EX0001 統計10s的股票統計值，2s輸出一次。

解決方法：輸入定時觸發器timer週期設定為2s

CREATE QUERY demo

SELECT T1._start_time_ AS starttime,average(T2.price) ASavg,T3._end_time_ AS endtime

FROM T1:timer,T2:模擬股票,T3:timer

PATTERN T1;T2^+;T3 

WHERE T1._start_time_=T3._start_time_-10000 

WITHIN 10000

EX0002統計每一隻股票的10s的統計值,2s輸出一次

解決方法：輸入timer週期設定為2s

CREATE QUERY demo

SELECT T1,T2,T3

FROM T1:timer,T2:模擬股票,T3:timer

PATTERN T1;T2^+;T3 

Group BY T2.name

WHERE T1._start_time_=T3._start_time_-10000 

WITHIN 10000

EX0003每當股價超過閾值後，開啟10秒視窗，統計10秒內股價超過閾值的事件（>80.0）。這10秒內的超過閾值事件，就不再開啟新的10秒視窗。

CREATE QUERY delayoutput2

SELECT T1,T2,T3

FROM T1:stokIn,T2:stockIn,T3:delay10sec

PATTERN T1;T2^+;T3 

WHERE T1._start_time_=T3._start_time_-10000 

AND T1.price>80.0 

AND T2.price>80.0

WITHIN 10000 BATCHMODE

EX0004查詢10分鐘以內，單筆金額小於等於10元，大於等於2筆的交易卡號和金額

 (1) SODSQL

select T1.cardid AS T1_cardid,T1.value AS T1_value,tostring(T2.value)AS T2_value,T3.value AS T3_value

from T1:Event,T2:Event,T3:Event

PATTERN T1;T2^*;T3

GROUP By T1.cardid

WHERE T1.value<=10 AND T3.value<=10 ANDT1.cardid=T3.cardid AND T1.cardid=T2.cardid AND T2.value<=10

WITHIN 36000000

（2）參考Esper

select cardid

from Event.win:time(10 min)

where value<=10

group by cardid

having count(*)>=2

P00003檢測短時間內，同一賬號連續發生接近授權金額的交易

SODSQL語句：

CREATE QUERY P00003

SELECT T1,T2,T3

FROM T1: 模擬銀行交易資料,T2:模擬銀行交易資料,T3:模擬銀行交易資料PATTERN T1;T2^*;T3 

WHERE T2.amt<50000 AND T2.amt>45000

AND T3.amt<50000 AND T3.amt>45000 

AND T1.amt<50000 AND T1.amt>45000

AND T1.Account=T2.Account 

AND T2.Account=T3.Account 

WITHIN 11000

P00004：同一個賬戶連續進行的大額轉賬相反交易

SODSQL語句：

CREATE QUERY P00004

SELECT T1,T2 FROM T1:模擬銀行交易資料,T2:非法交易2

PATTERN T1;T2 

WHERE T1.Account = T2.Account

AND T1.trans_flag='in'

AND T2.trans_flag='out' 

WITHIN 500

P00023：檢測短時間內櫃面現金交易，防止將使用者的“先取後存”業務辦理為“先存後取”

SODSQL語句：

CREATE QUERY P00023

SELECT T1,T2 FROM T1:模擬銀行交易資料,T2:非法交易2

PATTERN T1;T2 

WHERE T1.Account = T2.Account 

AND T2.dc_flag='C'

AND T1.dc_flag = 'A'

AND T1.cash_trans_flag= '1'

AND T2.cash_trans_flag = '1' 

WITHIN 1000

P00101監測是否存在當日現金出現大收大付

SODSQL語句：

CREATE QUERY P00101

SELECT T1,T2

FROM T1:模擬銀行交易資料,T2:模擬銀行交易資料

PATTERN T1&T2

WHERE T1Account=T2.Account 

WITHIN 86400000

OLP0001檢測"使用者確認支付"後,沒有"銀行轉賬成功"，就"出貨"

