by  Liz Ahlberg,  University of Illinois News Bureau

University of Illinois researchers recently examined the benefit of matching passenger risk with security assets and found that intensive screening of all passengers makes the system less secure by overtaxing security resources.

“A natural tendency, when limited information is available about from where the next threat will come, is to overestimate the overall risk in the system, [which] actually makes the system less secure by over-allocating security resources to those in the system that are low on the risk scale relative to others in the system,” says Illinois professor Sheldon H. Jacobson.

He says with security resources devoted to too many low-risk passengers, those resources are less able to identify high-risk passengers. “The cost of such a system is prohibitive, and it makes the air system more vulnerable to successful attacks by sub-optimally allocating security assets,” Jacobson says.

The researchers developed three algorithms dealing with risk uncertainty in the passenger population. They then ran simulations to demonstrate how the algorithms, applied to a risk-based screening method, could estimate risk in the overall passenger population. The researchers found that risk-based screening increases the overall expected security.

“The ideal situation is to create a system that screens passengers commensurate with their risk,” Jacobson says.  Read the Article. (the full technical paper is also available there)

by: Philip Howard, Research Director – Data Management, Bloor

There have been a couple of things floating around in the ether about CEP (complex event processing) recently. The first is the question, supposedly credited to Curt Monash, of whether it should be called something different.

I’ve been going back through my records. When I first wrote a product evaluation of what is now Progress Apama in 2002, I stated that “the company’s contention is that conventional approaches to real-time queries are only suitable for small scale environments or those in which limited numbers of data feeds are being monitored. In particular, its view is that these solutions cannot cope with environments where large numbers of data feeds need to be combined in a complex and dynamic fashion.” That was the only use of the word “complex” in a total of nearly 3,000 words. Events were mentioned several times, streams not at all.

As an aside, look at Wikipedia and other sources about the development of CEP and you’ll see lots of mentions of David Luckham, who coined the CEP term in his book “The Power of Events”, published in 2001. You will also see various other attributions to American scholarship but no mention at all to Cambridge (that’s UK not Harvard), which is where Apama came from. I guess all the writers are American. …..

…… What I didn’t mention was that there are a number of companies/products that have been specifically designed to work in conjunction with Hadoop, namely HStreaming, S4 (from Yahoo!) and Storm (from Twitter). I haven’t looked at any of these in detail so can’t comment on them but that is definitely an area that is heating up.  Read the Blog

DCL: John Bates’ PH.D. work on event processing at Cambridge in the 1990′s should definitely be credited in any account of the development of CEP.

by John Markoff, New York Times

The legal and ethical implications of autonomous vehicles recently were discussed by Silicon Valley technologists, legal scholars, and government officials at Santa Clara University.

Even as Google tests its small fleet of self-driving vehicles on California highways, legal scholars and government officials are warning that society has only begun wrestling with the changes that would be required in a system created a century ago to meet the challenge of horseless carriages.

Google has demonstrated that autonomous vehicles could replace human drivers and greatly reduce human error, which causes most of the 33,000 deaths and 1.2 million injuries that occur in the U.S. each year.

Google’s autonomous vehicles currently have driven 200,000 miles without an accident. Nevada was the first state to legalize driverless vehicles, and similar laws have been introduced in Florida and Hawaii.

However, several issues, such as whether police should have the right to pull over autonomous vehicles, are unresolved, according to the University of Minnesota’s Frank Douma. “It’s a 21st-century Fourth Amendment seizure issue,” Douma says. The U.S. government does not have enough information to determine how to regulate driverless technologies, according to the National Highway Traffic Safety Administration’s O. Kevin Vincent.

Even after intelligent cars match human capabilities, significant issues, such as legal liability and insurance, would remain, says Stanford University’s Sven A. Beiker. In addition, autonomous vehicles rely on global positioning systems and satellite data, which are vulnerable to jamming by computer hackers. Article

DCL:  CEP will be an enabling technology inside these systems but the builders may not recognize that fact.

by Colin Neagle,   Network World

Microsoft announced plans to launch a real-time threat intelligence feed at the recent International Conference on Cyber Security. The project’s goal is to stream the company’s security information on dangerous and high-profile threats to organizations running the gamut from business partners and private corporations to domestic and foreign governments.

If the beta test is successful, Microsoft may make the feed publicly available. Microsoft’s T.J. Campana says the feed will serve as a Hadoop-based cluster merged with Windows Server, streaming information from a database that now contains data on the Kelihos botnet Microsoft first reported on in September.

