39 results about "Event stream processing" patented technology

An event stream processing device capable of processing larger numbers of events while simultaneously responding to queries. This is achieved through sequential storage of data, the maintenance in memory of information pertaining to the most recent events for each entity monitored and the aggregation of file read / write requests in a single thread which is capable of optimising the execution of those requests.

Computer implemented method, system and computer usable program code for achieving transactional quality of service in a transactional object store system. A transaction is received from a client and is executed, wherein the transaction comprises reading a read-only derived object, or reading or writing another object, and ends with a decision to request committing the transaction or a decision to request aborting the transaction. Responsive to a decision to request committing the transaction, wherein the transaction comprises writing a publishing object, events are delivered to event stream processing queries, and are executed in parallel with executing of the transaction. Responsive to a decision to request committing a transaction that comprises reading a read-only derived object, a validation is performed to determine whether the transaction can proceed to be committed, whether the transaction should abort, or whether the validation should delay waiting for one or more event stream processing queries to complete.

A security engine may use event-stream processing and behavioral techniques to detect ransomware. The engine may detect process behavior associated with encrypting a file, encrypting a storage device, or disabling a backup file, and may assign a ransomware category to the process based thereon. The engine may initiate protection actions to protect system resources from the process, which may continue to execute. The engine may monitor the process for specific behavior corresponding to its ransomware category. Based on the extent to which such specific behavior is detected, the engine may determine that the process is not ransomware, assign a ransomware subcategory to the process, or adjust the process's threat score. Monitoring of the process may continue, and the threat score may be updated based on the process's behavior. If the threat score exceeds a threshold corresponding to the ransomware category (or subcategory), a corresponding policy action may be initiated.

The present invention allows Scenarios to be easily created and maintained via a graphical user interface and processed efficiently by re-using Actions and Action Chains and aggregating duplicated Actions and Action Chains. The method of building, maintaining, re-using, and aggregating Actions and Action Chains utilizes Event-Driven Information Systems and supports the three styles of event processing: simple event processing, event stream processing, and complex event processing.

An event stream processing system includes a versioned data structure layered over a log-structured store. A first address handle points to a first version of data in the versioned data structure. A stream of data updates from a data source create a second version of data in the versioned data structure, addressed using a second address handle.

The invention discloses a stream data processing method based on event stream processing and a plug-in type development framework. The stream data processing method comprises the following steps: step 1, establishing a plug-in host program; step 2, defining an interface specification between the plug-in host program and a plug-in; step 3, aiming at data acquisition protocols of different outer field sensing equipment, generating corresponding data acquisition plug-ins; step 4, establishing an event stream processing engine; step 5, defining a time window or a length window for the event stream processing engine; step 6, aiming at the data acquisition protocols of the different outer field sensing equipment, realizing corresponding data processing rules; step 7, defining and registering events; step 8, correlating the registered events with the data processing rules in the step 6 respectively; step 9, setting event processing conditions; step 10, establishing a source data queue and a target queue; step 11, establishing a consumption thread; step 12, leading target data to a destination; and step 13, establishing a daemon process.

Disclosed are systems and methods for processing events in an event stream using a map-update application. The events may be embodied as a key-attribute pair. An event is processed by one or more instances implementing either a map or an update function. A map function receives an input event from the event stream and publishes one or more events to the event stream. An update function receives an event and updates a corresponding slate and publishes zero or more events. Systems and methods are also disclosed herein for implementing a map-update application in a multithreaded architecture and for handling overloading of a particular thread or node. Systems and methods for providing access to slates updated according to update operations are also disclosed.

Disclosed are systems and methods for processing events in an event stream using a map-update application. The events may be embodied as a key-attribute pair. An event is processed by one or more instances implementing either a map or an update function. A map function receives an input event from the event stream and publishes one or more events to the event stream. An update function receives an event and updates a corresponding slate and publishes zero or more events. Systems and methods are also disclosed herein for implementing a map-update application in a multithreaded architecture and for handling overloading of a particular thread or node. Systems and methods for providing access to slates updated according to update operations are also disclosed.

The present disclosure provides an event stream processing system, comprises a gateway device and an external module. The gateway device comprises an event processing engine, and the external module comprises external processor. The event processing engine comprises an event grouping unit, a catch-collector, a processor and an event generator. The event processing engine processes a plurality events of the event stream corresponded to a rule. The event grouping unit groups the events corresponded to the rule. The catch-collector couples to the event group unit, configured for storing a first group event. The processor couples to the event group unit, configured for processing a second group event. The external module calculates the first group event and generates a first processing result. The event generator integrates the first processing result of the first group event and a second processing result of the second group event and generates a derived event.

