CEP: Event-Decision Architecture for  PredictiveBusiness TM Centre for Strategic Infocomm Technologies (CSIT), Singapore J...
Our Agenda <ul><li>Introduction </li></ul><ul><li>Event-Decision Architecture  </li></ul><ul><ul><li>High Level Overview o...
Introduction <ul><li>Event-Decision Processing is Computationally Intensive </li></ul><ul><li>CEP requires a Number of Tec...
A Vocabulary of Confusion  (Work in Progress) Resource Management Data Fusion Sensor Fusion Information Fusion Tracking Da...
PredictiveBusiness TM
Example PredictiveBusiness TM  Scenarios <ul><li>Finance </li></ul><ul><ul><li>Program (Opportunistic) Trading and Executi...
PredictiveBusiness TM  & Complex Event Processing (CEP) <ul><li>More CEP Scenarios: </li></ul><ul><li>Stock Trading </li><...
Our Agenda <ul><li>Introduction </li></ul><ul><li>Event-Decision Architecture  </li></ul><ul><ul><li>High Level Overview o...
Overview of IT and Decision Making What is a High Level View of How Businesses Make Decisions? <ul><li>Facts </li></ul><ul...
TIBCO BusinessEvents™ Solutions Overview BusinessEvents™ Solutions Space Data: Events & Databases -Real-Time & Historical ...
A Business Optimization Perspective What Classes of Rule-Based Problems Do Businesses Need to Solve? Rule-Based <ul><li>Pa...
Event-Decision Hierarchy 22 Impact Assessment Situational Assessment Relationship of Events Identify Events Location, Time...
Event-Decision High Level Architecture 22 EVENT CLOUD (DISTRIBUTED DATA SET) KS KS KS KS KS KS KS KS KS KS KS KS KS KS Ada...
<ul><li>Sensors </li></ul><ul><ul><li>Systems that provide data and events to the inference models and humans </li></ul></...
Event-Decision Reference Architecture 24 EVENT PRE-PROCESSING EVENT SOURCES EXTERNAL .  .  .  LEVEL ONE EVENT REFINEMENT U...
Structured Processing for Event-Decision <ul><li>Multi-level inference in a distributed event-decision architectures </li>...
CEP Level 0 –  Event Preprocessing  <ul><li>Cleanse/Refine/Normalize Data for Upstream Processing </li></ul><ul><li>Calibr...
CEP Level 1 – Event Refinement  <ul><li>Problem:  Which Events in the Event Stream Are “Interesting”? </li></ul><ul><li>Ev...
CEP Level 2 – Situation Refinement <ul><li>What is the Context of the Identified Events? </li></ul><ul><li>Focuses on Rela...
CEP Level 3 – Impact Assessment <ul><li>Predict Intention of Subject (Fraudster example) </li></ul><ul><ul><li>Make change...
CEP Level 4 – Process Refinement  <ul><li>Evaluate Process Performance and Effectiveness </li></ul><ul><ul><li>Exception D...
CEP - Database Management Examples <ul><li>Reference Database </li></ul><ul><ul><li>User Profiles </li></ul></ul><ul><ul><...
CEP Level 5 – User Interface / Interaction <ul><li>Operational Visualization at all “Levels” </li></ul><ul><ul><li>Dynamic...
TIBCO’S Event-Decision Reference Architecture Flexible SOA and Event-Driven Architecture
Our Agenda <ul><li>Introduction </li></ul><ul><li>Event-Decision Architecture  </li></ul><ul><ul><li>High Level Overview o...
Event Processing Application Scenarios  Examples of Detection-Prediction Scenarios We Solve for Customers POC Fraud Detect...
Identity Theft Detection / Phishing Example Fraud Detection Scenario   Source:  Bass, T., TIBCO Software Inc., January 200...
Customer Case Study: Fusion-Based IDS High Level Event-Driven Architecture (EDA) – Early Phase JAVA  MESSAGING SERVICE  (J...
Overview of Mizuho Securities Solutions Architecture <ul><li>Fusion of IDS information across Customer’s Enterprise, inclu...