“I don’t see a decrease in threats, but I do see this [feed] limiting the possible damage from a given threat as the community will be able to respond faster,” says Lumension analyst Paul Henry.

Microsoft will need to allay the concerns of privacy skeptics, particularly since the feed will circulate Internet Protocol addresses of systems that are discovered to be elements in large botnets. However, Henry says that security threat information can be exchanged without causing privacy infringement, noting that the Microsoft feed will bear a similarity to practices at the SANS Internet Storm Center.  Report

by Duncan Graham-Rowe,  MIT Technology Review

Samsung has developed a prototype emotion detection system for smartphones. Rather than use specialized sensors or cameras, the system monitors certain inputs, such as the speed at which a user types, how often the backspace or special symbol buttons are pressed, and how much the smartphone shakes.

Normal cell phone use enables the system to postulate the emotional state of the user, says Samsung researcher Hosub Lee. The system is designed to work as part of a Twitter client on an Android-based Samsung Galaxy S II, enabling people in a social network to view symbols of emotions alongside tweets. The system has to be trained to work with each individual user.

The software’s machine-learning algorithms currently offer detection with an accuracy of 67.5 percent, but the technology can be improved with more training data. “Emotion recognition technology will be an entry point for elaborate context-aware systems for future consumer electronics devices or services,” Lee says. “If we know the emotion of each user, we can provide more personalized services.”  Report

DCL: This is an application of event processing I did not foresee. The article doesn’t say what the “more personalized services” would be for an angry customer. Hate to think what United Airlines reservations system would do with me some of the time, if it knew how I felt.

by: Charles Rich  Sys-Con Media

The earlier you find an IT problem the less expensive it is to resolve it.  Most IT practitioners would agree with that.  What they will most likely disagree about is how to do it.  Some talk about predictive monitoring and say they can forecast IT problems before they occur.  Can that really be done?  Is predicting failure events even the right approach?

With the coming onslaught of what the media refers to as “big data” and the inevitable event storm that will accompany it, organizations need to find the best method for detecting business impacting problems early, and resolving them before they have user impact.

Although, useful, predicting IT events one by one isn’t sufficient.  We need to go beyond merely predicting events and look at what kind of real business problems we can uncover. For example, predicting that the congestion between a connection pool and a database will become a bottleneck in an hour by looking at a moving baseline is nice to know and important to the DB admin, but not necessarily a business impacting issue.  Problems like this are the easy, low-hanging fruit anyone can detect.  But, then there are the problems that are really hard to uncover such as whether interbank payments made using a complex, home-grown SOA application are completing on time and if not why– the payoff is that solving these can produce significant business value.

In order to solve the hard problems, we need to move in the direction of a pattern-based, problem-recognition strategy.  IT events can be captured from our devices, applications and users.  However, resolving IT events one by one as they arrive is often ineffective as it can be impossible for the service desk to determine if they are symptoms or causes and to understand their priority.

Again, with the rise of big data as cloud computing adoption matures this approach is doomed.  Today’s brute force approach to handling a growing set of events by writing an ever-increasing number of rules can never catch up and be effective.

Instead, a pattern-based strategy can look at these events in totality as a “situation”; a composite of IT events and business events that, taken together, describe a real problem with business impact.  This can be done today by utilizing technologies such as complex event processing to consider situations top-down and not just individual events bound together by an ever-growing set of programmer rules.

In our example, a business problem such as an interbank funds transfer taking too long can be considered as a situation.  Under the covers there may be messages with payment instructions sent over WebSphere MQ to a DataPower appliance.  At the appliance the message is transformed and then routed to an application at the appropriate bank via the Fed and sent out via a TIBCO message.  Think of this as a “chain of custody” for a payment as the transaction traverses multiple companies, a government agency and different messaging topologies.  Pretty complex. In a situation like this do we really want to focus on predicting a WebSphere or TIBCO problem?  What will that do for us? Or will it be much more effective to look at the situation of a late payment and then find the cause?  Certainly, the latter will be better as it is focused on what matters to the business.

The pattern based strategy is really one of scale and time.  As complexity increases, it can help us rapidly make sense of the data we are buried under and swiftly take the appropriate action to restore service.  Blog

DCL: If the author continued his line of thought he would probably come up with event processing techniques such as abstracting sets of events and hierarchical organizations of  layers of abstracted  events for different analytic purposes within the business.

Thilo Koslowski, Technology Review  

As our cars become networked—to the Internet and to one another—new trends in technology and society will redefine transportation. What’s certain: tomorrow’s automobiles will provide experiences that go well beyond driving.

