and the strongest ones recombine their genes. The simplest Genetic Algorithm (GA) consists of steps represented by the following pseudo-code.

A genetic algorithm should be able to sample especially large, non-linear and complex search spaces by random search. Mutations of single chromosomes mean a local search, junctions can serve to break out of local optima.

9 schematically illustrates the process of crossing and mutation using chromosomes consisting of series of binary numbers. The example of intersections shows how an implementation could be implemented. A section of two chromosomes, here the number vector, is exchanged. The mutation can be done, for example, by swapping two adjacent numbers. How the mechanisms are actually implemented for an optimization problem depends on the choice of the representation of a chromosome.

Another possibility is the use of a "cuckoo search" algorithm. Cuckoo Search (CS) is based on two concepts that can be found in nature, the breeding behavior of some cuckoo species, and the flight behavior of some bird species and fruit flies. The breeding behavior of certain cuckoo species is parasitic. That is, they lay their eggs in the nests of foreign birds and may even remove their eggs to increase the chances of survival of their own brood. If a bird so deceived discovers the cuckoo's egg, it either throws it out of the nest or gives up the entire nest.

The flight behavior of the Drosophila melanogaster (fruit flies) shows typical characteristics of the Lévy Flight, a kind of Random Walk. Compared to the Brownian motion, for which a maximum variance between steps is defined, the variance of the Lévy Flight is infinite. The Lévy distribution has larger extensions than the normal distribution. Symmetrical α distributions, like some Lévy variants, have equally large extensions in the positive and negative intercept. They depend on the exponent α, which indicates the allowed "severity". The heavier, the wilder the distribution. You can no longer specify an average value. This type of random pathfinding has been proven even in prehistoric humans before they settled down. The advantage of large variance is that you can explore the search space more efficiently and thus overcome local optima. Limited variance means primarily more local routes.

• (i) Ein Kuckuck legt ein einziges Ei in ein zufällig gewähltes Nest.
• (ii) Die Nester mit den besten Eiern bleiben für die nächste Iteration.
• (iii) Die schlechtesten Nester und Eier werden aufgegeben und durch neue ersetzt.

The Cuckoo Search algorithm is based on three simple rules:

• (i) A cuckoo lays a single egg in a randomly chosen nest.
• (ii) The nests with the best eggs stay for the next iteration.
• (iii) The worst nests and eggs are abandoned and replaced with new ones.

The quality of an ice cream corresponds to the fitness value of the solution by which it is represented. Based on the existing eggs in the nests, a new cuckoo's egg is generated by Lévy-Flight: x ^{t + 1} = x ^t + α · L _vy (λ) x is a solution of the minimization problem to the time step t, α is 1 and Lvy ~ u = t ^-λ , (1 <λ ≤ 3). The factor α influences the step size and can be adapted to the search space.

A percentage (p _a ∈ [0, 1]) of the worst nests is replaced by random new solutions. These rules seek new solutions around the best nests and explore new areas by giving up bad solutions. This allows the algorithm to break out of local optima. The above steps are iterated until a holding criterion, such as a certain number of iterations or non-improvement of a nest group, is achieved.

The following pseudo-code describes the Cuckoo Search algorithm:

Another possibility is the use of a modified "Cuckoo Search" algorithm based on the "Cuckoo Search" algorithm, which is extended by a communication in the group of the best nests. The reason is that the "cuckoo search" always finds an optimum with sufficient time but can be too slow for computation-intensive evaluation functions. The extension increases the convergence rate and increases the application areas without losing the good scan of the search space.

Here are the nests as in the "Cuckoo Search" algorithm divided into two groups: good and bad solutions. But now the Lévy-Flight is mainly used only in the bad nests. The step size α also decreases with the number of generations to promote more local sampling:

sodass das generierte Ei näher an der fitteren bzw. der besseren der beiden Lösungen liegt. In Ausnahmefällen, bei denen das neue Ei dem älteren gleicht, soll ein Lévy Flight des neuen Eies mit der Schrittweite

angewendet werden, um den Konflikt zu lösen.The better group uses a particle swarm-like method. For each nest, a random one from the group is selected, and a new egg is generated that lies on the connecting line between the two solutions. Instead of a random distance one uses the inverse of the golden section

so that the generated egg is closer to the fi rst or the better of the two solutions. In exceptional cases, in which the new egg is similar to the older, should be a Lévy Flight of the new egg with the step size

be used to solve the conflict.

Another possibility is the use of a particle-swarming algorithm whose idea is to mimic the flock behavior of fish and birds and to solve optimization problems. Conceptually, this algorithm can be classified between genetic and evolutionary algorithms. Genetically, because each particle uses different particles to generate new solutions. More precisely: He represents a solution and remembers his personal and globally best solution. As in nature, the particle now moves from its position, adapted to its swarm perception, to a new position. This swarm intelligence can also be implemented through the global best with multiple local optima that the particles strive for. Evolutionary because the particle swarm optimizer searches iteratively over many generations. For each evolutionary step, each particle will fly to a better place in the solution space.

