304 results about "Complex event processing" patented technology

A continuous query parallel engine on data streams provides scalability and increases the throughput by the addition of new nodes. The parallel processing can be applied to data stream processing and complex events processing. The continuous query parallel engine receives the query to be deployed and splits the original query into subqueries, obtaining at least one subquery; each subquery is executed in at least in one node. Tuples produced by each operator of each subquery are labeled with timestamps. A load balancer is interposed at the output of each node that executes each one of the instances of the source subquery and an input merger is interposed in each node that executes each one of the instances of a destination subquery. After checks are performed, further load balancers or input managers may be added.

A system for characterizing malicious activity in an intelligent utility grid system includes a system storage in which to store a database including a plurality of rules. A collector is operable to collect and store in the system storage information-technology (IT) data including IT-related activity from the intelligent grid system. A complex event processing (CEP) bus is operable to receive non-IT data including location-specific event data from a plurality of electronic sources, the CEP bus further operable to disregard the non-IT data failing to meet a predetermined level of relevance to one of a plurality of risk-related events. A processor is operable to apply the plurality of rules to the relevant non-IT data to: associate an undesired event with reference to the IT-related activity; and determine a probability that the undesired event is indicative of malicious activity. The processor further applies a risk characterization to the undesired event based on the probability and the IT-related activity.

Methods, systems, and computer-readable media are disclosed for event processing with a query based on a reusable XML query template. A particular method includes receiving a plurality of events from a source and generating a plurality of event objects based on the plurality of events. A query represented by an XML file based on a reusable XML query template is executed with respect to the plurality of event objects to produce a plurality of result objects. Each result object is produced based on an application of at least one operator of the query. A plurality of results is generated based on the plurality of result objects, and the plurality of results is transmitted to a sink.

The invention provides a system for providing services of an event-driven service-oriented internet of things and a working method of the system. The system is composed of a plurality of parts of an internet of things service system, an access agent, a unified message distribution network based on a publish-subscribe mechanism, a complex event processing engine, a resource descriptive model base and a sensor system. The system and the working method solve the problems that an existing system for providing the services of the internet of things can not process large-scale sensing information in a distributed mode, events in a physical world can not be processed, effective cross-business-domain and cross-organization coordination is difficult to achieve by different enterprise business processes. According to the system, sensing information is effectively distributed in the open and distributed computing environment, various pieces of sensing information can be conveniently and quickly distributed as required among different internet of things heterogeneous service systems, event-driven cross-business-domain and cross-organization service dynamic coordination is achieved, time, space and control flow uncoupled network services are provided, and quick response to change of the physical world can be flexibly and dynamically achieved in real time.

A system comprising a plurality of complex event processing engines including a first complex event processing engine set at a first tier and a second complex event processing engine set at a second tier. Each of the plurality of complex event processing engines executes on at least one hardware computer processor. The plurality of complex event processing engines are configured such that at least one complex event processing engine in the second set communicates with only some of the other complex event processing engines in the second set. The plurality of complex event processing engines further are configured such that at least one complex event processing engine in the first set communicates with each complex event processing engine in the second set.

A system for conducting real-time and historical analysis of complex customer care processes, comprising an event collector software module, a complex event processing software module adapted to receive events from the event collector software module, a distributed data storage layer, a business analytics software module adapted to receive and process data from the distributed data storage layer, a distributed configuration software module, and a user interface software module adapted to receive analytics results from the business analytics software module.Upon receiving an event from an event source, the event collector software module at least converts the event into a standard event data format suitable for use by the complex event processing software module and extracts or masks sensitive data from the event based on privacy rules maintained by the distributed configuration software module.

A system and method for motivating users to improve their wellness utilizes complex event processing on sensor and user-interaction data of the users collected over time using inference and predictive models in order to deliver personalized interactions to motive the users toward their wellness goals.

A system and method for implementing a service oriented architecture that supports complex event processing and business activity monitoring. An enterprise service bus (ESB) generates a first list of one or more devices, receives a selection from a user associated with a first device of a second device in the first list, generates a second list that includes functions associated with the selection from the first user, receives a request from the first device to perform one of the functions in the second list, translates a first communication protocol of the request received from the first device into a second communication protocol used by the second device to create a translated request, translates a first message format of the request into a second message format and transmits the translated request to the second device.

The embodiment of the invention discloses a complex event processing method and device. The method comprises the steps of: after receiving base events, determining an event mode to which the base events belong according to the event information of the base events, wherein the base events carry event labels; inputting the base events into a state machine instance corresponding to the event labels, wherein the state machine instance is created by a state machine defined according to the event mode to which the base events belong, and the base events belonging to the same state machine instance have the same event label; and outputting a complex event according to a state transition result according to the state machine instance. According to the embodiment of the invention, the complex event is output by means of the state transition result of the state machine instance, so that the consumed storage space of a system for storing a large number of base events is reduced; in addition, because the definition of the state machine specific to a certain event mode can be transformed according to actual application demands, the flexibility of the system in complex event processing is enhanced.

