Stephane Kasriel

Event Mining with Event Processing Networks

Event Mining discovers information in a stream of data, or events, and delivers knowledge in real-time. Our event processing engine consists of a network of event processing agents (EPAs) running in parallel that interact using a dedicated event processing infrastructure. EPAs can be configured at run-time using a formal pattern language. The underlying infrastructure provides an abstract communication mechanism and thus allows dynamic reconfiguration of the communication topology between agents at run-time and provides transparent, location-independent access to all data. These features support dynamic allocation of EPAs to machines in a local area network at run time.

Enlisting event patterns for cyber battlefield awareness

Cyber warfare consists to a large degree of reaction to activities happening in the information infrastructure. Better knowledge of the status of this infrastructure at any time allows more appropriate reactions. Context-based event correlation can provide a more appropriate view of the cyber battlefield by providing users a view on the desired level of abstraction. We informally introduce context as the temporal and causal relations between events. Event correlation based on event patterns in a declarative language means we specify what to detect, instead of how to detect. We describe the Stanford University context-based event correlator that is able to process events on-line, as they are generated. It can be reconfigured dynamically while it is running. On the example of intrusion detection, we show how Complex Event Processing (CEP) increases detection rate, reduce false alarms, and detect large-scale attack patterns at an early stage.