The approach is so different from the original version of the "Cuckoo Search", which is mainly based on random walks. The "Modi fi ed Cuckoo Search", on the other hand, uses the concepts of the particle swarm and can be represented compactly by the following pseudo-code:

Each particle P _i moves depending on its velocity v _i . These are calculated as follows.

The constants c ₁ , c ₂ contribute significantly to the fact that the particles do not get caught in local minima and r ₁ , r ₂ are random numbers between zero and one. PERSONALBEST _i represents the personal best value of the particle i, ^t Globalbest for the global optimum. The new particle P t + 1 / i is finally P t / i + v t + 1 / i ,

Another option is to use a hybrid heuristic that combines several of the above concepts. For example, the "vanilla variant" of the particle swarm optimizer can be considerably improved by combinations with other heuristics. In combination with a hill-climbing algorithm, the local space around the individual particles can be additionally scanned. The environment of the particle is explored again by steps of fixed length at each iteration step of the algorithm. It is then checked if the new particle is better and should replace the old one.

An example of such a hybrid algorithm is a hybrid CS / Particle Swarm Optimizer (PSO). Basically, this is a Cuckoo Search algorithm whose cuckoos act as a swarm, using swarm intelligence instead of random walks to find better breeding grounds. When the cuckoos lay an egg, a random bird from the swarm performs a Lévy flight. The rest of the code is similar to the Cuckoo Search, so there is a bottom nest group whose eggs are re-diced, and an upper one that is preserved. The pseudocode of a possible implementation is as follows:

In the following paragraphs, the algorithms and heuristics described above for finding new potential solutions to the problem or for the distribution of the event detectors to the plurality of computational nodes are checked by means of a synthetic benchmark. There is a large problem size chosen, so a large number of hosts and detectors. In addition, group size of the tasks per host is varied, thereby testing the parameterization of the algorithms. Here, the algorithms and the representation are to be checked for their suitability for the system.

The benchmarks allow the group size to be based on an empirical foundation. The simplification of the benchmark is that instead of any event transmissions, each detector has only one subscription and also sends only one event per publication. The resulting hierarchy of dependencies between the event detectors corresponds to a binary tree as in 11 is shown.

In The results of the benchmarks of the CS / PSO and H / PSO algorithms can be seen. The topology of the dependencies corresponds to the binary tree 11 , the group size was 4 and the number of detectors was set to 20, spread over 5 hosts. The relative quality (fitness) of the solutions is plotted against the number of iterations needed. Fitness symbolizes the costs that the assignment from detector to computer causes. The higher the fitness, the lower the cost. In the graphs is the exact optimum 70 as well as the maximum 72 , the minimum 74 and the average 76 out of 10 runs, each experiencing 200,000 generations. The optimum 70 was calculated a-priori with an exact solver.

As well as in 12a be in 12b on the left the fitness values of the Modified Cuckoo Search algorithm and on the right the PSO algorithm with maximum value 72 , Average value 76 and the lowest fitness score 74 represented by an increasing number of iterations. The same is in the left picture of the 12c for the genetic algorithm, whereas in the right figure the 12c different variants of a particle swarming algorithm are compared.

In the average values of 10 runs with 200,000 iterations of the compared algorithms for different group sizes are summarized in a direct comparison. It can be seen from the graphs that the genetic algorithm and the hybrid Cuckoo Search particle swarm algorithm, with a group size of 4, are superior to the remaining heuristics. With a group size of 3, the CS / PSO achieves better results than the GA. This is due to the fact that a smaller group size means that there are more possibilities to distribute the detectors on computers. The search space is thus larger and finding a correct solution more difficult. The search space coverage for difficult problems seems to be better for the CS / PSO than for the GA. The values in the table below show that the CS / PSO scales better than the others, even for larger problems Heuristics. The higher the value in the table, the better the distribution found, and the more detectors allowed to start on an EventCore at maximum, the easier it will be to find one. It can also be seen there that the algorithm also scales better with simplifications, ie a higher limit of detectors per EventCore. The largest jump is between group size 6 and 7. As in the previous benchmarks, the values in the table represent the average of 10 passes after every 200,000 iterations. algorithm 6 max 7 max 8 max 9 max CS / PSO -8th 13 14 16 H / PSO -22 -10 -5 0 PSO -27 -9 -6 -3 MCS -38 -18 -14 -7 CS - -36 -28 -26 GA -18 -13 -12 -5

The better average results and the continuous improvement of the best found solution of the CS / PSO compared to the other PSO algorithms and the GA (for more difficult problems) can be explained by the greater variance, and thus the better search space coverage of the swarm. The results of the other PSO variants, however, show very early a persistence in already found local Optima. In addition, the CS / PSO scans a larger area of the search space through levy flights and the determination of new, random solutions in its swarm and thus seems to be particularly suitable for the investigated problem of an event-based distributed analysis system.

