The Cyberwar Against Marketing Hype

Posted on March 13th, 2009 by Tim Bass

When discussing CEP and EP, someone recently blogged:

“There is even one person who declared a full fledged cyber war on anybody who uses the term “complex event processing” not in what he believes to be the original intent of past DARPA project in the area of security and military operational applications.”

Actually, I think that blogger may be referring to me, so I should respond?

First off all, the intent of the original DARPA funded research for CEP is not something “that I believe” it is a fact, completed supported by the original DARPA documents and the papers and projects written on CEP.

Furthermore, the intent of CEP, as a discipline, was not only “security and military operational applications” as the blogger opines, it was to solve a wide range of detection-oriented problems to close the gap between operational capabilities in cyberspace. This is often referred to as the problem of asymmetric capabilities in cyberspace. I wrote about this in The Genesis of Complex Event Processing: Asymmetric Capabilities.

It is from this operational asymmetry that complexity in event processing is required. In other words, as distributed networks grow in complexity, it is difficult to determine causal dependence when trying to diagnosis a distributed networked system. Most who work in a large distributed network ecosystem (cyberspace) understand this. The CEP notion of “the event cloud” was an attempt to express this complexity and uncertainly (in cyberspace).

There are many classes of CEP problems and a number of them were funded by DARPA, including the work at Stanford where the phrase was minted. These problems, all documented in the original CEP research, papers, projects, slideshows and book, were (1) determining causality in complex distributed systems (troubleshooting), (2) detecting security threats in distributed network systems and (3) solving network management issues (which is a specific application of (1)). There were also a few other topics like SLA confirmation or verification, also related to (1).

The common thread, the conceptual framework that defines complexity, is the fact that there is “an event or situation” that is difficult to detect without some processing of complex events. These “complex events” were defined, via examples, in the early literature. There is not a single reference (that I can find) to complexity being related to “high throughput processing”; and there is not one reference (that I can find) in the CEP literature where “routing” (smart or otherwise), order management, or process orchestration is referred to as “a complex event”.

Share and Enjoy: