Rulecore
Encyclopedia
Rulecore is an ongoing research project investigating the use of different technologies to create software that support active behaviour. Especially active (near real-time) detection of event patterns. The foundations for the event pattern language of ruleCore is described in
The aim of the project is to transfer knowledge from the academic community into a commercial software product and services. The project contributes to some extent to academic research too.
The Rulecore project draws its ideas mainly from a number of academic research areas:
The architectural goals of the project is to investigate how a loosely coupled component can be added to existing IT infrastructure in order to provide active capabilities. The goal is to create a new type of event-driven component which can work as a components in a massively event driven architecture supporting huge number of components and high throughput event streams.
Active capabilities are defined, in the scope of the project, as:
The complex situation is defined using ideas created by research within the active database
community during 90's. The research area of sensor fusion also uses the concept of situations and situational awareness. Sensor fusion is, as the name implies, sensor oriented but shares many characteristics with the more business oriented situation detection of ruleCore.
Although immediate reaction is a goal, the ruleCore implementation lacks most of the features normally found in typical real-time
systems. Processing is performed on a best effort basis without any timing guarantees. The design an architecture of ruleCore makes a basic assumption that it will solve business related problems and this it was determined that hard real-time capabilities was not needed. This simplifies the design and implementation.
A design assumption is that there is a human in the loop and thus reaction times need only be short enough to be perceived immediate by a human observer. This basic assumption reduces complexity in the implementation of the evaluation engine.
Events are also allowed to be sent to ruleCore from multiple unsynchronized sources. It is assumed that multiple event sources exists which are under the control of different system owners. For example events from different web sites or other distributed sources.
Initial research for ruleCore started in 2001 as a tool to extend EAI (Enterprise Application Integration) solutions with BAM (Business Activity Monitoring) capabilities. At that time the business integration wave was catching on and providing an enabler for real-time access to business data.
During the years 2001 to 2004 considerable effort were put into research and resulted in published peer-reviewed research articles. During these years two open source releases were made of ruleCore prototypes to gain experience in this new style of event driven processing tools.
Event correlation as used by network monitoring solutions were used as inspiration source for the more advanced event correlation design ideas considering event selection and partitioning.
In 2005 the project where influenced with ideas from military sensor fusion approaches and research. Leading to design and implementation of business event fusion functions into the ruleCore CEP Server, which is the commercial implementation of ruleCore.
From 2004 to current date, effort is put into create an industrial strength server application for active rule processing.
Based on experience from the open source prototypes, the development of the ruleCore rule designer GUI was stopped in 2006. An open approach based on XML was adopted instead with public and free XML schemas and by choosing XML as the native interface. Also the engine was re-written to use an event driven architecture as the native API for rule management
During 2008 support has been added for geospatial event processing to complement the temporal event processing of the previous versions. Native support for GPS location datatypes and tracking of mobile entities with respect to geographical zones and routes (Defined using Google Maps or WebService API) has been added.
In 2009, a graphical user interface platform was added which uses a high level concept to provide a model suitable for non-technical end-users.
The event driven nature comes as a result of ruleCore being a component designed to be used as a building block in an event driven architecture. Event-driven architecture (EDA) have been proposed as one way to build better enterprise architectures in the future.
Clients interact with Rulecore purely using high level XML events. The Rulecore server and its clients are both event sinks and an event generators. This model of interaction is not common and is a research topic for future software components. The claim is that high level access using events creates software components which are more easily re-used than software with traditional APIs. Although this approach comes with it own set of problems such lower performance and synchronization and correlation issues. Future research are conducted to assert the viability of this approach.
In order to provide a coherent and easy to understand architecture an event-driven architecture is used internally in Rulecore. The aim is to try to avoid shifting paradigms when passing the Rulecore external interface. As the Rulecore interface is event-driven an event-driven architecture is used internally. Thus external and internal events can be managed in the same way.
The plug-in components of which ruleCore consists of are driven by a central event dispatcher. Automatic thread management is used to allow components to be started in separate threads in order to try to take advantage of multi cpu and multi core architectures.
The active database research invented the concept of active ECA (Event-Condition-Action) rules. The concept used in ruleCore is based on this research but modified and improved upon to be suitable in a message/event driven environment. It also improves the concepts in many areas on the initial research prototypes proposed in projects such as Snoop and ODE.
The ruleCore Event Model, and its Rule Evaluation Model and its definitions described in XML Schemas are placed in the public domain and thus freely usable for many purposes. To date, there exists one commercial implementation, marketed as the ruleCore CEP Server. and one open source version known simply as ruleCore.
The aim of the project is to transfer knowledge from the academic community into a commercial software product and services. The project contributes to some extent to academic research too.
The Rulecore project draws its ideas mainly from a number of academic research areas:
- Reaction Rules from Active Databases, Event-Condition-ActionEvent condition actionEvent Condition Action is a short-cut for referring to the structure of active rules in event driven architecture and active database systems.Such a rule traditionally consisted of three parts:...
(ECA) rules specially. - Simulation
- Network Event Correlation
- Complex Event ProcessingComplex Event ProcessingComplex event processing consists of processing many events happening across all the layers of an organization, identifying the most meaningful events within the event cloud, analyzing their impact, and taking subsequent action in real time....
(CEP) - The Semantic WebSemantic WebThe Semantic Web is a collaborative movement led by the World Wide Web Consortium that promotes common formats for data on the World Wide Web. By encouraging the inclusion of semantic content in web pages, the Semantic Web aims at converting the current web of unstructured documents into a "web of...
- Multi sensor fusionSensor fusionSensor fusion is the combining of sensory data or data derived from sensory data from disparate sources such that the resulting information is in some sense better than would be possible when these sources were used individually...
- Geospatial Databases
- The main contribution of ruleCore is the capability to describe very complex situations using a high level description language and provide an execution engine which tracks and monitors the behaviour of multiple entities in order to generate real-time alerts when a behaviour pattern is detected.
The architectural goals of the project is to investigate how a loosely coupled component can be added to existing IT infrastructure in order to provide active capabilities. The goal is to create a new type of event-driven component which can work as a components in a massively event driven architecture supporting huge number of components and high throughput event streams.
Active capabilities are defined, in the scope of the project, as:
- the ability to detect and react immediately to any complex situation (a.k.a. event pattern) consisting of multiple business events as they happen over time.
The complex situation is defined using ideas created by research within the active database
Active database
An Active Database is a database that includes an event driven architecture which can respond to conditions both inside and outside the database. Possible uses include security monitoring, alerting, statistics gathering and authorization.Most modern relational databases include active database...
community during 90's. The research area of sensor fusion also uses the concept of situations and situational awareness. Sensor fusion is, as the name implies, sensor oriented but shares many characteristics with the more business oriented situation detection of ruleCore.
Although immediate reaction is a goal, the ruleCore implementation lacks most of the features normally found in typical real-time
Real-time computing
In computer science, real-time computing , or reactive computing, is the study of hardware and software systems that are subject to a "real-time constraint"— e.g. operational deadlines from event to system response. Real-time programs must guarantee response within strict time constraints...
systems. Processing is performed on a best effort basis without any timing guarantees. The design an architecture of ruleCore makes a basic assumption that it will solve business related problems and this it was determined that hard real-time capabilities was not needed. This simplifies the design and implementation.
A design assumption is that there is a human in the loop and thus reaction times need only be short enough to be perceived immediate by a human observer. This basic assumption reduces complexity in the implementation of the evaluation engine.
Intended Audience
Rulecore is designed with the following typical use-cases in mind:- Correlating events in various monitoring scenarios. For example monitoring of IT infrastructure or business process execution.
- Tracking the behavior of mobile (vehicles) entities by observing their location events and detecting situations based on this location information correlated with telematics information.
- Detecting situations in message based integration infrastructure. For example monitoring of message oriented middleware and message brokers.
Design Philosophy
RuleCore creates a uniform and coherent concept for event processing by using a number of design principles:- All processing is driven by events. All processing is initiated by an event.
- RuleCore should fit as a component in a larger enterprise wide Event Driven Architecture (EDA), thus:
- RuleCore assumes event transport to be provided by someone else, for example message oriented middleware
- Event dispatching and routing is assumed to be handled by an external party, like a message broker or ESB
- Events are the basic "data type"
- Events are notifications of some activity, thus:
- Events are immutable
- Events have a unique id
- Events happen at an exact point in time.
- Temporal management and timing constraints are fundamental to event processing
- Specification of event patterns are declarative, not procedural.
- Event causality is automatically tracked
- Geographical location of the entity generating the event is a fundamental property.
Events are also allowed to be sent to ruleCore from multiple unsynchronized sources. It is assumed that multiple event sources exists which are under the control of different system owners. For example events from different web sites or other distributed sources.