Potential Extensions to Solutions Architecture <ul><li>Extension of IDS to rules-based access control </li></ul><ul><ul><l...
Event-Decision Processing Characteristics Adapted (this and the next slide) from:  Steinberg, A., & Bowman, C.,  Handbook ...
Comparison of Event-Decision Models Sense Detect Detect Analyze Analyze Decide Respond Sense & Respond Sensor Processing C...
Enterprise Scenario The Full Range of Business Integration Products and Services EVENTS EVENTS
Key Takeaways <ul><li>Event-Decision Processing is Computationally Intensive </li></ul><ul><li>CEP requires a Number of Te...
Thank You! Tim Bass, CISSP Principal Global Architect [email_address] Complex Event Processing at TIBCO
Example Publications, Webinars and Tools
Upcoming SlideShare
Loading in...5
×

CEP: Event-Decision Architecture for PredictiveBusiness, July 2006

2,598

Published on

CEP: Event-Decision Architecture for PredictiveBusiness, Centre for Strategic Infocomm Technologies (CSIT), Singapore July 26, 2006, Tim Bass, CISSP, Principal Global Architect, Director, TIBCO Software Inc.

Published in: Technology, Business
0 Comments
8 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
2,598
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
0
Comments
0
Likes
8
Embeds 0
No embeds

No notes for slide
  • CEP: Event-Decision Architecture for PredictiveBusiness, July 2006

    1. 1. CEP: Event-Decision Architecture for PredictiveBusiness TM Centre for Strategic Infocomm Technologies (CSIT), Singapore July 26, 2006 Tim Bass, CISSP Principal Global Architect, Director TIBCO Software Inc.
    2. 2. Our Agenda <ul><li>Introduction </li></ul><ul><li>Event-Decision Architecture </li></ul><ul><ul><li>High Level Overview of Decision Making and BusinessEvents™ </li></ul></ul><ul><ul><li>Event-Decision Reference Architecture </li></ul></ul><ul><li>CEP Scenarios, Use Cases and Application </li></ul><ul><li>Open Discussion </li></ul>
    3. 3. Introduction <ul><li>Event-Decision Processing is Computationally Intensive </li></ul><ul><li>CEP requires a Number of Technologies: </li></ul><ul><ul><li>Distributed Computing, Publish/Subscribe and SOA </li></ul></ul><ul><ul><li>Hierarchical, Cooperative Inference Processing </li></ul></ul><ul><ul><li>High Speed, Real Time Processing with State Management </li></ul></ul><ul><ul><li>Event-Decision Architecture for Complex Situations and Events </li></ul></ul><ul><li>There is no single “CEP Solution” or “CEP Product” </li></ul><ul><li>CEP needs a Common Vocabulary and Functional Architecture based on Mature, Industry-Standard Inference Models </li></ul><ul><li>TIBCO is Solving CEP Scenarios for Our Customers Today </li></ul>
    4. 4. A Vocabulary of Confusion (Work in Progress) Resource Management Data Fusion Sensor Fusion Information Fusion Tracking Data Mining Correlation Planning Complex Event Processing Processing Management Sensor Management Control Estimation Event Stream Processing Adapted from: Steinberg, A., & Bowman, C., CRC Press, 2001
    5. 5. PredictiveBusiness TM
    6. 6. Example PredictiveBusiness TM Scenarios <ul><li>Finance </li></ul><ul><ul><li>Program (Opportunistic) Trading and Execution </li></ul></ul><ul><ul><li>Risk Management </li></ul></ul><ul><ul><li>Pricing and Consumer Relationship Management </li></ul></ul><ul><ul><li>Fraud and Intrusion Detection </li></ul></ul><ul><li>Business Process Management </li></ul><ul><ul><li>Process Monitoring </li></ul></ul><ul><ul><li>Exception Management and Outage Prediction </li></ul></ul><ul><ul><li>Scheduling </li></ul></ul><ul><li>Sensor Networks </li></ul><ul><ul><li>Reliability of Complex, Distributed Systems </li></ul></ul><ul><ul><li>RFID Applications </li></ul></ul><ul><ul><li>Manufacturing Floor – “Sense and Respond” </li></ul></ul><ul><ul><li>Power Grid Monitoring </li></ul></ul><ul><ul><li>Military </li></ul></ul>
