Jump to content

Complex event processing

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by 130.214.25.253 (talk) at 05:50, 10 December 2009. The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Complex event processing, or CEP, is primarily an event processing concept that deals with the task of processing multiple events with the goal of identifying the meaningful events within the event cloud. CEP employs techniques such as detection of complex patterns of many events, event correlation and abstraction, event hierarchies, and relationships between events such as causality, membership, and timing, and event-driven processes. CEP is to discover information contained in the events happening across all the layers in an organization and then analyze its impact from the macro level as "complex event" and then take subsequent action plan in real time.

A conceptual description of CEP

Examples of events include church bells ringing, the appearance of a man in a tuxedo with a woman in a flowing white gown, and rice flying through the air. A complex event is what one infers from the simple events: a wedding is happening. CEP is a technique that helps discover complex, inferred events by analyzing and correlating other events: the bells, the man and woman in wedding attire and the rice flying through the air.

There are many commercial applications of CEP including algorithmic stock trading, credit card fraud detection, business activity monitoring, and security monitoring[1]. New applications of CEP are emerging as technology vendors find new uses

Another systemic example of CEP

A more systemic example of CEP involves a car, some sensors and various events and reactions. Imagine that a car has several sensors - one that measures tire pressure, one that measures speed, and one that detects if someone sits on a seat or leaves a seat.

In the first situation, the car is moving and the pressure of one of the tires moves from 45 PSI to 41 PSI over 15 minutes. As the pressure in the tire is reducing, a series of events containing the tire pressure is generated. In addition, a series of events containing the speed of the car is generated. The car's Event Processor may detect a situation whereby a loss of tire pressure over a relatively long period of time results in the creation of the "lossOfTirePressure" event. This new event may trigger a reaction process to note the pressure loss into the car's maintenance log, and alert the driver via the car's portal that the tire pressure has reduced.

In the second situation, the car is moving and the pressure of one of the tires drops from 45 PSI to 20 PSI in 5 seconds. A different situation is detected - perhaps because the loss of pressure occurred over a shorter period of time, or perhaps because the difference in values between each event were larger than a predefined limit. The different situation results in a new event "blowOutTire" being generated. This new event triggers a different reaction process to immediately alert the driver and to initiate onboard computer routines to assist the driver in bringing the car to a stop without losing control through skidding.

In addition, events that represent detected situations can also be combined with other events in order to detect more complex situations. For example, in the final situation the car was moving normally but suffers a blown tire which results in the car leaving the road and striking a tree and the driver is thrown from the car. A series of different situations are rapidly detected. The combination of "blowOutTire", "zeroSpeed" and "driverLeftSeat" within a very short space of time results in a new situation being detected: "occupantThrownAccident". Even though there is no direct measurement that can determine conclusively that the driver was thrown, or that there was an accident, the combination of events allows the situation to be detected and a new event to be created to signify the detected situation. This is the essence of a complex (or composite) event. It is complex because one can not directly detect the situation; one has to infer or deduce that the situation has occurred from a combination of other events.

Types of CEP

Most CEP solutions and concepts can be classified into two main categories.

  1. Computation oriented CEP
  2. Detection oriented CEP

A computation oriented CEP solution is focused on executing on-line algorithms as a response to event data entering the system. A simple example is to continuously calculate an average based in data on the inbound events.

Detection oriented CEP is focused on detecting combinations of events called events patterns or situations. A simple example of detecting a situation is to look for a specific sequence of events.

Academic research

  • Aurora (Brandeis University, Brown University and MIT)
  • Borealis (Brandeis University, Brown University and MIT)
  • STREAM (Stanford University)
  • Telegraph (UC Berkeley)
  • SASE (UC Berkeley/UMass Amherst)
  • Cayuga (Cornell University)
  • PIPES (University of Marburg)

See also

References

  1. ^ Details of commercial products and use cases
Retrieved from "https://en.wikipedia.org/w/index.php?title=Complex_event_processing&oldid=330811872"