Event Processing on the Web

Conceptual Overview, Current Trends and Technologies, and Challenges

Srdjan Komazec

www.sti-innsbruck.at Copyright 2011 STI INNSBRUCK www.sti-innsbruck.at

Outline

Motivation Technical solutions Possible extensions Conclusions References

www.sti-innsbruck.at

Are we there yet?

Motivation
www.sti-innsbruck.at 3

Motivation
A prediction

By 2015 2015, wirelessly networked sensors in everything we own will form a new Web. But it will only be of value if the terabyte torrent of data it generates can be collected, analyzed and interpreted.*

Mark Raskino, Jackie Fenn, and Alexander Linden. Extracting Value From the Massively Connected World of 2015. Gartner Research, 1 April 2005. http://www.gartner.com/resources/125900/125949/extracting_valu.pdf
www.sti-innsbruck.at 4

Motivation
A prediction

Are we there yet?

www.sti-innsbruck.at

Motivation
Semantic Sensor Web

Semantic Sensor Web*

Collecting and processing avalanches of data about the world around us while relying on the semantic technology to increase interoperability and provide contextual information for situational knowledge.

Amit Sheth, Cory Henson, Satya S. Sahoo, "Semantic Sensor Web," IEEE Internet Computing, pp. 78-83, July/August, 2008
6

www.sti-innsbruck.at

Motivation
Semantic Sensor Web

Linked Sensor Data*

Hurricane and blizzard observations in the United States. Department D t t of f Meterology M t l at t the th University U i it of f Utah. Ut h Measurements of phenomena such as temperature, visibility, precipitation, pressure, wind speed, humidity, etc.

sens-obs:Observation_WindSpeed_3CLO3_2005_10_16_9_35_00 a weather:WindObservation ; om-owl:observedProperty weather:_WindSpeed ; om-owl:procedure sens-obs:System_3CLO3 ; om-owl:result sens-obs:MeasureData_WindSpeed_3CLO3_2005_10_16_9_35_00 ; om-owl:samplingTime sens-obs:Instant_2005_10_16_9_35_00 . sens-obs:MeasureData_WindSpeed_3CLO3_2005_10_16_9_35_00 a om-owl:MeasureData ; om-owl:floatValue "17.0"^^xsd:float ; om-owl:uom weather:milesPerHour . sens-obs:Instant_2005_10_16_9_35_00 a owl-time:inXSDDateTime

owl-time:Instant ; "16-10-2005T09:35:00^^http://www.w3.org/2001/XMLSchema#dateTime".

A sample data from hurricane Wilma readings (October 2005)

Harshal Patni, Cory Henson, and Amit Sheth. Linked Sensor Data. In Proceedings of 2010 International Symposium on Collaborative Technologies and Systems (CTS 2010), Chicago, IL, May 17-21, 2010.
www.sti-innsbruck.at 7

Motivation
Internet of Things

Internet of Things
Refers to the networked interconnection of everyday objects*. If everything in our daily life could be just identified situations like lost parcels, theft, running out of stock, etc. would be things of past.

As simple idea but difficult to achieve

Its a non-deterministic, event-driven, bottom-up and open network with self-organizing entities. Meaning of an event depends on a context of the event itself.
Makes it necessary for the Internet of Things to be also a Semantic Web**

*Conner, C

M Margery (M (May 27, 27 2010). 2010) Sensors S empower the th "Internet "I t t of f Things" Thi ". pp. 3238. 32 38 ISSN 0012-7515 0012 7515

**http://www.i-o-t.org/post/3questionstoPhilippeGAUTIERbyDavidFayon

www.sti-innsbruck.at

Motivation
Internet of Things

Central Nervous System for the Earth (HP Labs initiative) A research and development program to build a planetwide sensing network, using billions of "tiny, cheap, tough and exquisitely sensitive detectors detectors. Sensors detect vibrations, motion, light, temperature, barometric pressure airflow and humidity pressure, humidity. Possible use-cases*:

*

Warning W i about b t structural t t l strains t i or weather th conditions, diti Monitor traffic, weather and road conditions, Tracking hospital equipment, Sniffing g out pesticides and pathogens g in food, etc.