Method and Apparatus for rapid scalable unified infrastructure system management platform are disclosed by discovery of compute nodes, network components across data centers, both public and private for a user; assessment of type, capability, VLAN, security, virtualization configuration of the discovered unified infrastructure nodes and components; configuration of nodes and components covering add, delete, modify, scale; and rapid roll out of nodes and components across data centers both public and private.

The present application details exemplary methods and systems for processing an event stream at one or more datacenters within a network-based communication system. For example, a datacenter can detect an event that occurs within the network-based communication system. Upon detecting the event, the datacenter can create an event message and send the event message to other datacenters in the network-based communication system. Each datacenter that receives the event message from the datacenter can process the event message to obtain event information and can store the event information in association with a context, such as a user account.

Disclosed are systems and methods for processing events in an event stream using a map-update application. The events may be embodied as a key-attribute pair. An event is processed by one or more instances implementing either a map or an update function. A map function receives an input event from the event stream and publishes one or more events to the event stream. An update function receives an event and updates a corresponding slate and publishes zero or more events. Systems and methods are also disclosed herein for implementing a map-update application in a multithreaded architecture and for handling overloading of a particular thread or node. Systems and methods for providing access to slates updated according to update operations are also disclosed.

The invention provides a security policy self-feedback method based on security log association analysis. The security policy self-feedback method comprises the following steps: firstly, creating a security log information acquisition program, message queues and consumption services in one-to-one correspondence with the message queues; creating an event stream processing engine and various rules;associating the type of the event after registration of the security log information with a rule; packaging the original information of the security log into an event, inputting the event into an event stream processing engine, and matching a log analysis rule; inputting the analyzed log information into an event stream processing engine, matching a log association analysis rule, and generating association analysis log information; inputting the association analysis log information into an event flow processing engine, matching a security policy instruction generation rule, generating securitypolicy instruction information and outputting the security policy instruction information to a security policy issuing instruction message queue; and finally, issuing the security policy change instruction to the corresponding network security protection equipment to realize the change of the security protection policy. Compared with the prior art, the log analysis efficiency is higher, and automatic issuing of security policies is achieved.

In one embodiment, a stream processing system ingests data from one or more data sources and converts the data into an unbounded stream for an event stream processor. The stream processing system may include a first coordinating spout instance that is deployed at a first time, the first coordinating spout instance to instantiate one or more second spout instances and deploy said one more second spout instances at a second time that is later than the first time; the one or more second spout instances to: connect to the one or more data sources, respectively, and ingest a respective portion of the data from its respective one of the one or more data sources; and output messages based on the ingested portions of the data; wherein the unbounded stream for the event stream processor is based on the messages. Other embodiments may be disclosed and / or claimed.

The invention provides a cluster dispatch data processing method and a system based on event types. The method specifically comprises the steps that attributes of a to-be-processed event is arranged and stored at a server side in advance, wherein the attributes of the event comprises event type, and a dispatch terminal related to the event; when the server side detects that the event occurs, the server side sends event information to the dispatch terminal related to the event according to the event type; and the dispatch terminal receives the event information, performs corresponding process on the event and outputs a processing result. According to the method, processing people and methods for different types of event are preassigned; after receiving an event signal, the server matches the event signal with the event type, and sends dispatch information or a voice prompt to the preassigned event processing people so as to prompt a receiver to process the event. Through adoption of the method, defects of slow response to event processing and delayed processing in the prior art are overcome, and the method has the advantages of rapid and timely response to cluster dispatch events.

An event processing method and apparatus are disclosed. An event processing method includes: obtaining a processing requirement specified for the event processing; Reading a plurality of events in a preset message queue according to the processing requirement; The message queue includes an event inputted to a wind control system; Determining a processing scheme corresponding to the processing requirement according to the corresponding relationship between the preset processing requirement and the processing scheme; Grouping the read events according to grouping rules in the processing scheme;According to the de-duplication rule in the processing scheme, a plurality of unrepeated events in the group are reserved. The events reserved in each event group are written to the message queue so that other subsystems in the wind control system perform wind control processing on the written events.

A security engine may use event-stream processing and behavioral techniques to detect ransom ware. The engine may detect process behavior associated with encrypting a file, encrypting a storage device, or disabling a backup file, and may assign a ransomware category to the process based thereon The engine may initiate protection actions to protect system resources from the process, which may continue to execute. The engine may monitor the process for specific behavior corresponding to its ransomware category. Based on the extent to which such specific behavior is detected, the engine may determine that the process is not ransomware, assign a ransomware subcategory to the process, or adjust the process's threat score. Monitoring of the process may continue, and the threat score may be updated based on the process's behavior. If the threat score exceeds a threshold corresponding to the ransomware category (or subcategory), a corresponding policy action may be initiated.