    7. 7. PredictiveBusiness TM & Complex Event Processing (CEP) <ul><li>More CEP Scenarios: </li></ul><ul><li>Stock Trading </li></ul><ul><ul><li>Automatic identification of buy/sell opportunities. </li></ul></ul><ul><li>Compliance Checks </li></ul><ul><ul><li>Sarbanes-Oxley detection. </li></ul></ul><ul><li>Fraud Detection </li></ul><ul><ul><li>Odd credit card purchases performed within a period. </li></ul></ul><ul><li>CRM </li></ul><ul><ul><li>Alert if three orders from the same platinum customer were rejected. </li></ul></ul><ul><li>Insurance Underwriting </li></ul><ul><ul><li>Identification of risk. </li></ul></ul>&quot; Events in several forms, from simple events to complex events, will become very widely used in business applications during 2004 through 2008 &quot; --- Gartner July 2003 Graphic Sources: TIBCO Software Inc & IBM CEP Situation Manager Event Streams Historical Data Real-time Detection and Prediction
    8. 8. Our Agenda <ul><li>Introduction </li></ul><ul><li>Event-Decision Architecture </li></ul><ul><ul><li>High Level Overview of Decision Making and BusinessEvents™ </li></ul></ul><ul><ul><li>Event-Decision Reference Architecture </li></ul></ul><ul><li>CEP Scenarios, Use Cases and Application </li></ul><ul><li>Open Discussion </li></ul>
    9. 9. Overview of IT and Decision Making What is a High Level View of How Businesses Make Decisions? <ul><li>Facts </li></ul><ul><li>Rules </li></ul><ul><li>Procedures </li></ul><ul><li>Historical Data/ </li></ul><ul><li>Historical Events </li></ul><ul><li>Real-Time Data </li></ul><ul><li>Real-Time Events </li></ul><ul><li>Statistical </li></ul><ul><li>Financial </li></ul><ul><li>Optimization </li></ul><ul><li>Simulation </li></ul>Document- Driven <ul><li>Unstructured Docs </li></ul><ul><li>Distributed Computing </li></ul><ul><li>Publish-Subscribe </li></ul><ul><li>Collaboration </li></ul>Knowledge- Driven Decision Making Communications- Driven Model- Driven Data- Driven
    10. 10. TIBCO BusinessEvents™ Solutions Overview BusinessEvents™ Solutions Space Data: Events & Databases -Real-Time & Historical Data Models: Statistical Financial Optimization Comms: Pub/Sub Messaging Queues Topics UIs Knowledge: Facts & Rules
    11. 11. A Business Optimization Perspective What Classes of Rule-Based Problems Do Businesses Need to Solve? Rule-Based <ul><li>Pattern Recognition </li></ul><ul><li>Anomaly Detection </li></ul><ul><li>Track and Trace </li></ul><ul><li>Monitoring (BAM) </li></ul><ul><li>Dynamic Resource Allocation </li></ul><ul><li>Adaptive Resource Allocation </li></ul><ul><li>Constraint Satisfaction (CSP) </li></ul><ul><li>Dynamic CSP </li></ul><ul><li>Adaptive Marketing </li></ul><ul><li>Dynamic CRM </li></ul><ul><li>Fault Management </li></ul><ul><li>Impact Assessment </li></ul>Detection Prediction Scheduling <ul><li>Fraud Detection </li></ul><ul><li>Intrusion Detection </li></ul><ul><li>Fault Detection </li></ul><ul><li>Rule-Based Access Control </li></ul><ul><li>Exception Management </li></ul><ul><li>Compliance Work Flow </li></ul><ul><li>Risk Management </li></ul><ul><li>Fault Analysis </li></ul><ul><li>Impact Assessment </li></ul>Solving a Broad Class of Complex Problems
