Model-aware Monitoring of SOAs for Compliance

Abstract

Business processes today are supported by process-driven service oriented architectures. Due to the increasing importance of compliance of an organization with regulatory requirements and internal policies, there is a need for appropriate techniques to monitor organizational information systems as they execute business processes. Event-based monitoring of processes is one of the ways to provide runtime process-state information. This type of monitoring, however, has limitations mostly related to the type and amount of information available in events and process engines. We propose a novel approach -model-aware monitoring of business processes -to address these limitations. Emitted events contain unique identifiers of models that can be retrieved dynamically during runtime from a model-aware repository and service environment (MORSE). The size of the events is kept small and patterns of events that signify interesting occurrences are identified through complex event processing and are signaled to interesting components such as a business intelligence. To illustrate our approach we present an industry case study where we have applied this generic infrastructure for the compliance monitoring of business processes.

On the Understandability of Temporal Properties Formalized in Linear Temporal Logic, Property Specification Patterns and Event Processing Language

“…Numerous studies make use of EPL (cf. Awad et al [27], Holmes et al [28], Boubeta-Puig et al [29], Kunz et al [30], Adam et al [31], Aniello et al [32], to name but a few). EPL is well-suited as a representative for CEP query languages as it supports common CEP query language concepts, such as leads-to (sequence, followed-by) and every (each) operators, that are present in many CEP query languages and engines (e.g., Siddhi 5 and TESLA [33]).…”

Modeling compliance specifications in linear temporal logic, event processing language and property specification patterns: a controlled experiment on understandability

“…Several existing studies on compliance monitoring make use of EPL (cf. Awad et al [2], Holmes et al [41] and Tran et al [82]). -Property specification patterns (PSP) are a collection of recurring temporal patterns proposed by Dwyer et al [27,28].…”

A comparison framework for runtime monitoring approaches

“…The motivation for applying the approach is an important element; it describes the users' benefits when using the approach. Our review revealed a wide range of reported benefits, such as detecting Service-Level Agreement (SLA) violations ( Contreras and Mahbub, 2014 ), detecting compliance issues in service-based systems ( Holmes et al, 2011 ), discovering performance leaks ( Ehlers and Hasselbring, 2011 ), detecting security problems ( Gunadi and Tiu, 2014 ), checking business process conformance ( Poppe et al, 2013 ), checking safety properties ( Kim et al, 2001 ), monitoring constraints on business processes ( Montali et al, 2014 ), checking program behavior ( Jeffery et al, 2004 ), detecting mismatches in service interactions ( Baouab et al, 2012 ), etc. FORMAN ( Jeffery et al, 2004) has recently also been extended to support system and software executable architecture modeling and is also the basis for a business process modeling framework called Monterey Phoenix ( Auguston et al, 2015 ).…”

“…The needed skills element refers to the capabilities that a user needs to possess to properly apply an approach and perform its monitoring tasks. Typically, the approaches we investigated require user skills in several areas including formal background (e.g., LTL, Event Calculus) (Contreras and Mahbub, 2014;Faymonville et al, 2014;Spanoudakis and Mahbub, 2004), experience with different domain-specific languages ( Holmes et al, 2011;Paschke, 2005;Aktug et al, 2008 ), the capability to specify rules ( Ehlers and Hasselbring, 2011) or queries ( Baouab et al, 2012 ), programming skills for writing probes ( Vierhauser et al, 2016b ), or modeling skills ( Ramirez and Cheng, 2011 ).…”

“…This could be a high-level programming language or a formal verification framework, hidden from the user through a constraint definition language. In the domain of service-based systems and business processes, Complex Event Processing (CEP) engines (Luckham, 2011) such as Drools Fusion and Esper are widely used (Holmes et al, 2011;Inzinger et al, 2013 ). However, there are also many custom-tailored mechanisms for evaluating rules and constraints ( Vierhauser et al, 2016b;Gunadi and Tiu, 2014;Jeffery et al, 2004;Faymonville et al, 2014 ).…”