The invention discloses a real-time security early warning method based on complex event processing. The method specifically comprises the following steps: step (1), using a formalized engine to perform log field segmentation on collected security data, performing normalization on fields according to field requirements, and associating knowledge base information according to the fields that are expected to be outputted; step (2), using a data flow semantic analysis engine to perform data context analysis according to a complex event instance to be modeled as a scene, and analyzing mapping stream data based on a standardized analysis field template; and step (3), using a security analysis model calculation engine, in an analysis rule calculation module, analyzing according to scenes based on a point event, an edge event and an interval event, and generating an early warning event. The real-time security early warning method based on the complex event processing provided by the invention realizes the multi-angle association analysis of original log data through a configurable normalization rule, a semantic recognition rule and a security analysis rule, and discovers unknown threats and carries out early warning timely.

Certain example embodiments described herein relate to forecasting the future behavior of event streams in Complex Event Processing (CEP) environments. For each received event in an event stream, a reference window indicative of a predefined temporal range during which the forecast is to be computed is updated so that the reference window ends with the received event, with the reference window moving with the event stream. Within this processing loop, when a forecasting update policy indicates that the forecast is to be updated based on the received event: a forecasting window indicative of a temporal range in which events are to be forecasted is updated; and while the time period of the forecasting window is not exceeded, (a) a next forecasted event is generated via at least one processor and (b) the next forecasted event is inserted into the forecast window; and the forecast window is published.

A system and method for replicating a distributed computer system state among a plurality of deterministic event processing engines are disclosed. A sender module receives a plurality of input events or input event streams and generates a serialized message sequence describing an order in which input events are processed. The serialized message sequence is then transmitted to a plurality of deterministic event processing engines for processing. As the event processing engines are deterministic, each event processing engine produces the same ordered sequence responsive to the received serialized message sequence. The ordered sequences from each deterministic event processing engine are transmitted to a merger module which generates an output from the plurality of ordered sequences. The merger module removes one or more redundant ordered sequences and associates the resulting output with a client device.

Disclosed herein are methods, systems, and computer readable storage media for performing load balancing actions in a complex event processing system. Static statistics of a complex event processing node, dynamic statistics of the complex event processing node, and project statistics for projects executing on the complex event processing node are aggregated. A determination is made as to whether the aggregated statistics satisfy a condition. A load balancing action may be performed, based on the determination.

Techniques for extending the capabilities of an event processing system to support the processing of spatial data. In one set of embodiments, this extensibility can be provided via a plug-in extension component referred to herein as a spatial data cartridge. The spatial data cartridge can enable the event processing system to support spatial data types (e.g., point, polygon, etc.) and various operations related to such data types (e.g., proximity determinations, overlap determinations, etc.). The spatial data cartridge can also define an indexing scheme that can be integrated with the capabilities of the event processing system to support the indexing of spatial data. Using the spatial data cartridge, the event processing system can operate on spatial data even if spatial data formats are not natively supported by the system.

A method including receiving, at a computer system, debugging configuration information specifying a functional area of a data stream processing server to be debugged, is described. Furthermore, the method includes identifying, by the computer system, an object associated with the functional area that has been instantiated by the data stream processing server, determining, by the computer system, that tracing for the object is enabled to perform the debugging, and instantiating, by the computer system, a tracelet associated with the object. Further, the method includes stepping, by the computer system, through the tracelet associated with the object to debug the object, and displaying, by the computer system, a visual representation of debugging results associated with the object.

Certain example embodiments described herein relate to techniques for user feedback driven dynamic query rewriting in complex event processing (CEP) environments. In certain example embodiments, the adjustment of already-initiated queries may be permitted during runtime in order to help continuously or substantially continuously meet a user's requirements. In certain example embodiments, parameters of a query may be adapted dynamically, e.g., without the need to redeploy it. Adaptable parameters in certain example embodiments may be identified and / or based on, for instance, an automatic determination from original query creation, user specifications, the way in which a user interacts with a user interface for visualizing the results of queries, etc.

A method for workflow management includes modeling a workflow as a set of nodes linked by transitions. At least one of the nodes is defined as an action triggered by a situation using a complex event processing (CEP) engine. During execution of the workflow, the CEP engine is invoked in order to detect the situation, and the action is performed responsively to detection of the situation by the CEP engine.

The present invention includes a method for providing parameterized queries in complex event processing (CEP). The method includes providing a query template which includes one or more bind variables, providing sets of parameters corresponding to the one or more bind variables, and parsing the query template to determine positions of the one or more bind variables. The method further includes scanning the provided sets of parameters to determine which of the sets of parameters are to be bound to the one or more bind variables, binding the one or more bind variables which are determined to be bound to the sets of parameters, and substituting the bound one or more bind variables with the corresponding sets of parameters. The method further includes injecting all incarnations of the parameterized queries into the system, and one template / parameterized query is configured to run them all.

A framework or infrastructure (extensibility framework / infrastructure) for extending the indexing capabilities of an event processing system. The capabilities of an event processing system may be extended to support indexing schemes, including related data types and operations, which are not natively supported by the event processing system. The extensibility is enabled by one or more plug-in extension components called data cartridges.

The present invention concerns a complex event processing (CEP) engine (1) for processing CEP queries (10) over data streams, wherein the CEP engine (1) comprises:a. a parser (100), adapted for parsing a received CEP query (10) into a logical query graph (20); andb. a translator (300), adapted for translating the logical query graph (20) into a physical query plan (30) in accordance with one of a plurality of data stream representations; whereinc. the logical query graph (20) is independent of the plurality of data stream representations.

A system and method for constructing and deploying a business activity monitoring (BAM) dashboard associated with an event-based process are disclosed. A configuration module receives an event-based process identifier for an event-based process and data, such as inputs or outputs, for the event-based process. A generation module then generates a dashboard description that includes the identifier and an associated dashboard template having one or more dashboard components. This dashboard description is used by a dashboard server to automatically generate a BAM dashboard for monitoring the event-based process by using the association between the dashboard template and the event-based process to display data associated with the event-based process using one or more dashboard components.

Provided is a process, including: obtaining a set of historical geolocations; segmenting the historical geolocations into a plurality of temporal bins; determining pairwise transition probabilities between a set of geographic places based on the historical geolocations; configuring a compute cluster by assigning subsets of the transition probabilities to computing devices in the compute cluster; receiving a geolocation stream indicative of current geolocations of individuals; selecting a computing device in the compute cluster in response to determining that the computing device contain transition probabilities for the received respective geolocation; selecting transition probabilities applicable to the received respective geolocation from among the subset of transition probabilities assigned to the selected computing device; predicting a subsequent geographic place based on the selected transition probabilities.

Some event ordering requirements can be determined based on continuous event processing queries. Other event ordering requirements can be determined based on distribution flow types being used to distribute events from event streams to node executing the queries. Events from event streams can be ordered according to ordering semantics that are based on a combination of all of these event ordering requirements. Additionally, virtual computing nodes can be associated with constraints, and computing processors can be associated with capabilities. Virtual computing nodes for processing event streams can be assigned to execute on various computing processors based on both these constraints and capabilities. Additionally, for each of several events in an event stream, a ratio between a total latency and a communication latency can be for determined. Based on an average of these ratios, a quantity of reducing nodes that will be involved in a map-reduce operation can be selected.

An enterprise application integration broker for managing a number of applications. The enterprise application integration broker includes a complex event processing engine. The complex event processing engine is adapted to monitor and analyze a first set of events in at least one of the plurality of applications. In addition, the enterprise application integration broker includes an integration engine. The integration engine is connected to the complex event processing engine and is connected to each of the applications. The integration engine is adapted to cause at least one application to react to a first set of events occurring in one or more of the plurality of applications. The integration engine is further adapted to cause at least one application to react to a second set of events generated by the complex event processing engine. The second set of events is correlated with the first set of events.

One embodiment of an event management system, operating on a computer system having event producers and event consumers, includes an initial event handler program and an event queue having a first event. The initial event handler program retrieves the first event from the event queue for event processing. This event processing returns a first response to the initial event handler program, wherein the initial event handler program manages the first event on the event queue based on the first response.

Techniques for embedded event processing are provided. In some examples, instructions for executing at least a subset of complex event processing features may be received. A stream of events received by the edge computing device may be identified. Additionally, the events of the stream utilizing the subset of complex event processing features may be processed. Further, in some aspects, the processed events may be provided to a complex event platform of a server.

An event processing system that can perform processing corresponding to event messages certainly, and improve efficiency of processing event messages.To that end, the event processing system of the present invention holds event messages, which are received owing to state transitions of an IT service system, in an event message holding unit in order of issue. Among the event messages held in the event message holding unit, the event processing system searches for an event message for which a state of the IT service system after issue of the event message in question coincides with a state of the IT service system before issue of the oldest event message in the event message holding unit. When the event processing system can retrieve the event message in question, the event processing system deletes event messages ranging from the oldest event message to the retrieved event message from the event message holding unit.

A novel and useful mechanism enabling a standard learning algorithm to generate rules for complex event processing (CEP) systems. The method creates rules that infer previously defined output events by creating input event feature vectors for each targeted output event. In addition, a method for automatically generating CEP system rules to infer output events which are anomalies (i.e. statistical outliers) of input event sequences is disclosed. Input feature vectors consisting of multiple input events and parameters for each targeted output event are then input into a standard learning algorithm to generate CEP system rules.