    12. 12. Event-Decision Hierarchy 22 Impact Assessment Situational Assessment Relationship of Events Identify Events Location, Times and Rates of Events of Interest Existence of Possible Event of Interest Data/Event Cloud Analysis of Situation & Plans Contextual and Causal Analysis Causal Analysis, Bayesian Belief Networks, NNs, Correlation, State Estimation, Classification Use of Distributed Sensors for Estimations Raw Sensor Data (Passive and Active) Adapted from: Waltz, E. & Llinas, J., Multisensor Data Fusion, 1990 HIGH LOW MED
    13. 13. Event-Decision High Level Architecture 22 EVENT CLOUD (DISTRIBUTED DATA SET) KS KS KS KS KS KS KS KS KS KS KS KS KS KS Adapted from: Engelmore, R. S., Morgan, A.J., & and Nii, H. P., Blackboard Systems, 1988 & Luckham, D., The Power of Events, 2002
    14. 14. <ul><li>Sensors </li></ul><ul><ul><li>Systems that provide data and events to the inference models and humans </li></ul></ul><ul><li>Actuators </li></ul><ul><ul><li>Systems that take action based on inference models and human interactions </li></ul></ul><ul><li>Knowledge Processors </li></ul><ul><ul><li>Systems that take in data and events, process the data and events, and output refined, correlated, or inferred data or events </li></ul></ul>HLA - Knowledge Sources KS KS KS
    15. 15. Event-Decision Reference Architecture 24 EVENT PRE-PROCESSING EVENT SOURCES EXTERNAL . . . LEVEL ONE EVENT REFINEMENT USER INTERFACE COMPLEX EVENT PROCESSING (CEP) DB MANAGEMENT Historical Data Profiles & Patterns DISTRIBUTED LOCAL EVENT SERVICES . . EVENT PROFILES . . DATA BASES . . OTHER DATA LEVEL TWO SITUATION REFINEMENT LEVEL THREE IMPACT ASSESSMENT LEVEL FOUR PROCESS REFINEMENT Adapted from JDL: Steinberg, A., & Bowman, C., Handbook of Multisensor Data Fusion, CRC Press, 2001
    16. 16. Structured Processing for Event-Decision <ul><li>Multi-level inference in a distributed event-decision architectures </li></ul><ul><ul><li>Level 5 – User Interface </li></ul></ul><ul><ul><ul><li>Human visualization, interaction and situation management </li></ul></ul></ul><ul><ul><li>Level 4 – Process Refinement </li></ul></ul><ul><ul><ul><li>Decide on control feedback, for example resource allocation, sensor and state management, parametric and algorithm adjustment </li></ul></ul></ul><ul><ul><li>Level 3 – Impact Assessment </li></ul></ul><ul><ul><ul><li>Impact threat assessment, i.e. assess intent on the basis of situation development, recognition and prediction </li></ul></ul></ul><ul><ul><li>Level 2 – Situation Refinement </li></ul></ul><ul><ul><ul><li>Identify situations based on sets of complex events, state estimation, etc. </li></ul></ul></ul><ul><ul><li>Level 1 – Event Refinement </li></ul></ul><ul><ul><ul><li>Identify events & make initial decisions based on association and correlation </li></ul></ul></ul><ul><ul><li>Level 0 – Event Preprocessing </li></ul></ul><ul><ul><ul><li>Cleansing of event-stream to produce semantically understandable data </li></ul></ul></ul>Level of Inference Low Med High
    17. 17. CEP Level 0 – Event Preprocessing <ul><li>Cleanse/Refine/Normalize Data for Upstream Processing </li></ul><ul><li>Calibrate Raw Event Cloud: </li></ul><ul><ul><li>Web Server Farm Event Stream Example - </li></ul></ul><ul><ul><ul><li>Group HTTP REQUESTS and RESPONSES </li></ul></ul></ul><ul><ul><ul><li>Reduce and Extract Required Data from Transaction </li></ul></ul></ul><ul><ul><ul><li>Format into Event for Upstream Processing </li></ul></ul></ul><ul><ul><li>Intelligent Agent Fraud Detection Event Steam Example - </li></ul></ul><ul><ul><ul><li>Receive Event Stream from Purpose-Built FD Application </li></ul></ul></ul><ul><ul><ul><li>Reduce and Extract Required Event from Event Stream </li></ul></ul></ul><ul><ul><ul><li>Format for Upstream Processing </li></ul></ul></ul><ul><li>Reduces System Load by Preprocessing Events </li></ul><ul><li>Enables Upstream to Concentrate on Most Relevant Events </li></ul><ul><li>Focuses on Objects/Events </li></ul>