The invention relates to routing management by an event stream processing cluster manager. The routing management is characterized by computing a device management router; defining an instantiation manager engine based on the manager engine, and instantiating a manager ESPE based on the created manager ESP model; creating a router profile based on the mapping information read from the manager profile, the mapping information describing a connection between the event publish source and a source window of the manager ESPE; instantiating a router engine based on the created router profile; and initiating a connector to receive an event based on a router profile. The event is received in a source window of a manager ESPE processed based on a manager ESP model. A third computing device is selected by the router engine based on usage metrics received from each of a plurality of windows defined by a remote ESP model configured to further process a processed event upon receiving the processedevent.

Disclosed are systems and methods for processing events in an event stream using a map-update application. The events may be embodied as a key-attribute pair. An event is processed by one or more instances implementing either a map or an update function. A map function receives an input event from the event stream and publishes one or more events to the event stream. An update function receives an event and updates a corresponding slate and publishes zero or more events. Systems and methods are also disclosed herein for implementing a map-update application in a multithreaded architecture and for handling overloading of a particular thread or node. Systems and methods for providing access to slates updated according to update operations are also disclosed.

The invention provides an event stream processing method and device, a mobile terminal and a computer readable storage medium, and the method comprises the steps: obtaining more than one touch point from a to-be-processed event stream when a drive layer obtains the to-be-processed event stream, and enabling the to-be-processed event stream to be generated based on the touch operation of a user fora screen of the mobile terminal; matching the more than one touch point with a preset gesture navigation condition; assigning a value to a preset event flag bit according to a matching result; the framework layer determining an event indicated by the to-be-processed event stream based on the assigned event flag bit, and determining an associated object of the to-be-processed event stream according to the event indicated by the to-be-processed event stream; and triggering the associated object to execute an event indicated by the to-be-processed event flow. According to the scheme, the judgment of the event flow of the screen is completed on the driving layer, and the framework layer is triggered to directly distribute the event flow to the corresponding associated object for processing based on the judgment result, so that the stability of the mobile terminal can be guaranteed.

A security engine may use event-stream processing and behavioral techniques to detect ransomware. The engine may detect process behavior associated with encrypting a file, encrypting a storage device, or disabling a backup file, and may assign a ransomware category to the process based thereon. The engine may initiate protection actions to protect system resources from the process, which may continue to execute. The engine may monitor the process for specific behavior corresponding to its ransomware category. Based on the extent to which such specific behavior is detected, the engine may determine that the process is not ransomware, assign a ransomware subcategory to the process, or adjust the process's threat score. Monitoring of the process may continue, and the threat score may be updated based on the process's behavior. If the threat score exceeds a threshold corresponding to the ransomware category (or subcategory), a corresponding policy action may be initiated.

Disclosed are systems and methods for processing events in an event stream using a map-update application. The events may be embodied as a key-attribute pair. An event is processed by one or more instances implementing either a map or an update function. A map function receives an input event from the event stream and publishes one or more events to the event stream. An update function receives an event and updates a corresponding slate and publishes zero or more events. Systems and methods are also disclosed herein for implementing a map-update application in a multithreaded architecture and for handling overloading of a particular thread or node. Systems and methods for providing access to slates updated according to update operations are also disclosed.

An electricity consumption information collection system and its collection method based on big data technology, relating to the electricity consumption information collection system and its collection method. At present, the power consumption information collection system has the problems of lack of high-speed and massive data storage calculation models, time-consuming, and poor calculation results. The present invention includes: a communication service module; a data storage module: connected to the communication service module, including relational databases, distributed databases and cloud storage, and the obtained electricity information data is correspondingly stored in the relational database, distributed database and cloud storage ; Data processing module: connected to the data storage module, which includes timing calculation service unit, real-time data flow processing unit, complex event flow processing unit, massive data off-line processing unit and data mining unit; data presentation module: connected to the data storage module. The technical solution adopts different processing methods for real-time calculation and offline calculation, which improves the real-time processing capability and calculation speed of data and effectively reduces storage space.

The invention relates to a pipeline theory method for processing faults based on change and alarm event streams. The method specifically comprises the following steps: acquiring a change event stream, an alarm event stream and a fault event stream; associating a change event, an alarm event and a fault event of the change event flow, the alarm event flow and the fault event flow based on time information in the change event flow, the alarm event flow and the fault event flow; when an alarm event is generated, triggering fault event upgrading, entering a fault event discovery stage, sending a fault notification to fault processing personnel through a worker or a program in the fault event discovery stage, and entering a fault processing stage; in the fault processing stage, positioning a first change event causing a fault through manual or program matching of historical change events; implementing the second change event to end the influence of the first change event; and along with the implementation of the second change event, recovering the fault, and eliminating the alarm event, so that the service is recovered to run stably.