Contextualised Event-Triggered Reactivity With Similarity Search

iCEP – FIS 08

28. September 2008

Darko Anicic, Sinan Sen, Nenad Stojanovic, Jun Ma,

and Kay-Uwe Schmidt

WIR FORSCHEN FÜR SIE

Agenda

Introduction; Use Case Scenario; Event Processing; Similarity Search; Contextualised Event-Triggered Reactivity With

Similarity Search; Conclusion.

Introduction

Complex events with precise specifications not always desired;

Fraud or failure detection apps. demand similar events;

Our approach - combining reactive rules with ontologies:

• to capture the context;• to discover similar (uncertain and unknown) complex events.

Semantic approach for reasoning about events, their contexts and reactions.

Use Case Scenario

SAP Business ByDesign SaaS:• Mission-critical applications;• Failure detection and maintenance to be improved;• Application context important for meaningful alerts.

CEP for monitoring and metering in SaaS; Example rules:

• If all CRM-Monit-Evs in last 5 minutes (event) exceed 90% for CPU cons. (condition) and no previous repair action happened (context) => do aut. healing.

• If all CRM-Monit-Evs in last 5 minutes (event) exceed 90% for CPU cons. (condition) and the aut. self healing did not work from prev. situation (different context), => do different action.

Similarity measures enable reuse of rules to be fired in situations, not originally specified but similar to them.

Contextualised Event-Triggered Reactivity With Similarity Search

System architecture; Reactive rules; Event Calculus Extended With Similarity Search; Context Model for Event Processing; Detection of Complex Events and Situations

Event Processing

Complex Event Processing (CEP), is primarily an event processing concept that deals with the task of processing multiple events from an event cloud with the goal of identifying the meaningful events within the event cloud.

Figure source: Opher Etzion, IBM Research

System Architecture

Reactive Rules

Previous form: “ON event IF condition DO action”; Condition used for contextual information; Required form:

“ON event WITHIN context IF condition DO action”; Context used for no explicit relationships between

events and reactions;

Event Calculus With Similarity Search

Similarity calculation is based on an event ontology Aggregation of taxonomy similarity and property similarity

simA(e1,e2)= simtx(e1,e2) + simft(e1,e2)

If simA is above a predefined threshold events are considered as to be similar

Using the similarity results rules can be fired, which were not originally defined for this situation e.g. fraud detection.

sim=0.87

Event Calculus With Similarity Search (cont.)

Context Model for Event Processing

Unknown events cannot be detected with classical CEP approaches;

Context is important concept in dealing with unknown situations;

Context helps in conflict resolution (e.g., 2 contradictory actions triggered by an event);

Ontologically represented context:• Number of attributes with predetermined values;• Discrimination concepts (e.g., location, date, time, involved actors,

execution phase etc.);• Actions relevant for particular context.

Run-time context instantiation with SWRL rules.

Detection of Complex Events

Bottom-up complex event detection; Propagate up to parent when condition (operation) is

satisfied; Event history for implementation of different polices (i.e.

recent policy etc.)

Detection of Complex Situations

Conclusion

Event-triggered reactivity with similarities measures for monitoring;

Contextualised similarity for detection of unknown complex events and situations;

Reasoning over complex situations for intelligent reactive systems;

Other Stuff We DO…

tφ

OR

End

tψ t6

t4 t7

t6

Start

cond.φ cond.3

cond.3 cond.4

tφφ

End

tψφ t3φ

t4φ t5φ

t6φ

Start

cond.φφ

cond.φψ

cond.3φ cond.4φ

tφψ

OR

End

tψψ t3ψ

t4ψ t5ψ

t6ψ

Start

cond.φψ

cond.ψψ

cond.3 cond.4

OR

t3

t5

cond.ψ

cond.5

Private WFs ACWFs Private WFs

Thank you! Questions please…