    18. 18. CEP Level 1 – Event Refinement <ul><li>Problem: Which Events in the Event Stream Are “Interesting”? </li></ul><ul><li>Event Refinement Example (Association & Classification): </li></ul><ul><ul><li>Hypothesis Generation (HG) </li></ul></ul><ul><ul><ul><li>Processing incoming events, data and reports </li></ul></ul></ul><ul><ul><ul><li>Hypothesis: This Group of Events May Represent Fraud </li></ul></ul></ul><ul><ul><ul><li>Output: Fraud Detection Scorecard or Matrix </li></ul></ul></ul><ul><ul><li>Hypothesis Evaluation (HE) </li></ul></ul><ul><ul><ul><li>Evaluates Scorecard/Matrix for likelihood comparison </li></ul></ul></ul><ul><ul><ul><li>Rank Evaluation: These Events have a Higher Likelihood of Fraud </li></ul></ul></ul><ul><ul><ul><li>Output: Fills Scorecard/Matrix with relative likelihood estimation </li></ul></ul></ul><ul><ul><li>Hypothesis Selection (HS) </li></ul></ul><ul><ul><ul><li>Evaluates Scorecard/Matrix for best fit into “badges of fraud” </li></ul></ul></ul><ul><ul><ul><li>Evaluation: Provide an Estimate (Name) of the Fraudulent Activity </li></ul></ul></ul><ul><ul><ul><li>Output: Assignment of fraudulent activity estimate to event </li></ul></ul></ul>
    19. 19. CEP Level 2 – Situation Refinement <ul><li>What is the Context of the Identified Events? </li></ul><ul><li>Focuses on Relationships and States Among Events </li></ul><ul><li>Situation Refinement </li></ul><ul><ul><li>Event-Event Relationship Networks </li></ul></ul><ul><ul><li>Temporal and State Relationships </li></ul></ul><ul><ul><li>Geographic or Topological Proximity </li></ul></ul><ul><ul><li>Environmental Context </li></ul></ul><ul><ul><ul><li>Example: Brand currently used by phishing site in Internet increasing probability of fraud and identity theft </li></ul></ul></ul><ul><li>Event / Activity Correlation – Relational Networks </li></ul><ul><li>Pattern, Profile and Signature Recognition Processing </li></ul><ul><li>Question: Do “Complex Events” == “Situations”? </li></ul>
    20. 20. CEP Level 3 – Impact Assessment <ul><li>Predict Intention of Subject (Fraudster example) </li></ul><ul><ul><li>Make changes to account identity information? </li></ul></ul><ul><ul><li>Transfer funds out of account? </li></ul></ul><ul><ul><li>Test for access and return at later time? </li></ul></ul><ul><li>Estimate Capabilities of Fraudster </li></ul><ul><ul><li>Organized Gang or Individual Fraudster? </li></ul></ul><ul><ul><li>Expert or Novice? </li></ul></ul><ul><li>Estimate Potential Losses if Successful </li></ul><ul><li>Identify Other Threat Opportunities </li></ul>
    21. 21. CEP Level 4 – Process Refinement <ul><li>Evaluate Process Performance and Effectiveness </li></ul><ul><ul><li>Exception Detection, Response Efficiency and Mitigation </li></ul></ul><ul><ul><li>Knowledge Development </li></ul></ul><ul><li>Identify Changes to System Parameters </li></ul><ul><ul><li>Adjust Event Stream Processing Variables </li></ul></ul><ul><ul><li>Fine Tune Filters, Algorithms and Correlators </li></ul></ul><ul><li>Determine If Other Source Specific Resources are Required </li></ul><ul><li>Recommend Allocation and Direction of Resources </li></ul>
