Tuesday, May 26, 2009

What does an Event Analyst do?

**** I am working on the images for this post. They will be along shortly! ****

Over the past several months, I have had the privilege of working with some of the top minds in event processing working on a glossary of event processing terms.  Our work has centered around the mechanics and "clock-works" of CEP.  This is extremely important work, but my mind keeps moving towards what does the event analyst do? Perhaps its my ADD, but what's a man to do?

The working group has a diagram of an fully developed event scenario.  We have used this diagram to aid in discussion and as a reference.  But again, my mind turns to the question of "how did an event analyst create this in the first place?"  In this post, I hope to work through that and perhaps evangelize some terms.

First off, what is an event analyst?  I see a specialized business analyst.  A person who recognizes the stimuli that sets things in motion.  It's obvious, a business is replete with business and technical events.  Some of these things like customer order or RFID or check paid are easy to bridge the gap between the real world and the emulating virtual computer world.  However, not all things that happen in the real world of business can be directly measured or captured.  How can you capture the event of fraud or a car accident except perhaps by a human entering information into a screen?  That is what an event analyst does: Figure out how to capture events that are not directly capture-able.

For those still reading, I want to illustrate an example of this and perhaps you can help me make it better. Comments are appreciated!  Especially around vocabulary of terms.  If something doesn't make sense or could be improved, please comment.  This is a work in process, so I have humble opinion of it.  The goal is to make it worthwhile even if it changes from my original opinion.

========  Situation  =========
Emily, an event analyst, works for the state transportation and highways department. She is given the task by her boss to figure out how they can increase capturing speeding motorists while decreasing the number State Trooper patrols.  Getting her cup of Jamaican Blue Mountain, she gets to work.

First off, she knows that there is an business event object in the Transportation system called speeding which is triggers a process in the court system which files the complain with the clerk of courts, sends out the legally approved correspondence and creates the case on the court's docket.  Currently, that event object is published when the patrol-person types the traffic ticket info into the patrol system.  In order to accomplish her task, however, Emily can't rely on human observing the speeding violation.   But how can we get a computer to measure that.  As any good analyst would do, she starts to draw a picture. (well, I would, but I am an architect which means picture-drawer, I believe)

*** Draw a picture of the two speeding events in the real and emulated worlds ***

When she considers the "real-world" event of speeding, a couple of things come to mind.  First off, what object is speeding?  The car.  And what does it mean "to speed"?  It means that the object (car) is moving faster than the legal limit for that section of road.   Emily realizes that the car has a velocity  which indicates the speed its traveling but also, thinking back to her calculus classes about integrals, that at each moment in time the car is at a certain position.  Since an event is a state change of an object, in a sense, the car has a stream of state changes in terms of its position. And the Speeding event would change state to speeding or not speeding depending on the velocity passed  legal limit at that location one way or the other.  Emily adds this event stream to her diagram.

*** Add an event stream for the movement to the picture ***

Emily understands that there is a relationship between speeding and movement which is called an attribute relationship, but how does that help her get the speeding event object in the patrol system to be published?  Perhaps she can figure out a way to get capture the movement.

As she is pondering this, she remembers that Homeland Security implemented a high speed traffic camera that was mounted around some critical infrastructure.  It has the ability to take high-speed digital images of 3 lanes of traffic and capture the license plates of cars.  In Homeland Security's case, they used the information to track the coming and goings of cars around the infrastructure, but Emily had an idea.  The raw events objects that were created had a timecode and a highly precise location.  Being the good event analyst, she reused what was available, subscribed to the raw event objects and started watching.  She know that the individual movement event caused the camera to capture the license plate encapsulating it in the raw event object.  

*** Add the camera event object, the causal relationship between the movement and camera. ***

Homeland security had 50 of these camera setup in the metro area.  All of them were setup at intervals along the roads around some critical areas.  By calculating the time difference between the intervals when a car (as identified by the license plate) past a camera, it is easy to calculate the speed by dividing the distance by the time.  This creates an inference relationship between the set of camera used to detect the movement of the car and the real-world speeding event.

Emily wrote some CEP Script that allowed her to calculate the time difference between the raw event objects for a particular car.  With that information, she was able to publish the speeding event object which acted as a stimuli to the rest of the legal process.  Her finished diagram looked as so:

No comments: