Handling Complex Events

Among thousands of incoming events, a surveillance system can, for example, get the following three from the same source:

1. the bells of the church ring.
2. the appearance of a man in a tuxedo with a woman in a white dress.
3. rice is thrown into the air.

For these events, the surveillance system can output a “complex event”: a wedding. CEP technology helps detect complex events by analyzing and correlating other events: ^[1] bells, men and women in wedding attire, and rice tossed into the air.

CEP is based on a number of technologies, ^[2] including:

• event pattern detection;
• abstraction of events;
• modeling the hierarchy of events;
• determining relationships (such as causality, membership, or temporal dependence) between events;
• abstractions of event driven processes.

CEP commercial applications include algorithmic trading , money laundering , payment card fraud , business activity monitoring, and security monitoring . ^[3]

CEP is primarily used in business process management (BPM) and related areas.

In computer network management , system management, application lifecycle management, and service management, event correlation is usually referred to. In the CEP architecture, event correlation tools (event correlators ) analyze a mass of events, determine the most important of them, and initiate actions. However, most of them do not display new events. Instead, they relate high-level events to low-level events. ^[four]

In artificial intelligence , the output is usually generated by an output engine , such as a rule-based system . However, new information is usually not produced in the form of complex (output) events.

A more rigorous example of the use of CEP includes a car, several sensors, and various events and reactions to them. Imagine that a car has several sensors: one for measuring tire pressure, another for measuring speed, and a third that determines whether someone is sitting on the seat or has left it.

In the first case, the car moves and the pressure in one of the tires decreases from 45 to 41 psi within 15 minutes. As the tire pressure drops, a series of events are generated that reflect the tire pressure. In addition, a series of events containing vehicle speed are generated. A car’s event processor can detect a situation in which a loss of pressure in a tire over a relatively long period of time leads to the creation of a “lossOfTirePressure” event. This new event may trigger a reaction process, noting a loss of pressure in the vehicle’s service log, as well as warning the driver using the car’s computer that the tire pressure has decreased.

In the second situation, the car moves and the pressure of one of the tires drops from 45 to 20 psi in 5 seconds. A different situation is being discovered - perhaps because the pressure loss occurred over a short period of time, or perhaps because the difference in values ​​between each event was greater than the predetermined limit. A different situation triggers the generation of a new blowOutTire event. This new event triggers a different reaction process that immediately alerts the driver and initiates the on-board computer procedures that help the driver slow down the car to a full stop without losing control of it when skidding.

In addition, events that represent detected situations can be combined with other events to identify more complex situations. For example, in the latter situation, the car moved normally, but a tire break occurred, as a result of which the car flew out of the road and hit a tree and the driver was thrown out of the car. A series of different situations is quickly discovered. The combination of “blowOutTire”, “zeroSpeed” and “driverLeftSeat” in a very short period of time leads to the discovery of a new situation: “occupantThrownAccident”. Even though there are no direct measurements that can definitively determine what the driver threw away or that an accident occurred, a combination of events allows you to detect a situation and create a new event to indicate the detected situation. This is the essence of a complex (or composite) event. It is complex because it is impossible to directly detect the situation; we must conclude that the situation arose from a combination of other events.

Most CEP implementations and concepts can be classified in two categories:

1. Computing Oriented CEP
2. Discovery oriented ceps

A computationally oriented CEP implementation focuses on the online execution of algorithms in response to event data included in the system. A simple example is the continuous calculation of the average based on data from incoming events.

The discovery-oriented CEP is focused on detecting combinations of events called event patterns or situations. A simple example of determining a situation is to search for a specific sequence of events.

Of course, the application of new technology rarely exists in isolation. It is natural to introduce CEP into business process management ^[5] . Business process management is strongly focused on the final business processes with the goal of continuous optimization and adjustment to the operational environment.

However, business optimization is not based solely on its individual, final processes. Often disparate, it seems, processes can significantly affect each other. Consider this scenario: in the aerospace industry, it’s good practice to monitor vehicle accidents to look for trends (to identify potential weak points in production processes, materials, etc.). Another separate process monitors the current cycle of vehicles and writes them off at the end of the term if necessary. beneficial use. When using CEP, it is necessary to link these separate processes, and in the case when the initial process (monitoring of breakdowns) detects a malfunction based on metal fatigue (a significant event), an action using the second process (life cycle) can be created to recall vehicles that use metal of the same batch in which the first process detected malfunctions.

Integration of CEP and business process management can be carried out at two levels, both at the level of business awareness (users must understand the potential holistic benefits of their individual processes) and at the technological level (there must be a method by which CEP can interact with the implementation of business management process).

The role of computing-centric CEP is overlapped by technology business rules.

• Event-Oriented Architecture - (EDA) software architecture template that promotes the creation, discovery, consumption, and response to events.
• Event Stream Processing - (ESP) is a close technology that focuses on processing streams of related data.

• K. Mani Chandy, W. Roy Schulte. Event Processing: Designing IT Systems for Agile Companies. - McGraw-Hill, 2009 .-- 251 p. - ISBN 978-0-07-163349-9 .
• Martin Atzmueller, Samia Oussena, Thomas Roth-Berghofer. Enterprise Big Data Engineering, Analytics, and Management. - IGI Global, 2016 .-- 272 p. - ISBN 978-1-5225-0293-7 .
• David C. Luckham. Event Processing for Business: Organizing the Real-Time Enterprise. - John Wiley & Sons, 2011 .-- 288 p. - ISBN 0-470534-85-0 .