    22. 22. CEP - Database Management Examples <ul><li>Reference Database </li></ul><ul><ul><li>User Profiles </li></ul></ul><ul><ul><li>Activity and Event Signatures and Profiles </li></ul></ul><ul><ul><li>Environmental Profiles </li></ul></ul><ul><li>Inference Database </li></ul><ul><ul><li>Subject Identification </li></ul></ul><ul><ul><li>Situation and Threat Assessment </li></ul></ul><ul><ul><li>Knowledge Mining </li></ul></ul><ul><li>Referential Mapping Database Examples </li></ul><ul><ul><li>Mapping Between IP Address and Domain </li></ul></ul><ul><ul><li>Mapping Between Known Anonymous Proxies </li></ul></ul>
    23. 23. CEP Level 5 – User Interface / Interaction <ul><li>Operational Visualization at all “Levels” </li></ul><ul><ul><li>Dynamic Graphical Representations of Situations </li></ul></ul><ul><ul><li>Supports the Decision Making Process of Analytics Personnel </li></ul></ul><ul><li>Process and Resource Control </li></ul><ul><ul><li>Supports Resource Allocation and Process Refinement </li></ul></ul><ul><li>Display Control & Personalization </li></ul><ul><ul><li>Different Operator Views Based on Job Function and Situation </li></ul></ul>
    24. 24. TIBCO’S Event-Decision Reference Architecture Flexible SOA and Event-Driven Architecture
    25. 25. Our Agenda <ul><li>Introduction </li></ul><ul><li>Event-Decision Architecture </li></ul><ul><ul><li>High Level Overview of Decision Making and BusinessEvents™ </li></ul></ul><ul><ul><li>Event-Decision Reference Architecture </li></ul></ul><ul><li>CEP Scenarios, Use Cases and Application </li></ul><ul><li>Open Discussion </li></ul>
    26. 26. Event Processing Application Scenarios Examples of Detection-Prediction Scenarios We Solve for Customers POC Fraud Detection Financial Services Pre-Sales Intrusion Detection Financial Services Production Supply Chain Monitoring Business Hub (B2B) Planning/POC Supply Chain Monitoring Manufacturing Pre-Sales Anti Money Laundering Government Pre-Sales Power Grid Monitoring Energy Production Track & Trace Transportation Production Service Monitoring Telecommunications Pre-Sales Track & Trace Supply Chain - Logistics Pre-Sales Network & Applications Management Telecommunications Status (2Q06) Application Scenarios Industry
    27. 27. Identity Theft Detection / Phishing Example Fraud Detection Scenario Source: Bass, T., TIBCO Software Inc., January 2006 Uses Proxy Alert Service Account Lockout Profile Mismatch Brand Phishing Alert Security Alert Customer Known Fraud IP Identity Theft Login Success Phishing Alert Brand Misuse
    28. 28. Customer Case Study: Fusion-Based IDS High Level Event-Driven Architecture (EDA) – Early Phase JAVA MESSAGING SERVICE (JMS) DISTRIBUTED QUEUES (TIBCO EMS) HIGH PERFORMANCE RULES-ENGINE (TIBCO BE) HIGH PERFORMANCE RULES-ENGINE (TIBCO BE) HIGH PERFORMANCE RULES-ENGINE (TIBCO BE) HIGH PERFORMANCE RULES-ENGINE (TIBCO BE ) SENSOR NETWORK RULES NETWORK NIDS BW JMS LOGFILE JMS BW LOGFILE JMS BW LOGFILE JMS BW IDS JMS BW HIDS JMS BW SQL DB BW JMS ADB SQL DB BW JMS ADB MESSAGING NETWORK TIBCO PRODUCTS
    29. 29. Overview of Mizuho Securities Solutions Architecture <ul><li>Fusion of IDS information across Customer’s Enterprise, including: </li></ul><ul><ul><li>Log files </li></ul></ul><ul><ul><li>Existing Customer’s IDS (host and network based) devices </li></ul></ul><ul><ul><li>Network traffic monitors (as required) </li></ul></ul><ul><ul><li>Host statistics (as required) </li></ul></ul><ul><li>Secure, standards-based JAVA Messaging Service (JMS) for messaging: </li></ul><ul><ul><li>Events parsed into JMS Properties (Extended headers) </li></ul></ul><ul><ul><li>SSL transport for JMS messages </li></ul></ul><ul><li>TIBCO technology for next-generation detection, prediction, rule-based intrusion response, and adaptive control </li></ul><ul><ul><li>TIBCO Business Works™ as required, to transform, map or cleanse data </li></ul></ul><ul><ul><li>TIBCO BusinessEvents™ for rule-based IDS analytics </li></ul></ul><ul><ul><li>TIBCO Active Database Adapter as required </li></ul></ul>
