So how is CEP performing in the market?

TIBCO had their 4th quarter analyst call last week, and SeekingAlpha’s transcript has a few CEP mentions for TIBCO’s Q4 and 2011 FY:

  • “Our business optimization category, which includes both BusinessEvents and Spotfire, grew over 50% in license revenue for the year and has doubled in the past 2 years.”
  • “Business optimization was the clear growth driver this quarter, up 45% over last Q4. Both Spotfire and BusinessEvents, which make up this category, showed tremendous growth, and each had its largest quarter ever. BusinessEvents is also playing a larger and larger role in our platform sales, and therefore making up a larger and larger percentage of revenue on many deals.”
  • “…everybody is moving into an eventing engine. And some people — we have clients that are actually replacing app servers with event servers. …”
  • “It seems like the world is moving more and more to intelligent systems and driving intelligent outcomes in various verticals. “
  • “…so everybody wants to completely go to the eventing platform if you’re a retailer. … Everybody wants to be able to go all the way down to the consumer. They want to be able to make you the offer before you leave the aisle, not 6 months after you leave the store. … so Macy’s was an early TIBCO adopter to go to this eventing platform. And I think their results have shown it. …”
  • “One of the use cases we’re very excited about is for cybersecurity where people are now trying to look at events and anticipate that there might be trouble. And the — what we did in the government is now all of a sudden of interest everywhere. And in addition to our technology now being built into the smart grid, they’re using the cybersecurity component because once you have a smart grid, it can be hacked and that’s not so good. So we have some fantastic use cases around that. …”

Facebook Cybersecurity

Interesting article in the New Scientist titled “Inside Facebook’s massive cyber-security system” about a system they call the “Facebook Immune System” (FIS)…

…an all-seeing set of algorithms that monitors every photo posted to the network, every status update- indeed, every click made by every one of the 800 million users.

That is one big event monitoring system! The stats are impressive too:

  • 25Bn read-write actions monitored per day
  • Peak 650K events per second

Per the published paper, published under the Microsoft Research topic “Querying Large Distributed Graphs“, FIS has the following main features:

  • Classifier Services: various statistical algorithms
  • Feature eXtraction Language (FXL): a features and rules specification language – in other words, “patterns” – including stream processing expressions
  • dynamic model loading and training: also a common attribute of CEP systems
  • Policy Engine: the business rules engine also handling Classifer Services monitoring, executing the FXL expressions in rules.
  • Feature Loops (Floops): the aggregation mechanism taking feature extraction output and creating the complex events called features for the classifiers.

They also seemed to have exploited crowdsourcing as indicators for fraud: … [the system also] checked to see which messages were being flagged as spam by users and blocked messages with similar keywords in the text.

In some respects this is social rule / knowledge elicitation – something that can also be done on other social systems like tibbr, and likely an increasing trend that came up several times at RulesFest this week.

Meanwhile, TIBCO announced a cybersecurity deal with the US DHS.

Stuxnet worm: the need for provenance in events?

While discussing Smart Grids with a guest at the Paris NOW event earlier this week, TIBCO’s Al Harrington mentioned to me the discovery of the Stuxnet worm. This unconventionally targets SCADA controllers of the type used in many industrial control systems – power plants, water utilities, etc – and indicates the start of a distinct threat against current and future Smart Grid and similar systems. This does raise an interesting CEP issue, namely understanding the provenance of events being monitored as well as the reliability of our event sources.

Interestingly, it appears Stuxnet is using the usual-security-target of a PC running Windows just as a means to deliver its payload to SCADA systems. Also it is somewhat incredible that the first report of attack was from the controversial Iranian nuclear power program. So is this a cybersecurity issue, or a cyberwarfare offensive?