Efficiency of computing $e(P,Q)$ Vs $g^a \pmod{p}$? The definition of $e$ can be seen here. I want to know the accurate comparison of efficiency between $e(\cdot,\cdot)$ and $g^a \pmod{p}$. If  computing $e(P,Q)$ is less efficient than computing $g^a \pmod{p}$, should we prefer $g^a \pmod{p}$ to $e(P,Q)$ when designing protocols?

Also, what is the reason for defining the pairings on an elliptic curve? Is it to solve the multiplication of points over the elliptic curve? 

p.s. Sorry to have a lot of questions, I'm new to elliptic curve cryptography..
Firstly, there is not one definition of a pairing.

A pairing is a bilinear function: you have three finite groups $G_1$, $G_2$ and $G_3$; a pairing is a function $e$ such that, for all $(g_1,g_2) \in G_1\times G_2$ and all integers $a$ and $b$, then $e(g_1^a,g_2^b) =e(g_1,g_2)^{ab}$ (I am here using multiplicative notation for the three groups). Why would you want such a function, in a cryptographic setting ? Basically, if you can have the following properties together:


$G_1$, $G_2$ and $G_3$ have known, finite orders.
Computations on these groups is easy.
The computational Diffie-Hellman assumption holds on the groups.
A pairing function $e$ can be defined and easily computed on these groups.


Then we can use the groups and the pairing function to power some interesting cryptographic protocols, in particular Identity-Based Encryption, which would be hard to obtain without pairing-friendly groups. To state things in a very general way, "normal" groups are for protocols which involve interactions between two parties (e.g. Diffie-Hellman) while pairing-friendly groups are for protocols which involve interactions between three parties.

So the cryptographic question is: do we know pairing-friendly groups ?

Right now, the only practical candidates we have for pairing-friendly groups are some special elliptic curves, which allow for a few distinct pairing functions (Weil, Tate, Ate and Eta pairings, the last two being subvariants of the Tate pairings). So we don't use pairings to "solve things" on elliptic curves; we use elliptic curves so that we can have computable pairings, which open the possibility of nifty advanced protocols.

(Note that initially, Weil and Tate pairings were first investigated as mechanisms to break elliptic curves. Fortunately, usual elliptic curves don't allow for computable pairings -- if you try to apply Weil or Tate pairing on a "normal" curve, you will find that it entails computations on integers which would not fit in the RAM of any computer, even if the computer was as big as the Moon. Pairing-friendly curves are in fact "slightly weakened curves" specially crafted so that pairings are computable, but not to the point that they allow a fast break of the said curves.)

Then there are details. For instance, in some protocols we want a symmetric pairing where $G_1$ and $G_2$ are the same group; while in other protocols we want the opposite: $G_1$ and $G_2$ shall be distinct groups, with, for instance, a one-way morphism from $G_2$ to $G_1$ (but not in the other direction). You will not use the same curves and the same kind of pairing for all cases.

So your question cannot have any simple answer except that "it depends". We can still give orders of magnitude: for a given security level (e.g. that of 2048-bit RSA), usual pairings will entail a computational cost which is about 8 to 12 times the cost of decryption with 2048-bit RSA. Don't try to read too much in that figure, though. What must be remembered is that, for instance, the BLS signature scheme allows for short signatures (shorter than DSA or ECDSA) but implies a computational overhead (for signature verification) which is not necessarily negligible.