JEPC: The Java Event Processing Connectivity

Hoßbach, Bastian; Glombiewski, Nikolaus; Morgen, Andreas; Ritter, Franz; Seeger, Bernhard

doi:10.1007/s13222-013-0133-y

Cited by 9 publications

(1 citation statement)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the ACCEPT-VM, we use a federation of heterogenous CEP engines based on Java Event Processing Connectivity (JEPC) [13] to exploit synergies between them with respect to functionality, expressiveness, and performance. A federation of four different CEP engines allows us to execute a query or part of a query in the CEP engine that is most suitable or performs best.…”

Section: Federated Cep Enginementioning

confidence: 99%

Complex event processing for reactive security monitoring in virtualized computer systems

Baumgärtner

Strack

Hoßbach

et al. 2015

Proceedings of the 9th ACM International Conference on Distributed Event-Based Systems

Self Cite

View full text Add to dashboard Cite

The number of security incidents in computer systems is steadily increasing, despite intrusion detection and prevention mechanisms deployed as countermeasures. Many existing intrusion detection and prevention systems struggle to keep up with new threats posed by zero-day attacks and/or have serious performance impacts through extensive monitoring, questioning their effectiveness in most real-life scenarios. In this paper, we present a new approach for reactive security monitoring in a virtualized computer environment based on minimally-intrusive dynamic sensors deployed vertically across virtualization layers and horizontally within a virtual machine instance. The sensor streams are analyzed using a novel federation of complex event processing engines and an optimized query index to maximize the performance of continuous queries, and the results of the analysis are used to trigger appropriate actions on different virtualization layers in response to detected security anomalies. Furthermore, a novel event store that supports fast event logging is utilized for offline analysis of collected historical data. Experiments show that the proposed system can execute tens of thousands of complex, stateful detection rules simultaneously and trigger actions efficiently and with low latency.

show abstract

Section: Federated Cep Enginementioning

confidence: 99%