    30. 30. Potential Extensions to Solutions Architecture <ul><li>Extension of IDS to rules-based access control </li></ul><ul><ul><li>Integration of IDS with access control </li></ul></ul><ul><ul><li>TIBCO BusinessEvents™ for rule-based access control </li></ul></ul><ul><li>Extension of IDS and access control to incident response </li></ul><ul><ul><li>Event-triggered work flow </li></ul></ul><ul><ul><li>TIBCO iProcess™ BPM for incident response </li></ul></ul><ul><ul><li>TIBCO iProcess™ BPM security entitlement work flow </li></ul></ul><ul><ul><li>TIBCO BusinessEvents™ for rule-based access control </li></ul></ul><ul><li>Extensions for other risk and compliance requirements </li></ul><ul><ul><li>Basel II, SOX, and JSOX - for example </li></ul></ul><ul><ul><li>Other possibilities to be discussed later </li></ul></ul><ul><li>Extensions for IT management requirements </li></ul><ul><ul><li>Monitoring and fault management, service management, ITIL </li></ul></ul>
    31. 31. Event-Decision Processing Characteristics Adapted (this and the next slide) from: Steinberg, A., & Bowman, C., Handbook of Multisensor Data Fusion, CRC Press, 2001 Sensor Output Individual Event Aggregation (situation) Effect (situation, given plan) (Action) Entity Estimate Sensor Processing Event Processing Situation Assessment Impact Assessment Decision Making Activity Detection Assignment (L0) Event Preprocessing Attribution Assignment (L1) Event Refinement Relational Aggregation (L2) Situation Refinement Plan Interaction Aggregation (L3) Impact Assessment (Control) Planning (L4) Process Refinement Estimation Process Association Process JDL Model Levels
    32. 32. Comparison of Event-Decision Models Sense Detect Detect Analyze Analyze Decide Respond Sense & Respond Sensor Processing Collate Orient Sensor Processing (L0) Event Preprocessing Sensor Acquisition Collect Observe Sensing --- Activity Intelligence Cycle Boyd Loop Waterfall Model JDL Model Levels Decision Execution Disseminate Act (L5) Visualization Collate Evaluate Evaluate Disseminate Event Processing Situation Assessment Impact Assessment Decision Making Orient Pattern Processing / Feature Extraction (L1) Event Refinement Orient Situation Assessment (L2) Situation Refinement Orient --- (L3) Impact Assessment Decide Decision Making (L4) Process Refinement
    33. 33. Enterprise Scenario The Full Range of Business Integration Products and Services EVENTS EVENTS
    34. 34. Key Takeaways <ul><li>Event-Decision Processing is Computationally Intensive </li></ul><ul><li>CEP requires a Number of Technologies: </li></ul><ul><ul><li>Distributed Computing, Publish/Subscribe and SOA </li></ul></ul><ul><ul><li>Hierarchical, Cooperative Inference Processing </li></ul></ul><ul><ul><li>High Speed, Real Time Processing with State Management </li></ul></ul><ul><ul><li>Event-Decision Architecture for Complex Situations and Events </li></ul></ul><ul><li>There is no single “CEP Solution” or “CEP Product” </li></ul><ul><li>CEP needs a Common Vocabulary and Functional Architecture based on Mature, Industry-Standard Inference Models </li></ul><ul><li>TIBCO is Solving CEP Scenarios for Our Customers Today </li></ul>
    35. 35. Thank You! Tim Bass, CISSP Principal Global Architect [email_address] Complex Event Processing at TIBCO
    36. 36. Example Publications, Webinars and Tools

    ×