http://www.hpl.hp.com/news/2009/oct-dec/cense.html

www.sti-innsbruck.at

Motivation
Other examples

Social networking feeds

Average user creates 90 pieces of content each month** Micro blogging site Twitter is seeing 90 million tweets per day*
Twitter is planning to add structured annotations to a tweet ***
"Just saw Avatar and it was amazing "annotations: [ { 'movie': { title:'Avatar', 'url':'http://www.rottentomatoes.com/m/avatar/', 'image':' image : ...', 'text': 'Avatar } } ]
*

Twitter's T itt ' co-founder f d E Ev Williams Willi on S September t b 14th 14th, 2010 2010, htt http://techcrunch.com/2010/09/14/twitter-event //t h h /2010/09/14/t itt t th Facebook statistics, Retrieved on March 7 , 2011 at http://www.facebook.com/press/info.php?statistics *** Twitter Annotations Overview, http://dev.twitter.com/pages/annotations_overview
**
www.sti-innsbruck.at 10

And so what?

Motivation
www.sti-innsbruck.at 11

Motivation
The join points between the examples

Data is delivered in the form of stream A stream is a sequence of data of undetermined length*.

Inner data structures are exhibiting dimensional characteristics of the notion of event
Temporal dimension (creation data stamp), Geospatial dimension (coordinates where the data is created), Informational dimension (payload), etc.

Event processing stands for a set of techniques, techniques languages and tools to collect, analyze and interpret event streams.

http://www.cafeaulait.org/course/week10/02.html
12

www.sti-innsbruck.at

Motivation
Event Processing Market Players (March 4th, 2011)

The CEP Market in 2011. Retrieved from http://tibcoblogs.com/cep/2011/03/04/the-cep-market-in-2011 on March 7th, 2011
www.sti-innsbruck.at 13

Motivation
Reported Customers of Event Processing Solutions

Retreived from http://www.slideshare.net/swadpasc/semantic-complex-event-processing-at-sem-tech-2010 on July 30th, 2010

www.sti-innsbruck.at 14

Motivation
Current Event Processing Approaches

Automated event processing has been applied so far in many areas:

Medical monitoring, luggage management, personal banking system alerts, fraud detection, emergency control systems, online-trading systems, road-tolling systems, etc

Reasons of using event processing are:

Real-time operational behavior, Observation capabilities, Immediate information dissemination, Active diagnostics, Predictive processing, Analytics, y , Different paradigm for solving problems
Instead of designing and crafting an information system to accommodate every possible domain-specific usage scenario, the system composed out of intelligent objects should govern itself towards achieving local and global goals.

www.sti-innsbruck.at

15

Motivation
Event processing on the Web

Some of the problems regarding Event Processing on the Web:

Proper P t t treatment t of f the th notion ti of f time ti and d time ti dependent d d t event t relations l ti
Can we expect synchronous time across the globe? An event interpretation depends on the context in which the event has been produced. Context must be conveyed together with the event. IoT-based solutions may be segregated. Heterogeneity between the solutions may hinder the possibility to integrate different events. Reconciliation of event heterogeneities is necessary. How can we apply event processing techniques over RDF streams? Identifying event dimensions in raw data streams Stream of events may be enormous (sensor readings, social networking activities, etc). Activities such as publishing, searching, detecting, transforming, filtering and consuming usable and significant events must be automatized.

Context-based event interpretation

Events interoperability

Bridging the gap between event and stream processing

Scalable event lifecycle

www.sti-innsbruck.at

16

Motivation

Event Processing on the Web must rely on the Semantic Web in order to achieve its full potential potential.

www.sti-innsbruck.at

17

Technical Solution

www.sti-innsbruck.at

18

Technical Solution
Outline

Basic Concepts
The notion of event, event processing, and event processing networks

Event Processing on the Semantic Web

Brief B i f overview i of f th the current t approaches h Event-driven Transaction Logic Inference System (ETALIS)

www.sti-innsbruck.at

19

Basic Concepts *

Technical Solution S
* Opher

Etzion and Peter Niblett. Event Processing in Action. Manning Publications Co., 2010
20

www.sti-innsbruck.at

Technical Solution
Basic Concepts What is an event?

