Complex event processing for modern data processing environments

Modern Internet of Things (IoT) infrastructures generate high-rate streams from thousands of geographically distributed sources, creating time-sensitive data at scale. Today, cloud-hosted stream processing is the prevailing way to handle infinite streams by processing events as they arrive in a central data center. Analytical Stream Processing (ASP) is the dominant paradigm, with systems such as Flink and Spark, offering high-throughput execution, elastic scaling, and efficient state management. With the rapid expansion of IoT devices, streaming workloads increasingly require pattern-oriented reasoning to detect interesting behavior across multiple streams under temporal and causal constraints. Complex patterns go beyond the processing of single events in isolation and are expressed as compositions of stateful binary operators. In contrast to ASP, Complex Event Processing (CEP) provides expressive pattern abstractions. However, many implementations rely on state-heavy automata with a fixed evaluation order, which hampers distribution and yields poor efficiency in the cloud, making traditional CEP unsuitable at IoT scale. At the same time, cloud-optimized ASP systems struggle to meet the requirements of latency-sensitive IoT applications, as collecting all data centrally before processing introduces excessive latency, hindering the timely detection of critical patterns. Fog-cloud environments mitigate these bottlenecks by extending the cloud with a fog layer that allows early processing for data reduction close to sources. To leverage the fog as an extension of the cloud, both centralized processing paradigms must adopt decentralization strategies to shift computation toward heterogeneous fog nodes while preserving correct pattern detection. This thesis makes three contributions toward efficient processing of stateful, pattern-oriented workloads in unified fog-cloud environments. First, we improve cloud execution by enabling CEP on ASP systems through a general operator mapping. Our mapping decomposes a pattern encapsulated in the prevailing single CEP operator into a pipeline of native ASP operators, primarily Window Joins (WJs). Second, we introduce semantics-aware WJ reordering, which expands the plan search space from a single left-deep order to multiple semantically equivalent plans. This enlarged search space increases the optimization potential of mechanisms such as merging and placement in both cloud and fog deployments. Third, we present KRAKEN, a planner for decentralized execution in fog-cloud environments that jointly decides operator placement and communication modes for pattern-oriented workloads. This joint optimization reveals execution plans that are not reachable by sequential approaches that fix placement before optimizing communication. Collectively, these contributions advance stream processing for stateful, pattern-oriented workloads in fog-cloud environments and enable emerging IoT applications such as remote health monitoring and early warning systems that help protect communities and ecosystems.