The variance among the particles remains high due to continuous resampling, which keeps the swarm in motion. This mechanism can also be seen in the Cuckoo Search mode. In on the right are the progressions of a separate test of CS / PSO, HPSO and PSO. The values from the 5th to the 200th generation have been removed. They show how strongly local optima have an effect on this specific optimization problem. While the CS / PSO finds even better solutions after 200 iterations, HPSO and PSO stagnate very early. Without mechanisms to escape from local optima, these algorithms initially seem less suitable for integration into the EventCore.

While the HS / PSO algorithm appears to converge to optimal solutions faster for the given problem, the foregoing consideration has shown that, in principle, all of the algorithms are suitable for use in the performance improvement of a distributed event-based analysis system.

13 shows an embodiment of a performance enhancer 100 for improving the performance of an event-based analysis system. The performance enhancer 100 includes a solution finder 102 configured to, based on a given distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c ), a proposal for a modified distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c ) to investigate.

A performance appraiser 104 is designed to be suitable for the given distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c ) to determine a fitness value indicative of a measure of a performance of the analysis system and to determine another fitness value for the proposed changed distribution.

A performance appraiser 106 is designed to compare the further fitness value with a predetermined decision criterion.

A controller 108 is designed to receive at least one control message 110 generate a distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c ) according to the proposed changed distribution if the further fitness value satisfies the predetermined decision criterion.

Although some aspects of the present invention have been described in the context of a device, it should be understood that these aspects also constitute a description of a corresponding method such that a block or device of a controller is also to be understood as a corresponding method step or feature of a method step is. Similarly, aspects described in connection with or as a method step also represent a description of a corresponding block or detail or feature of a corresponding device.

Depending on particular implementation requirements, embodiments of the invention may be implemented in hardware or in software. The implementation may be performed using a digital storage medium, such as a floppy disk, a DVD, a Blu-ray Disc, a CD, a ROM, a PROM, an EPROM, an EEPROM or FLASH memory, a hard disk, or other magnetic disk or optical memory are stored on the electronically readable control signals, which can cooperate with a programmable hardware component or cooperate such that the respective method is performed.

A programmable hardware component may include, by a controller, a processor, a central processing unit (CPU), a computer, a computer system, an application-specific integrated circuit (ASIC), an integrated circuit (IC), a system on chip (SOC) system, a programmable logic element or a field programmable gate array with a microprocessor (FPGA = Field Programmable Gate Array) may be formed.

The digital storage medium may therefore be machine or computer readable. Thus, some embodiments include a data carrier having electronically readable control signals capable of interacting with a programmable computer system or a programmable hardware component such that one of the methods described herein is performed. One embodiment is thus a data carrier (or a digital storage medium or a computer readable medium) on which the program is recorded for performing any of the methods described herein.

In general, embodiments of the present invention may be implemented as a program, firmware, computer program, or computer program product having program code or data, the program code or data operative to perform one of the methods when the program resides on a processor or a computer programmable hardware component expires. The program code or the data can also be stored, for example, on a machine-readable carrier or data carrier. The program code or the data may be present, inter alia, as source code, machine code or byte code as well as other intermediate code.

For example, a program according to one embodiment may implement one of the methods during its execution by, for example, reading or writing one or more data into memory locations, optionally switching operations or other operations in transistor structures, amplifier structures, or other electrical, optical, magnetic or caused by another operating principle working components. Accordingly, by reading a memory location, data, values, sensor values or other information can be detected, determined or measured by a program. A program can therefore acquire, determine or measure quantities, values, measured variables and other information by reading from one or more storage locations, as well as effect, initiate or execute an action by writing to one or more storage locations and control other devices, machines and components ,

The embodiments described above are merely illustrative of the principles of the present invention. It will be understood that modifications and variations of the arrangements and details described herein will be apparent to others of ordinary skill in the art. Therefore, it is intended that the invention be limited only by the scope of the appended claims and not by the specific details presented with the description and explanation of the embodiments.