What is an event?
* An event is anything y g that happens. pp An event is an occurrence within a particular system or domain; it is something that has happened, or is contemplated as having happened in that domain. **

Side effects of the definition:

The system in which event occurred may be any system external to observer. An event needs not to correspond p to actual occurrences.

Examples of events:
Temperature sensor readings, airplane landing, Twitter updates, etc.

* K.

Many Chandy, W. Roy Schulte. Event Processing: Designing IT Systems for Agile Companies, McGraw-Hill Osborne Media, 2009 Etzion and Peter Niblett. Event Processing in Action. Manning Publications Co., 2010
21

** Opher

www.sti-innsbruck.at

Technical Solution
Basic Concepts What are event dimensions?

Different facets of an event*

* Ramesh

Jain, "EventWeb: Developing a Human-Centered Computing System," Computer, pp. 42-50, February, 2008
22

www.sti-innsbruck.at

Technical Solution
Basic Concepts Event Type

An event type is a specification for a set of event objects that have the same semantic intent and same structure *.

* Opher

Etzion and Peter Niblett. Event Processing in Action. Manning Publications Co., 2010
23

www.sti-innsbruck.at

Technical Solution
Basic Concepts Event Processing

What is Event Processing?

Event processing consists in processing many events happening across all the layers of an organization, identifying the most meaningful events within the event cloud, analyzing their impact, and taking subsequent action in real time.* Operations that you can perform on events, in particular operations that take a set of one or more events as input and generate further events from them as output. **

* http://en.wikipedia.org/wiki/Complex_event_processing ** Opher

Etzion and Peter Niblett. Event Processing in Action. Manning Publications Co., 2010
24

www.sti-innsbruck.at

Technical Solution
Basic Concepts Elements in the event processing environment

Event Producer Event Consumer Event Channel

An event channel is a processing element that receives events from one or more source processing elements, makes routing decisions, and sends the input events unchanged to one or more target processing elements in accordance to the decisions*. Usage of stateful data may be needed in event processing:
Historical event logs used for later processing, retraction, etc. Reference data used for enrichment, State of external entities (e.g., workflow state), Global variables (enabling non-event-based communication inside of the network)
Channel

Global State

Context
A context is a named specification of conditions that groups together event instances for the purpose of processing them together.

* Opher

Etzion and Peter Niblett. Event Processing in Action. Manning Publications Co., 2010
25

www.sti-innsbruck.at

Technical Solution
Basic Concepts Event Processing Agent (EPA)

What is Event Processing Agent ?

An Event Processing Agent (EPA) is a software module which processes events.

According to the targeted functionality EPA may be classified as follows:

www.sti-innsbruck.at

26

Technical Solution
Basic Concepts Event Processing Network

What is Event Processing Network?

An Event Processing Network is a collection of event producers producers, consumers consumers, event processing agents and global states which are connected by a collection of channels*. The definition is abstract and platform independent (at the level of Platform Independent Model - PIM).

* Opher

Etzion and Peter Niblett. Event Processing in Action. Manning Publications Co., 2010
27

www.sti-innsbruck.at

Technical Solution
Basic Concepts Detecting Event Patterns

A Pattern is a function that takes a collection of input event instances and produces a matching set that consists of zero or more of those input events*. Event pattern categories and types
Basic B i event t patterns tt
Logical Operator Patterns (all, any, absence). Threshold Patterns (count, value max, value min, value average). Relative Patterns (relative max, relative min). M d lP Modal Patterns tt (always, ( l sometimes). ti ) Temporal Patterns (sequence, increasing, decreasing, non increasing, non decreasing, stable). Spatial Patterns (min distance, distance max distance, distance average distance distance, relative min min, relative max, max relative average). Spatiotemporal Patterns (moving in constant direction, stationary, moving towards).

Dimensional patterns

* Opher

Patterns can be composed into more complex patterns in EPN EPN.

Etzion and Peter Niblett. Event Processing in Action. Manning Publications Co., 2010
28

www.sti-innsbruck.at

Technical Solution
Basic Concepts - Languages

Survey * of the current solutions reveals the following styles:

Stream-oriented style
Languages used to describe queries are based on SQL and relational algebra Streams of events are broken into the windows (temporal context) upon which queries are performed Example languages are SPADE, Aleri, CQL, but also C-SPARQL.

