Processing Patterns for PredictiveBusiness. TUCON 2006, Tim Bass, CISSP, Principal Global Architect, TIBCO Software Inc.

1. Processing Patterns for PredictiveBusiness TM Tim Bass, CISSP Principal Global Architect TIBCO Software Inc.

4. A Vocabulary of Confusion Resource Management Data Fusion Sensor Fusion Information Fusion Tracking Data Mining Correlation Planning Complex Event Processing Processing Management Sensor Management Control Estimation Event Stream Processing Adapted from: Steinberg, A., & Bowman, C., CRC Press, 2001 (Work in Progress)

5. US Legislation - Monitoring Requirements The Predictive Enterprise

6. PredictiveBusiness TM Source: Ranadiv é , V., The Power to Predict , 2006.

10. A Traditional Event-Driven Architecture HTTP request / response Structured messages Screen Audit events Message Audit events Screen/ message Audit events Fraud Detection Rules Queue Client/Server Channel Queue EMS Channel Queue Fraud Detection Rules Screen Based Channel Fraud Event? Sensor Preprocessing Service API Queue HTTP Channel Queue API Channel … 1234Joe01021970….. Fraud Event? Fraud Event? Fraud Event? Fraud Event? Structured messages Queue Unix/VT Channel Fraud Event? Fraud Detection Rules Fraud Detection Rules Fraud Detection Rules Fraud Detection Rules Fraud Detection Rules Network TAP

11. Emerging Event-Decision Architecture Customer Profiles Purpose-Built Analytics Distributed Multisensor Infrastructure Internet/Extranet Sensors Human Sensors Edge/POC Sensors Operations Center Other References Complex Event Processors Sensors are Everywhere!

13. Event-Inference Hierarchy 22 Impact Assessment Situational Assessment Relationship of Events Identify Events Location, Times and Rates of Events of Interest Existence of Possible Event of Interest Data/Event Cloud Analysis of Situation & Plans Contextual and Causal Analysis Causal Analysis, Bayesian Belief Networks, NNs, Correlation, State Estimation, Classification Use of Distributed Sensors for Estimations Raw Sensor Data (Passive and Active) Adapted from: Waltz, E. & Llinas, J., Multisensor Data Fusion, 1990 HIGH LOW MED

14. Event-Decision High Level Architecture 22 EVENT CLOUD (DISTRIBUTED DATA SET) KS KS KS KS KS KS KS KS KS KS KS KS KS KS Adapted from: Engelmore, R. S., Morgan, A.J., & and Nii, H. P., Blackboard Systems, 1988 & Luckham, D., The Power of Events, 2002

16. Event-Decision Architecture 24 Adapted from JDL: Steinberg, A., & Bowman, C., Handbook of Multisensor Data Fusion, CRC Press, 2001 EVENT PRE-PROCESSING EVENT SOURCES EXTERNAL . . . LEVEL ONE EVENT REFINEMENT USER INTERFACE COMPLEX EVENT PROCESSING (CEP) DB MANAGEMENT Historical Data Profiles & Patterns DISTRIBUTED LOCAL EVENT SERVICES . . EVENT PROFILES . . DATA BASES . . OTHER DATA LEVEL TWO SITUATION REFINEMENT LEVEL THREE IMPACT ASSESSMENT LEVEL FOUR PROCESS REFINEMENT

26. Processing Patterns Business Context Inference Processing Techniques Processing Patterns for PredictiveBusiness TM

29. Example Bayes Network I Identity Theft Detection / Phishing Source: Bass, T., TIBCO Software Inc., January 2006 Uses Proxy Alert Service Account Lockout Profile Mismatch Brand Phishing Alert Security Alert Customer Known Fraud IP Identity Theft Login Success Phishing Alert Brand Misuse

30. Example Bayes Network II Simple Web-Click Behavior Click Pg Subtype Click Elapsed Associate Session ID Stores Visited Click Pg Type Click to Purchase Session Time # Items Purchased ID Browser Recognize Session ID OS Total Purchase Session ID Code Click Price Price Click Count Source: Ambrosio, B., CleverSet Inc., December 2004

32. Event-Decision Processing Characteristics Adapted (this and the next slide) from: Steinberg, A., & Bowman, C., Handbook of Multisensor Data Fusion, CRC Press, 2001 Sensor Output Individual Event Aggregation (situation) Effect (situation, given plan) (Action) Entity Estimate Sensor Processing Event Processing Situation Assessment Impact Assessment Decision Making Activity Detection Assignment (L0) Event Preprocessing Attribution Assignment (L1) Event Refinement Relational Aggregation (L2) Situation Refinement Plan Interaction Aggregation (L3) Impact Assessment (Control) Planning (L4) Process Refinement Estimation Process Association Process JDL Model Levels

33. Comparison of Event-Decision Models Sense Detect Detect Analyze Analyze Decide Respond Sense & Respond Sensor Processing Collate Orient Sensor Processing (L0) Event Preprocessing Sensor Acquisition Collect Observe Sensing --- Activity Intelligence Cycle Boyd Loop Waterfall Model JDL Model Levels Decision Execution Disseminate Act Visualization Collate Evaluate Evaluate Disseminate Event Processing Situation Assessment Impact Assessment Decision Making Orient Pattern Processing / Feature Extraction (L1) Event Refinement Orient Situation Assessment (L2) Situation Refinement Orient --- (L3) Impact Assessment Decide Decision Making (L4) Process Refinement

35. Thank You! Tim Bass, CISSP Principal Global Architect [email_address] Complex Event Processing at TIBCO With BusinessEvents™

36. JDL Example: Inference ScoreCards Event Stream Raw Data Level 0 Pre-Processing Fraud Events Event Stream Level 1 Event Refinement ScoreCard Fraud Situations Fraud Events Level 2 Situation Assessment Business Impact Fraud Situations Level 3 Impact Assessment ScoreCard ScoreCard ScoreCard Event Source Task Level 4 Process Refinement ScoreCard Modified from: Steinberg, A., & Bowman, C., CRC Press, 2001