Claims (19)

Method for improving the performance of an event-based distributed analysis system, in which a plurality of event detectors, which respectively determine the occurrence of an event ( 22a - 22g ) on a plurality of different, over a network ( 22 ), computing nodes ( 20a - 20c ), comprising: for a given distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c Determining a fitness value indicative of a measure of performance of the analysis system; Determining a proposal for a changed distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c ); Determining another fitness value for the changed distribution; Comparing the further fitness value with a predetermined decision criterion; and distributing the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c ) according to the proposed changed distribution if the further fitness value satisfies the predetermined decision criterion. The method of claim 1, wherein the fitness value comprises information about one of the event detectors ( 22a - 22g ) on the compute node ( 20a - 20c ) includes computational load. Method according to Claim 1 or 2, in which the fitness value contains information about a utilization of the network connections of the network ( 22 ). Method according to one of the preceding claims, wherein the fitness value contains information about a signal propagation time of the over the network ( 22 ) events transmitted. Method according to one of the preceding claims, in which, in determining the fitness value, the fitness value at a between individual event detectors ( 22a - 22g ) on the same compute node ( 20a - 20c ) event is increased. Method according to one of the preceding claims, in which, in determining the fitness value, the fitness value at a between individual event detectors ( 22a - 22g ) on different compute nodes ( 20a - 20c ) transmitted event is lowered. Method according to one of the preceding claims, in which the determination of the fitness value f in an analysis system with n event detectors ( 22a - 22g ) according to the following calculation rule:

where t _{i, j} indicates the number of events transmitted from the compute node i to the compute node j within an observation period, a _{i, j} = 1 if the event detector i and the event detector j are executed on the same compute node, 0 otherwise; b _{i, j} = 0 if the event detector i and the event detector j are executed on the same compute node, 1 otherwise; l _{i, j} = a factor indicating the additional latency in the transmission of an event from the computational node of the event detector i and the computational node of the event detector j; and c ₁ and c _{2 are} statistical weights. The method of any one of the preceding claims, wherein determining the modified distribution proposal is performed using an algorithm from the group of genetic algorithm, Cuckoo Search, modified Cuckoo Search, Particle Swarm, and Hybrid Cuckoo Search / Particle Swarm Algorithm (CS / PSO). Method according to one of the preceding claims, in which the decision criterion is fulfilled if the further fitness value is greater than the fitness value. Method according to one of the preceding claims, wherein the decision criterion is satisfied if the further fitness value is greater than a sum of the fitness value and a load factor, which is a measure for a preliminary performance reduction in a distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c ) according to the proposed modified distribution. The method of any preceding claim, wherein an event is a primitive event or a derived event, wherein a primitive event is derived directly from sensor data of a sensor network and a derived event is based on primitive events.  Method according to one of the preceding claims, in which the occurrence of events in a sports event is determined by means of the event-based analysis system. The method of any one of the preceding claims, further comprising: receiving, from each of the event detectors ( 22a - 22g ), information about the number of event detectors ( 22a - 22g ) to each of the other event detectors ( 22a - 22g ) transmitted events. The method of any one of the preceding claims, further comprising: receiving, from each of the event detectors ( 22a - 22g ), information about an amount of data that the respective event detector ( 22a - 22g ) to each of the other event detectors ( 22a - 22g ). The method of any one of the preceding claims, further comprising: receiving, from each of the compute nodes ( 20a - 20c ), an information about a work load or utilization, which is stored on the respective compute node ( 20a - 20c ) from the event detectors ( 22a - 22g ) is caused. Method according to one of the preceding claims, in which the further fitness value for the changed distribution is based on the information between the event detectors ( 22a - 22g ) the given distribution is exchanged during a predetermined period of time. Method for improving the performance of an event-based distributed analysis system, in which a plurality of event detectors, which respectively determine the occurrence of an event ( 22a - 22g ) on a plurality of different, network-connected, computational nodes ( 20a - 20c ) can be performed, comprising: for a given distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c Determining a fitness value indicative of a measure of performance of the analysis system; Determining a proposal for a changed distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c ); Determining another fitness value for the changed distribution; Comparing the further fitness value with a predetermined decision criterion; and generating at least one control message indicating a distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c ) according to the proposed changed distribution if the further fitness value satisfies the predetermined decision criterion. Performance Enhancer ( 100 ) for improving a performance of an event-based distributed analysis system, in which a plurality of event detectors respectively determining the occurrence of an event ( 22a - 22g ) on a plurality of different, network-connected, computational nodes ( 20a - 20c ), comprising: a solution finder ( 102 ) configured to, based on a given distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c ), a proposal for a modified distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c ) to investigate; A performance appraiser ( 104 ), which is designed to be suitable for the given distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c ) to determine a fitness value indicative of a measure of performance of the analysis system and to determine another fitness value for the proposed altered distribution; A performance evaluator ( 106 ) configured to compare the further fitness value with a predetermined decision criterion; and a controller ( 108 ) configured to generate at least one control message indicating a distribution of the plurality of event detectors ( 22a - 22g ) to the plurality of compute nodes ( 20a - 20c ) according to the proposed changed distribution if the further fitness value satisfies the predetermined decision criterion. Computer program with a program code for performing the method according to one of claims 1 to 17, when the computer program runs on a programmable hardware component.

Images