Designing Intelligent Event Processor (IEP) Projects

Intelligent Event Processor Overview

The Intelligent Event Processor (IEP) enables you to perform complex event processing (CEP) and event stream processing (ESP) from within an enterprise service bus.

Complex Event Processing and Event Stream Processing

In the most general sense, the term event refers to anything that happens in a system. For example:

A password change
A stock purchase
A transfer of funds

You use IEP to process computerized representations of these events.

These events are generated and sent out by applications. The applications can be located within the enterprise service bus, or they can come from an external system that is connected to the enterprise service bus.

The term event stream refers to a continuous set of events. For example, an event stream could contain the password changes made by the users of a web-based application.

Processing an event stream can involve many types of activities. For example:

You can examine a bounded portion of an event stream, such as all of the events that occurred in the last two minutes. This bounded portion is called a window.
You can apply a function to a set of events. For example, you can determine the average price of a stock during the last three hours, with the calculation updated every five minutes.
You can change the order of the events.

When you combine multiple events to create a higher level event, the result is called a complex event.

An architectural style in which software modules operate in response to the arrival of events is called event driven architecture.

Typical IEP Scenarios

The following table describes typical IEP scenarios.

Scenario	Example
Financial trade auditing and compliance	Examine a stream of stock transactions and find any transactions that are suspicious. Check whether any traders involved in a suspicious transaction also appear in a database table that contains the names of persons of interest.
Network monitoring and traffic engineering	Receive an undifferentiated stream of alerts from various hardware devices, group them by the device, and sort them by the unique ID. For each device, detect any missing alerts and request them to be re-sent.
IT security event correlation	Examine the password changes that have been made to a web-based application. If the number of password changes in a given hour is more than twice the average, then generate a security alert.
Asset management and tracking using RFID	Examine the RFID signals that are regularly emitted by all of the products in a store. Determine whether a product is moving through the exit area without having been purchased. Determine whether a product's RFID emitter is no longer working.

IEP Architecture

The following diagram illustrates the IEP architecture.

Diagram shows the IEP Service Engine in the JBI
environment.

Within the enterprise service bus, the IEP Service Engine can interact with any Java^TM Business Integration (JBI) service engine or binding component that is also plugged into the bus. The Normalized Message Router takes care of message exchanges between the components.

By default, the IEP Service Engine receives input events from the HTTP Binding Component and sends output to the File Binding Component. The IEP Service Engine uses a database to maintain information about deployed event processors.

IEP Design-Time and Runtime Components

IEP consists of a design-time component and a runtime component.

The design-time component is integrated within the NetBeans IDE.
The runtime component is implemented as a JBI service engine.

In the NetBeans IDE, you create an IEP Module project and then add one or more event processors.

For each event processor, you drag operators from the palette onto the design canvas. In the palette, the operators are grouped into the following categories: Aggregator, Correlation and Filter, Input, Output, Relation Converter, Relation, Sequence, and Stream Converter.

An event processor must have at least one input operator and one output operator. You can add any number of operators between the input operator and the output operator.

On the design canvas, you connect the operators with each other and use property editors to configure the operators.

The following screen capture shows a set of operators in an event processor. The operator at the left is an input operator. The operator at the right is an output operator.

Screen capture of IEP operators combined with
each other in the Design view.

Some operators allow you to enter SQL-like statements. For these operators, knowledge of the SQL SELECT statement can be useful.

When you save an IEP Module project, IEP generates a Web Services Description Language (WSDL) document for each event processor. The WSDL documents contain the endpoints for the event processors.

You can run a set of predefined validation rules on an event processor at design time.

To deploy an IEP Module project, you must create and build a Composite Application project. These tasks create a service assembly. The service assembly is a collection of service units intended for the IEP Service Engine and any other required JBI component (such as the HTTP Binding Component and the File Binding Component).

When the project is deployed, the IEP Service Engine receives and processes the input events.