R l Rule-oriented i t d style t l
Production rules
IF condition THEN action (forward chaining). Rooted in expert systems. Event-Condition-Action (ECA) rules. Rooted in Active Databases. Example is Rulecore. Based on logic assertions. Rooted in the deductive databases. Example is ETALIS.

Active rules

Logic programming rules

Imperative style
Logic is coded in C or Java.

* Opher

Etzion and Peter Niblett. Event Processing in Action. Manning Publications Co., 2010
29

www.sti-innsbruck.at

Event Processing on the Semantic Web

Technical Solution
www.sti-innsbruck.at 30

Technical Solution
Event Processing on the Semantic Web - Related Work

Event-Condition-Action Rules on the Semantic Web

Xcerpt and XChange (University of Munich)
Xcerpt provides the possibility to query any kind of XML data while XChange enables propagation of changes on the Web and event-based communication between Web nodes. Event processing is defined in terms of rules. XChange provides composite event queries supporting temporal ranges and event compositions. Recent work is laying down formal foundation for event queries and rules.

Event-driven E tdi T Transaction ti L Logic i I Inference f S Systems t (ETALIS) (FZI Karlsruhe) K l h )

ETALIS is a logic-based complex event processing engine. Relies on the decomposition of composite event specifications into intermediate patterns which are asserted by declarative rules and executed in the backward-chaining fashion.

ECA-LP and ECA-RuleML (Technical University of Munich)

Unifies derivation rules, reaction rules and other rule types into a framework grounded in Logic Programming. Supports general updates on the knowledge base and transactions transactions.

www.sti-innsbruck.at

31

Technical Solution
Event Processing on the Semantic Web
Related Work

Event-Condition-Action Rules on the Semantic Web (contd)

RDF-based Event-Condition-Action Language (RDFTL) (University of London)
RDFTL is an ECA rule language operating over RDF graphs which provides reactive behavior over RDF data stored in RDF repositories. Uses path-based query sublanguage in order to select targeted part of RDF graph. Path-based queries are used in RDFTL ECA to construct resources, insert/delete arcs, etc.

Modular Active Rules for the Semantic Web (MARS) (Gttingen University)
Web as an active infrastructure of autonomous systems with the primary focus on reactivity and d evolution. l ti Defines ECA rule ontology as a joining point for different event, condition and action languages. Extends behavior of an OWL node with the ECA-based reactive behavior.

C-SPARQL (Politecnico di Milano)

Combines data streams and background knowledge with reasoning to develop the Stream Reasoning vision which intertwines four steps of the LarkC pluggable framework. C-SPARQL C SPARQL is a extension with notions of RDF streams, timing windows, handling of multiple streams and aggregated functions.

www.sti-innsbruck.at

32

Event Processing on the Semantic Web

Technical Solution ETALIS *

and examples are taken from Darko Anicic, Sebastian Rudolph, Paul Fodor, Nenad Stojanovic. Stream Reasoning and Complex Event Processing in ETALIS. Under review at journal Semantic Web Interoperability, Usability, Applicability (ISSN: 1570-0844).
www.sti-innsbruck.at 33

* Figures

Technical Solution
ETALIS Introduction

ETALIS features
Effective detection of complex events over streaming data Evaluation of background knowledge on-the-fly Reasoning about semantic relationships among events

ETALIS follows a completely deductive rule-based paradigm

Inclusion of background knowledge is straightforward

www.sti-innsbruck.at

34

Technical Solution
ETALIS Conceptual Architecture

www.sti-innsbruck.at

35

Technical Solution
ETALIS ETALIS Language for Events (ELE)

A rule-based language to construct complex event patters

Emphasis is on temporal composition operators

www.sti-innsbruck.at

36

Technical Solution
ETALIS ETALIS Language for Events (ELE) Example

Background knowledge

trafficEvent() trafficEvent() trafficEvent() trafficEvent() trafficEvent() trafficEvent() trafficEvent() trafficEvent() trafficEvent() Event detection rule

bottleneckArea(a) bottleneckArea(b)

www.sti-innsbruck.at

37

Technical Solution
ETALIS Internal processing

Event Driven Backward Chaining (EDBC) rules

Executable rules (written in Prolog)

Event-driven rules
A rule is evaluated when an event matching the rules head occurs. A firing rule inserts a goal into the memory. Goal denotes (partial) happening of an event it shows the current state of p progress g towards matching g an event pattern.

