Contextualised Event-Triggered Reactivity With Similarity Search iCEP – FIS September 2008 Darko Anicic, Sinan Sen, Nenad Stojanovic, Jun Ma, and Kay-Uwe Schmidt WIR FORSCHEN FÜR SIE

Agenda Introduction; Use Case Scenario; Event Processing; Similarity Search; Contextualised Event-Triggered Reactivity With Similarity Search; Conclusion.

Introduction Complex events with precise specifications not always desired; Fraud or failure detection apps. demand similar events; Our approach - combining reactive rules with ontologies: to capture the context; to discover similar (uncertain and unknown) complex events. Semantic approach for reasoning about events, their contexts and reactions.

Use Case Scenario SAP Business ByDesign SaaS: Mission-critical applications; Failure detection and maintenance to be improved; Application context important for meaningful alerts. CEP for monitoring and metering in SaaS; Example rules: If all CRM-Monit-Evs in last 5 minutes (event) exceed 90% for CPU cons. (condition) and no previous repair action happened (context) => do aut. healing. If all CRM-Monit-Evs in last 5 minutes (event) exceed 90% for CPU cons. (condition) and the aut. self healing did not work from prev. situation (different context), => do different action. Similarity measures enable reuse of rules to be fired in situations, not originally specified but similar to them.

Contextualised Event-Triggered Reactivity With Similarity Search System architecture; Reactive rules; Event Calculus Extended With Similarity Search; Context Model for Event Processing; Detection of Complex Events and Situations

Event Processing Complex Event Processing (CEP), is primarily an event processing concept that deals with the task of processing multiple events from an event cloud with the goal of identifying the meaningful events within the event cloud. Figure source: Opher Etzion, IBM Research

System Architecture

Reactive Rules Previous form: ON event IF condition DO action; Condition used for contextual information; Required form: ON event WITHIN context IF condition DO action; Context used for no explicit relationships between events and reactions;

Event Calculus With Similarity Search Similarity calculation is based on an event ontology Aggregation of taxonomy similarity and property similarity sim A (e1,e2)= sim tx (e1,e2) + sim ft (e1,e2) If sim A is above a predefined threshold events are considered as to be similar Using the similarity results rules can be fired, which were not originally defined for this situation e.g. fraud detection. sim=0.87

Event Calculus With Similarity Search (cont.)

Context Model for Event Processing Unknown events cannot be detected with classical CEP approaches; Context is important concept in dealing with unknown situations; Context helps in conflict resolution (e.g., 2 contradictory actions triggered by an event); Ontologically represented context: Number of attributes with predetermined values; Discrimination concepts (e.g., location, date, time, involved actors, execution phase etc.); Actions relevant for particular context. Run-time context instantiation with SWRL rules.

Detection of Complex Events Bottom-up complex event detection; Propagate up to parent when condition (operation) is satisfied; Event history for implementation of different polices (i.e. recent policy etc.)

Detection of Complex Situations

Conclusion Event-triggered reactivity with similarities measures for monitoring; Contextualised similarity for detection of unknown complex events and situations; Reasoning over complex situations for intelligent reactive systems;

Other Stuff We DO… tφ OR End tψt6 t4t7 t6 Start cond.φ cond.3 cond.4 tφφ End tψφt3φ t4φt5φ t6φ Start cond.φ φ cond.φ ψ cond.3φcond.4φ tφψ OR End tψψt3ψ t4ψt5ψ t6ψ Start cond.φ ψ cond.ψ ψ cond.3cond.4 OR t3 t5 cond.ψ cond.5 Private WFsACWFsPrivate WFs

Thank you! Questions please…