A Framework for Event Composition in Distributed Systems

Abstract

Abstract. For large-scale distributed applications such as internet-wide or ubiquitous systems, event-based communication is an effective messaging mechanism between components. In order to handle the large volume of events in such systems, composite event detection enables application components to express interest in the occurrence of complex patterns of events. In this paper, we introduce a general composite event detection framework that can be added on top of existing middleware architectures -as demonstrated in our implementation over JMS. We argue that the framework is flexible, expressive, and easy to implement. Based on finite state automata extended with a rich time model and support for parameterisation, it provides a decomposable core language for composite event specification, so that composite event detection can be distributed throughout the system. We discuss the issues associated with automatic distribution of composite event expressions. Finally, tests of our composite event system over JMS show reduced bandwidth consumption and a low notification delay for composite events.

Privacy-preserving event detection in pervasive spaces

“…We restrict composite events to those that can be expressed as regular expressions over primitive events. Regular expressions, while limited in expressibility, have been deemed to be sufficiently powerful for a large class of pattern and event detection systems [22], [6]. Composite Event Detection Composite events are translated into their corresponding finite state automata (FSA) referred to as an event automaton.…”

“…The IBM S3 smart surveillance system [13] offers event-based retrieval in order to manage surveillance data. The Cayuga system and accompanying language, CESAR [6] proposed an event stream language and detection system that uses finite state automata to realize the detection of complex events for publish/subscribe applications [22]. An event-based approach offers a general framework using which a wide variety of pervasive applications can be built.…”

FAIDECS: Fair Decentralized Event Correlation

“…Event correlation [8] enables higherlevel reasoning about interactions by supporting the assembly of composite events from elementary events [20,19]. Traditional uses of correlation include intrusion detection [17]; network monitoring [16] enables the improvement of resource usage, e.g., in data centers.…”

Policy-Controlled Event Management for Distributed Intrusion Detection

“…However, each stage can generate events. Therefore, detection accuracy benefits from combining such patterns into semantically more high-level composite events [12]. In general, composite events consist of a set of input events, a number of conditions, and an output event which is triggered if the conditions are met.…”

“…We are investigating the use of more high-level language elements to ease this task; we envision a language model similar to the one used in [12] but based on Petri nets.…”