SODSQL語句：

CREATE QUERY OLP0001

SELECT T1,T2,T3

FROM T1:線上支付模擬資料,T2:線上支付模擬資料,T3:線上支付模擬資料 PATTERN T1;!T2;T3 

WHERE T1.userid=T3.userid

AND T2.userid=T3.userid

AND T1.message='verifypay'

AND T2.message='bankpaycomplete'

AND T3.message ='productrelease'

AND T1.productid=T3.productid

AND T2.productid=T3.productid 

WITHIN 20000

OLP0002"使用者確認支付"後，"銀行轉賬成功"，3秒內沒有"出貨"

SODSQL語句：

CREATE QUERY OLP002

SELECT  T1,T2,T3,T4

FROM T1:onlinepayment,T2:onlinepayment,T3:onlinepayment,T4:timer PATTERNT1;(T2;!T3;T4)

WHERE T2.userid=T3.userid

AND T2.userid=T1.userid

AND T1.message='verifypay'

AND T2.message='bankpaycomplete'

AND T3.message ='productrelease'

AND T3.productid=T1.productid

AND T3.productid=T2.productid

AND T4._start_time_-T2._start_time_> 1000 WITHIN 2000

EX0005查詢30s內輸入不同密碼的次數大於5的使用者

解決方法：輸入定時觸發器timer週期設定為30s

CREATE QUERY demo

SELECT T1._start_time_ AS starttime,average(T2.price) ASavg,T3._end_time_ AS endtime

FROM T1: 登入,T2:登入,T3: 登入

PATTERN T1;T2^+;T3 

GROUP BY T2.name

WHERE countdistinct(T2.password)>3

AND T1.name=T2.name AND T3.name=T1.name

WITHIN 30000

EX0006 當reader 讀到標籤後，在1s內該標籤還在則認為是連續讀到該標籤，2s後該標籤還存在，則出發進入通道事件，進入通道後，如果2s內reader 未讀到標籤則觸發離開事件

“讀到標籤ReadSuccessiveEvent”

CREATE QUERY readsuccessive

SELECT 'readsuccessive' AS type, T1.id AS T1_id,T1.num AS T1_num,T2.id AST2_id,T2.num AS T2_num

FROM T1:readerevent,T2:readerevent

PATTERN T1;T2 

WHERE T1.id=T2.id 

WITHIN 1000

"進入通道"readenterchannel

CREATE QUERY readenterchannel

SELECT 'enterchannel' AS type,T3.id AS T3_id,T3.num AS num FROMT1:readerevent,T2:readerevent,T3:readerevent

PATTERN T1;T2;T3 

WHERE T1.id=T2.id

AND T1.id=T3.id

AND T2._end_time_-T1._end_time_<=1000

AND T3._end_time_-T2._end_time_<2000

AND T3._end_time_-T1._end_time_>1000  

WITHIN 3000

"離開事件" readoutofchannel

CREATE QUERY readoutofchannel2

SELECT T1.id AS T1_id,T1.num AS T1_num,'outofchannel' AS type

FROM T1:readerevent,T2:readerevent,T3:delay2sectimer

PATTERN T1;!T2;T3 

WHERE T1.id=T2.id AND T3._end_time_-T1._end_time_=2000 

WITHIN 2000

EX0007 查詢哪個卡號1小時內的總交易金額大於1w

CREATE QUERY pos

SELECT T1.acctnum AS acctum,T1.value AST1_value,tostring(T2.value) AS T2.value,T3.value AS T3_value

 FROM T1: pos,T2:pos,T3:pos

PATTERN T1;T2^+;T3 

GROUP BY T2.acctnum

WHERE T1. acctnum =T2. acctnum

AND T3. acctnum =T1. acctnum

AND T1.value+T2.value+sum(T3.value)>10000

WITHIN 10000