Contextualised Event-Triggered Reactivity With Similarity Search iCEP – FIS 08 28. September 2008

1. Contextualised Event-Triggered Reactivity With Similarity Search iCEP – FIS 08 28. September 2008 Darko Anicic, Sinan Sen, Nenad Stojanovic, Jun Ma, and Kay-Uwe Schmidt WIR FORSCHEN FÜR SIE

2. Agenda • Introduction; • Use Case Scenario; • Event Processing; • Similarity Search; • Contextualised Event-Triggered Reactivity With Similarity Search; • Conclusion.

3. Introduction • Complex events with precise specifications not always desired; • Fraud or failure detection apps. demand similar events; • Our approach - combining reactive rules with ontologies: • to capture the context; • to discover similar (uncertain and unknown) complex events. • Semantic approach for reasoning about events, their contexts and reactions.

4. Use Case Scenario • SAP Business ByDesign SaaS: • Mission-critical applications; • Failure detection and maintenance to be improved; • Application context important for meaningful alerts. • CEP for monitoring and metering in SaaS; • Example rules: • If all CRM-Monit-Evs in last 5 minutes (event) exceed 90% for CPU cons. (condition) and no previous repair action happened (context) => do aut. healing. • If all CRM-Monit-Evs in last 5 minutes (event) exceed 90% for CPU cons. (condition) and the aut. self healing did not work from prev. situation (different context), => do different action. • Similarity measures enable reuse of rules to be fired in situations, not originally specified but similar to them.

5. Contextualised Event-Triggered Reactivity With Similarity Search • System architecture; • Reactive rules; • Event Calculus Extended With Similarity Search; • Context Model for Event Processing; • Detection of Complex Events and Situations

6. Event Processing Complex Event Processing (CEP), is primarily an event processing concept that deals with the task of processing multiple events from an event cloud with the goal of identifying the meaningful events within the event cloud. Figure source: Opher Etzion, IBM Research

7. System Architecture

8. Reactive Rules • Previous form: “ON event IF condition DO action”; • Condition used for contextual information; • Required form: “ON event WITHIN context IF condition DO action”; • Context used for no explicit relationships between events and reactions;

9. Event Calculus With Similarity Search Similarity calculation is based on an event ontology Aggregation of taxonomy similarity and property similarity simA(e1,e2)= simtx(e1,e2) + simft(e1,e2) If simA is above a predefined threshold events are considered as to be similar  Using the similarity results rules can be fired, which were not originally defined for this situation e.g. fraud detection. sim=0.87

10. Event Calculus With Similarity Search (cont.)

11. Context Model for Event Processing • Unknown events cannot be detected with classical CEP approaches; • Context is important concept in dealing with unknown situations; • Context helps in conflict resolution (e.g., 2 contradictory actions triggered by an event); • Ontologically represented context: • Number of attributes with predetermined values; • Discrimination concepts (e.g., location, date, time, involved actors, execution phase etc.); • Actions relevant for particular context. • Run-time context instantiation with SWRL rules.

12. Detection of Complex Events • Bottom-up complex event detection; • Propagate up to parent when condition (operation) is satisfied; • Event history for implementation of different polices (i.e. recent policy etc.)

13. Detection of Complex Situations

14. Conclusion • Event-triggered reactivity with similarities measures for monitoring; • Contextualised similarity for detection of unknown complex events and situations; • Reasoning over complex situations for intelligent reactive systems;

15. Other Stuff We DO… Private WFs ACWFs Private WFs Start Start Start tφφ tφ tφψ OR OR OR cond.φφ cond.φψ cond.φ cond.φψ cond.ψψ cond.3 cond.ψ tψφ t3φ tψ t6 tψψ t3ψ t3 cond.3φ cond.4φ cond.3 cond.3 cond.4 cond.5 cond.4 t4φ t5φ t4 t7 t4ψ t5ψ t5 t6φ t6 t6ψ End End End

16. Thank you! Questions please…