An event pattern language for runtime monitoring based on AOP

Runtime monitoring is a body of techniques concerning monitoring and analyzing event sequences in software execution. It is widely used to improve software's security and reliability. However, the event pattern languages used in current runtime monitoring frameworks are not fully capable of expressing relations among monitored events. This makes them inadequate to describe some desired event sequences. To this problem, we propose a new event pattern language. Our event pattern language is composed of two level operators. The lower level operators select single events based on only local information, while the higher level operators fully leverage the control flow relation and data flow relation among events. This feature makes our language able to select a larger spectrum of event sequences in a modular and declaration way. We also present a demonstration of preventing SQL injection in this language and implement a compiler for this language.