The process of splitting complex rules l i into t th the bi binary rules l i is called binarization.
38

www.sti-innsbruck.at

Technical Solution
ETALIS Stream Reasoning with EP-SPARQL

Specifying complex event patterns and consuming streams and background knowledge represented as RDF Event processing SPARQL (EP-SPARQL)
Extends SPARQL with
Binary operators SEQ, EQUALS, OPTIONALSEQ and EQUALSOPTIONAL.
The operators are acting as joins depending on how the constituents are temporally interrelated

Functions getDURATION(), getSTARTTIME(), getENDTIME()

ETALIS implements a reasoning procedure to support subclass inference

www.sti-innsbruck.at

39

Technical Solution
ETALIS Stream Reasoning with EP-SPARQL - Example

Background knowledge

?road =

Event detection rule

www.sti-innsbruck.at

40

What am I doing now for my PhD?

Possible extensions
www.sti-innsbruck.at 41

Problems
Event Processing on the Web

Some of the problems regarding Event Processing on the Web:

Proper P t t treatment t of f the th notion ti of f time ti and d time ti dependent d d t event t relations l ti
Can we expect synchronous time across the globe? An event interpretation depends on the context in which the event has been produced. Context must be conveyed together with the event. IoT-based solutions may be segregated. Heterogeneity between the solutions may hinder the possibility to integrate different events. Reconciliation of event heterogeneities is necessary. How can we apply event processing techniques over RDF streams? Identifying event dimensions in raw data streams Stream of events may be enormous (sensor readings, social networking activities, etc). Activities such as publishing, searching, detecting, transforming, filtering and consuming usable and significant events must be automatized.

Context-based event interpretation

Events interoperability

Bridging the gap between event and stream processing

Scalable event lifecycle

www.sti-innsbruck.at

42

Proposed Solution
Semantically Enhanced Event Processing Networks (SEPN)

/* SEPN Agent functionality declaration */ SEPADecl ::= PrefixDecl* InTerDecl OutTerDecl FilterDecl? MatcherDecl? DeriverDecl? /* Input and output terminals declaration */ InTerDecl ::= 'INPUT TERMINAL' (Term_Id Event_Type_Id)+ OutTerDecl ::= 'OUTPUT TERMINAL' (Term_Id Event_Type_Id)+ /* Filter function declaration */ FilterDecl ::= 'FILTER' Input_Term* Output_Term? Filter_Expr+ Filter_Expr ::= WhereClause /* Matcher function declaration */ MatcherDecl ::= 'MATCHER' Input_Term* Output_Term? Matcher_Expr Matcher_Expr ::= WhereClause /* Deriver function declaration */ DeriverDecl ::= 'DERIVER' Input_Term* Output_Term Gl_State_Id? Deriver_Expr Gl_State_Id ::= 'GLOBAL STATE' IRI_REF Deriver_Expr ::= 'DERIVE' ConstructTriples 'FROM' WhereClause Input p _Term ::= 'INPUT' Term_Id Output_Term ::= 'OUTPUT' Term_Id Term_Id ::= IRI_REF Event_Type_Id ::= IRI_REF IRI_REF ::= '<' ([^<>"{}|^`\]-[#x00-#x20])* '>'
43

Srdjan Komazec and Davide Cerri. Enhancing Event Processing Networks with Semantics to Enable SelfManaged SEE Federations. 3rd International Workshop on Monitoring, Adaptation and Beyond (MONA+) colocated with collocated with ECOWS, Ayia Napa, Cyprus, 2010.
www.sti-innsbruck.at

Proposed Solution
Graph Pattern Detection

Rete Algorithm
Pattern matching algorithm for implementing production rule systems. Designed g by y Dr Charles L. Forgy gy of Carnegie g Mellon University y( (1974). ) The basis for many popular expert system shells, including CLIPS, Jess, Drools, BizTalk, Rules Engine and Soar.

