Use Case TutorialIntroductionPedro Bizarro on behalf of the group

Motivation of EPTS Use Case WorkgroupPurposeCreation of a use case questionnaire Collection of use cases Classification of use cases Taxonomy and classification2

MembersDieter Gawlick <dieter.gawlick@oracle.com> (co-chair)Pedro Bizarro <bizarro@dei.uc.pt> (co-chair)Alexander Widder <Alexander_Widder@gmx.de> Arkady A. Godin <agodin@mitre.org> BalaManiymaran <bmmaran@gmail.com> Beth Plale <plale@cs.indiana.edu> ChristophEmmersberger <christoph.emmersberger@citt-online.com> David Tucker <D.Tucker@eventzero.com> Florian Springer <email@florianspringer.de> Hans-Arno Jacobsen <jacobsen@eecg.toronto.edu> Harvey G. Reed <hreed@mitre.org> Matthew Cooper <M.Cooper@eventzero.com> Rainer von Ammon <vonammon@t-online.de> Steve Holbrook <shh@us.ibm.com> Thomas Ertlmaier <thomas.ertlmaier@citt-online.com> Thomas Paulus <thomas.paulus@citt-online.com> Serge Mankovskii (serge.mankovskii@ca.com) 313 meetings since Febaverage participation: 7-8

4Use CasesRetail Fraud Thomas Paulus (CITT)Health Care Pedro Bizarro, Diogo Guerra (U Coimbra), Dieter Gawlick (Oracle)Fleet Management Matthew Cooper (EventZero)Very Large EPN – Bio-defenseHarvey G. Reed (MITRE) – Dieter on behalf of HarveyBPM/BAMHans-Arno Jacobsen (University of Toronto)

Retail Fraud

Thomas Paulus (CITT)

Health Care

Pedro Bizarro, Diogo Guerra (U Coimbra), Dieter Gawlick (Oracle)

Fleet Management

Matthew Cooper (EventZero)

Very Large EPN – Bio-defense

Harvey G. Reed (MITRE) – Dieter on behalf of Harvey

BPM/BAM

Hans-Arno Jacobsen (University of Toronto)

Information per Use CaseQuestionnaireTextual descriptionPowerPoint overviewWiki-page with lessons learned and extra-infohttp://members.ep-ts.org5

The Questionnaire – Earlier versions2007: Kick-off by OpherEtzion (IBM)2008: Dieter Gawlick, Tao Lin (SAP), and Pedro and F2F meeting @ DEBS’2008 with Alex Kozlenkov (Betfair), Brian Connell (WestGlobal), Opher Etzion, and Richard Tibbetts (Streambase)2008: 1st version @ 4th EPTS in September2009: 2nd version today6

The Questionnaire – SectionsShort DescriptionFunctionalitySystem Inputs and OutputsSystem usersEvent ProcessingPattern DetectionReactionsSpecific Functional AspectsOperationalImplementation ConstraintsTerminology in use7

The Questionnaire – Short DescriptionWhat problem are you trying to solve?Why do you use or want to use event processing systems? (e.g., better scalability, latency, detection, ROI, increased automation, or adaptability to changing requirements). What industry or organizations are involved?If end users are involved, briefly describe are their department, roles and responsibilities? What are the success metrics, if any?Status of your system? (in use, development, design) Diagrams (architecture, data-flows, GUIs)8

The Questionnaire – FunctionalitySystem Inputs and OutputsSources: Where do data come from?Input: What are the types of incoming dataAcquisition: How is the data obtained?Sinks: Where is data delivered to?Output: What are the types of outgoing dataDelivery: How is data delivered?Channels: How is data transmitted?9

The Questionnaire – FunctionalityEvent ProcessingFilter: Describe any filters applied to eventsEnrichment: Are additional properties added into eventsAggregation: Is the incoming event data aggregated? Concatenating/Merging: Are different event types being concatenated or combined?Translate: Is any encoding/decoding, enumerating, mediation, mapping, etc. required at the semantic and data levels?Transform: Is any schema transformation of the representation of a data model required?10

The Questionnaire – FunctionalityPattern Detection for…Discover associations/relationships between events?Correlate events using event properties?Discover specific sequences of events?Discover trends over sequences of events?Discover trends over groups of events?Is there a need for an external program or user to query the state stored in a rule, e.g., to determine eventual pending alarms?Is there a need to express rules over a state instead/in addition to over individual events?Is there a need to store and/or query past patterns/states?11

The Questionnaire – FunctionalitySpecific Functional AspectsAre events/messages time stamped and/or geo-tagged?Is there a need for other support associated with events such as classifications, security, clearance, or sensitivity markings?How should the system deal with out-of-order/missing events? Do you require the system to automatically learn new queries/patterns/models?Is there a requirement for a dynamic system with respect to new sources/sinks/channels?12

The Questionnaire – FunctionalityOperationalNumber of components (sources, sinks, transformers, channels)?Events per second and with how much delay? Specify examplesHow many concurrent patterns/thresholds/triggers?How many “detections” per time unit do you anticipate having? Are there detection time requirements? How long do pattern instances need to be retained?Is scalability/growth a fundamental characteristic of your system?Recovery?, Fault Tolerance?, Disaster Tolerance?High Availability?, Load Balancing?, Transactionality?13

Build and Review ProcessBuild questionnaire incrementally, section-by-sectionReview, review, reviewReviewers per document sectionCross-review each other’s workPrevent stalemates by taking things offline (Thank you Dieter!)14

OutlineIntroduction PedroFraud in Retail ThomasHealth Care DieterVery Large EPN (Bio-D) Dieter on behalf of Harvey---- 15-minute break ----Transport Management MatthewBAM/BPM ArnoLessons Learned PedroQ&A All15

Introduction Pedro

Fraud in Retail Thomas

Health Care Dieter

Very Large EPN (Bio-D) Dieter on behalf of Harvey

---- 15-minute break ----

Transport Management Matthew

BAM/BPM Arno

Lessons Learned Pedro

Q&A All