Described embodiments relate generally to ontology-driven complex event processing (CEP). When implemented as a computer (105), the computer (105) enables, in communication with a network, user generation and transformation of an event definition into an ontology-based event definition. A computer-implemented transformer component (140) receives the ontology -based event definition, generates event processing instructions and transmits the event processing instructions to a CEP server (150) over the network. The CEP server (150) then observes a plurality of structured messages containing event data and determines whether the event data satisfy all conditions of the event definition and sends an event message responsive to determining that all event definition conditions are satisfied. The described techniques allow an arbitrary high-throughput CEP to be used. A user, unaware of the normally difficult and heterogeneous CEP interfaces, can easily construct requests for event alerts using the described interface and a domain ontology that is appropriate for the user's interest.

Optimized complex event processing in a software-defined network is provided. A computing device receives a rule that identifies a source device and an event notification condition. A network inventory structure that identifies a plurality of nodes in the network and corresponding processing capabilities is accessed. A particular datapath node of the plurality of nodes is identified. A packet flow window criterion and a packet operation are determined based on the event notification condition. A particular virtual network function (VNF) of a plurality of VNFs is identified based on the rule. A controller node datapath configuration command that comprises a source device identifier that identifies the source device, the packet flow window criterion, the packet operation, and a VNF identifier that identifies the particular VNF is generated. The controller node datapath configuration command is sent to a controller node of the plurality of nodes.

Devices, systems and/or methods are provided to implement true real time pattern recognition and anomaly detection by leveraging hardware specifically designed for that purpose. In particular, digital signal processors (DSPs) are used to provide true real time analysis of digital signals. In an embodiment, the system may convert the CEP stream itself to a format understood by the hardware components while retaining enough specificity to reference particular events for further processing and analytics, resulting in true real time performance for CEP.

An event processing system for processing events in an event stream is disclosed. The system can execute instructions to receive a continuous query, apply a transformation to the continuous query to generate a query plan for the continuous query, transform the query plan using a transformation algorithm to generate a transformed query plan, receive a micro-batch stream of input events related to an application, process the input events of the micro-batch stream based at least in part on the transformed query plan to generate a set of output events related to the application, and store the set of output events related to the application in an output queue.

A system and method for maintaining and updating a complex event processing system in response to real-world changes, to avoid non-optimal queries that can lead to poor performance and/or erroneous results. The knowledge model of the complex event processing system is monitored to identify elements that impact query optimization and additional knowledge elements that would impact query optimization if they were present. A watch model is constructed for the identified elements, and responses to monitor queries sent to the event processor are checked to determine if the system requires re-optimization. When monitor query responses indicate that the system requires re-optimization, the affected queries are re-optimized and redeployed automatically.

A complex event processing system comprises a complex event processing engine (52) and an event harvesting system, wherein the event harvesting system is operable to monitor a computer network (10, 21, 22, 31, 32, 33), generate simple event reports in response to the result of monitoring the network and pass these to the complex event processing engine for processing. The event harvesting system comprises a central configuration control module (51, 53) and a plurality of capture node modules (41, 42) each of which is operatively connected to the central configuration control module. Each capture node module is operable to receive configuration instructions from the central configuration control module to determine what simple event reports are to be generated by the module and in response to what conditions detected on the monitored computer network. The central configuration control module includes an interface (51 ) in the form of a web server for receiving configuration instructions from a user of the system and for processing these configuration instructions and sending them to a specified capture node module for causing the module to operate in accordance with the specified configuration instructions.

The present invention includes a method for providing parameterized queries in complex event processing (CEP). The method includes providing a query template which includes one or more bind variables, providing sets of parameters corresponding to the one or more bind variables, and parsing the query template to determine positions of the one or more bind variables. The method further includes scanning the provided sets of parameters to determine which of the sets of parameters are to be bound to the one or more bind variables, binding the one or more bind variables which are determined to be bound to the sets of parameters, and substituting the bound one or more bind variables with the corresponding sets of parameters. The method further includes injecting all incarnations of the parameterized queries into the system, and one template/parameterized query is configured to run them all.