The networking of vehicles to the Internet and each other over the next decade will spark new technological and societal trends in which automobiles of the future offer experiences that transcend driving, writes Gartner analyst Thilo Koslowski. He cites expected benefits such as lower accident rates, higher productivity, reduced emissions, on-demand entertainment for passengers, and in-vehicle health monitoring.

Koslowski says carmakers need to offer in-vehicle access to Web data so that they can maintain their relevance, and he argues that “the automotive industry must capture consumers’ interest in digital lifestyle offerings and adapt the relevant technologies to the car.” Koslowski says the one technology that offers the greatest possibility of meeting various transportation challenges presented by the global population explosion as well as the growth of the aged populace is the self-driving vehicle.

He also projects that the goals of zero accidents and real-time traffic management will come closer to realization over the next 10 years due to the continued development of sensors, computing power, machine learning, and big-data analytics. Koslowski also foresees the self-organization of cars that know their own location and that of other vehicles, enabling traffic flow optimization, pollution reduction, less congestion, and higher overall mobility.  Article

DCL:  We’ve been hearing about this from the automotive manufacturers for ten years. And the Grand Challenge races for robot cars go on year after year.  When will it happen?

by: Philip Howard, Research Director – Data Management, Bloor Research

It’s that time of year. Here are a few thoughts about what’s to come, in no particular order.

1. Real-time everything. Hardly a surprise. It’s been real-time everything for a few years. What I think is interesting is the growth in the data replication market specifically to support real-time BI as opposed to failover, disaster recovery, zero-downtime migrations and the like. I would not be at all surprised if we see the introduction of lightweight BI-only data replication products into the marketplace.
2. Continuous BI. I think we’ll hear a lot more about this as a generic market for complex event processing as opposed to the vertical markets that CEP has previously addressed.
3. CEP adoption by SIEM vendors. I have been arguing for the last two years that SIEM architectures are generally antiquated. The big breakthrough will come if (I think it more likely to be when) IBM announces that InfoSphere Streams has been integrated with QRadar. Now you have a big beast on the one hand and smaller, more agile companies like Red Lambda and Tier-3 all offering CEP in this space and the other suppliers will have to follow suit or a) appear out-of-date and slow (which they are) or b) limit themselves to the SME market. ….

Read Howard’s thoughts for 2012

by Clint Boulton, eWeek

Forrester Research analyst Sarah Rotman Epps says there are five computing form factors that could gain momentum in the near future.

For example, Epps says wearable devices will become popular, such as the Lark sleep tracker and Body Media wristband, which sync with Apple’s iOS devices for health and fitness scenarios.

Epps also cites embedded devices, such as refrigerators, coffee machines, and other Web-enabled devices that users could control with their smart devices. Epps also sees smart surfaces, or larger interactive displays that rely on multi-touch, voice and gesture input, facial recognition, near-field communication signals, and any other wireless technologies and sensors.

There also will be flexible displays that can come in the form of electronic readers or larger surface displays, such as furniture or wallpaper, according to Epps.

Finally, she predicts that mini-projectors, which project a larger image onto another surface or into three-dimensional space, will become available. “The most successful products will work with other products–for example, wearables that talk to smartphones and TVs; surfaces that are activated by the presence of your smartphone,” Epps says.  Report

DCL: A large amount of event processing will be involved in these visionary developments, and doubtless CEP.

by Declan McCullagh, CNet

Google chief Internet evangelist and 2004 ACM A.M. Turing Award winner Vint Cerf has sent a letter to U.S. House Judiciary chairman Rep. Lamar Smith (R-Texas), adding his voice to those of many other Internet and cybersecurity experts opposing the Stop Online Piracy Act (SOPA), which Smith authored.

According to Cerf’s letter, SOPA would not effectively prevent user access to illicit offshore Web sites, and also would trigger “a worldwide arms race of unprecedented ‘censorship’ of the Web.” Even with recently inserted revisions, Cerf writes that “the bill will still undermine cybersecurity including the robust implementation of DNS Security Extensions.”

He points out that “section 102(e)(2)(i) [of SOPA] continues to require service providers to block access to sites. While that provision no longer mandates DNS blocking in order to accomplish that goal, it still permits falsifying [Internet protocol (IP)] addresses in response to domain name resolution requests. Any response that provides a false IP address triggers potential damage to the intent of DNSSEC.”

He cautions that attempts to game DNS will make it less viable as the primary Web site location tool, and encourage the adoption of alternative mechanisms by abusers. Furthermore, Cerf writes that “site blocking or redirection mechanisms are unlikely to make a significant dent in the availability of infringing material and counterfeits online.”  Report