www.sti-innsbruck.at

44

Proposed Solution
Graph Pattern Detection An Example

@prefix @prefix @prefix p @prefix ?x ?x ?x ?y ?y ?z ?z

weather: rdf: sensor: time:

<http://knoesis.wright.edu/ssw/ont/weather.owl#> . <http://www.w3.org/1999/02/22-rdf-syntax-ns#> . <http://knoesis.wright.edu/ssw/ont/sensor-observation.owl#> p g . <http://www.w3.org/2006/time#>. weather:WindObservation . ?y . ?z . sensor:MeasureData . ?floatValue . time:Instant . ?instant .

rdf:type sensor:result sensor:samplingTime rdf:type sensor:floatValue rdf:type time:inXSDDateTime

rdf:type = weather:WindObservation

? ?x
sensor:result sensor:samplingTime

rdf:type = sensor:MeasureData

?y

rdf:type = time:Instant

?z

sensor:floatValue

time:inXSDDateTime

?floatValue

?instant

www.sti-innsbruck.at

45

Proposed Solution
Graph Pattern Detection Alpha and Beta Memory Structures

ALPHA MEMORY

RootNode JoinNode

BETA MEMORY

PREDICATE rdf:type

OBJECT weather:Wind Observation

AlphaNode

BetaNode JoinNode

PREDICATE sensor:result PREDICATE sensor:samplin gTime PREDICATE rdf:type PREDICATE sensor:floatVal ue PREDICATE rdf:type PREDICATE time:inXSDTim eData OBJECT time:instant OBJECT sensor:Measur eData

AlphaNode

BetaNode JoinNode BetaNode

AlphaNode

RootNode

AlphaNode

JoinNode BetaNode

Detection Node

AlphaNode JoinNode AlphaNode BetaNode JoinNode AlphaNode B t N Beta Node d JoinNode

www.sti-innsbruck.at

46

Further extensions

Graph pattern detection extensions

Introduction of RDFS entailment rules
Rewriting of the graph patterns Testing g the absence of items in a working g memory y Introduction of negation nodes in the form of negation-as-failure Avoiding GC pauses during which the knowledge base (KB) grows

Negated conditions

Garbage collection (GC) Support for timing windows

Comprehensive event pattern specification

Support for all event pattern categories and types Bridging the gap between raw data streams and event streams Optimization which exploits characteristics of RDF

www.sti-innsbruck.at

47

Conclusions

www.sti-innsbruck.at

48

Conclusions

Event processing represents a particular paradigm in the field of data stream processing where the streamed data exhibits specific structural dimensionality - temporal, geo-spatial, causal, etc. Event processing systems are composed out of a set elements exhibiting different behavior (produces, consumers, agents, channels, global states and contexts). Semantic Web technologies are becoming a requirement when it comes to Event processing on the Web. Semantic Web technologies tend to provide a fruitful foundation to address the challenges of Event processing on the Web.

www.sti-innsbruck.at

49

References

www.sti-innsbruck.at

50

References

Books
David Luckham. Luckham The Power of Events: An Introduction to Complex Event Processing in Distributed Enterprise Systems. Addison-Wesley, 2002 Opher Etzion and Peter Niblett. Event Processing in Action. Manning Publications Co., 2010

Blogs
Complex Event Processing: Applications, products, research, and developments in event processing by David Luckham @ http://www.complexevents.com Complex Event Processing (CEP) Blog by TIBCO @ http://tibcoblogs.com/cep Event Processing Thinking by Opher Etzion @ http://epthinking.blogspot.com http://epthinking blogspot com

Technical Societies
Event Processing Technical Society http://www.ep-ts.com

Major annual events

ACM International Conference on Distributed Event-Based Systems International Web Rule Symposium

www.sti-innsbruck.at

51

References

Wikipedia links
Complex event processing Event-driven architecture Pattern matching Internet of Things g http://en.wikipedia.org/wiki/Complex_event_processing http://en.wikipedia.org/wiki/Event-driven_architecture http://en.wikipedia.org/wiki/Pattern_matching http://en.wikipedia.org/wiki/Internet_of_Things p p g _ _ g

www.sti-innsbruck.at

52

Questions?

www.sti-innsbruck.at

53