History
The ruleCore project traces its roots to work done in active databases. The active database research which were initiated during the 80s and 90' were interested in adding active behavior to static data storage systems. The idea was to add functionality to react to changes in the database. For example when the value of items in stock goes below 5. Previously this had been solved by polling the database. This approach did not scale well and put a lot of stress on the database. It also could miss transient changes in the database happening between two polls.Initial research for ruleCore started in 2001 as a tool to extend EAI (Enterprise Application Integration) solutions with BAM (Business Activity Monitoring) capabilities. At that time the business integration wave was catching on and providing an enabler for real-time access to business data.
During the years 2001 to 2004 considerable effort were put into research and resulted in published peer-reviewed research articles. During these years two open source releases were made of ruleCore prototypes to gain experience in this new style of event driven processing tools.
Event correlation as used by network monitoring solutions were used as inspiration source for the more advanced event correlation design ideas considering event selection and partitioning.
In 2005 the project where influenced with ideas from military sensor fusion approaches and research. Leading to design and implementation of business event fusion functions into the ruleCore CEP Server, which is the commercial implementation of ruleCore.
From 2004 to current date, effort is put into create an industrial strength server application for active rule processing.
Based on experience from the open source prototypes, the development of the ruleCore rule designer GUI was stopped in 2006. An open approach based on XML was adopted instead with public and free XML schemas and by choosing XML as the native interface. Also the engine was re-written to use an event driven architecture as the native API for rule management
During 2008 support has been added for geospatial event processing to complement the temporal event processing of the previous versions. Native support for GPS location datatypes and tracking of mobile entities with respect to geographical zones and routes (Defined using Google Maps or WebService API) has been added.
In 2009, a graphical user interface platform was added which uses a high level concept to provide a model suitable for non-technical end-users.
Main Features
The main characteristic concept of ruleCore is its event driven nature. In contrast to conventional database and rule systems, in which the user executes a query at a given time, ruleCore reacts to events without requiring an explicit action from the user. All processing is initiated by inbound events or the lack of them.The event driven nature comes as a result of ruleCore being a component designed to be used as a building block in an event driven architecture. Event-driven architecture (EDA) have been proposed as one way to build better enterprise architectures in the future.
- Create virtual views of the inbound stream of events. The views acts as a context for rule evaluation. Events are included in the context set based on a number of properties;
- Type - For example, include only events of types 'DOOR OPEN' and 'LOW TEMPERATURE'
- Content - For example, include events which contain the same content in the body or contains a specific constant lite 'ERROR'
- Geographical location - For example, include events only from a specific city.
- Entity - For example, include events only from the same order process, same truck or mobile phone
- Time, for example include only events from last 10 minutes
- Count, for example, include only the last 100 events in the view
- Detection of sequences of events
- Detection of logical combinations of events, for example Any of A or B and C but not D
- Detection of non events. For example, vehicle did *not* exit zone within 3 hours after entering it.
- Native support for GeofenceGeofenceA geo-fence is a virtual perimeter for a real-world geographic area.A geo-fence could be dynamically generated—as in a radius around a store or point location. Or a geo-fence can be a predefined set of boundaries, like school attendance zones or neighborhood boundaries...
rules.
API
The Rulecore server uses slightly different programming interface model than traditional server software. Most traditional programming interfaces (API) uses a request/reply paradigm for interacting with clients. The API is normally accessed using a programming language such as Java, Perl or C#.Clients interact with Rulecore purely using high level XML events. The Rulecore server and its clients are both event sinks and an event generators. This model of interaction is not common and is a research topic for future software components. The claim is that high level access using events creates software components which are more easily re-used than software with traditional APIs. Although this approach comes with it own set of problems such lower performance and synchronization and correlation issues. Future research are conducted to assert the viability of this approach.
In order to provide a coherent and easy to understand architecture an event-driven architecture is used internally in Rulecore. The aim is to try to avoid shifting paradigms when passing the Rulecore external interface. As the Rulecore interface is event-driven an event-driven architecture is used internally. Thus external and internal events can be managed in the same way.
The plug-in components of which ruleCore consists of are driven by a central event dispatcher. Automatic thread management is used to allow components to be started in separate threads in order to try to take advantage of multi cpu and multi core architectures.
Background
RuleCore uses the concept of active rules based on ideas from the active database research conducted in the 90s.The active database research invented the concept of active ECA (Event-Condition-Action) rules. The concept used in ruleCore is based on this research but modified and improved upon to be suitable in a message/event driven environment. It also improves the concepts in many areas on the initial research prototypes proposed in projects such as Snoop and ODE.
Implementations
The Rulecore software is available freely for research and the GPL licensed source code is available on Sourceforge. The results of the project are described continuously in academic papers and reports. The Rulecore project has also contributed to EU funded research projects.The ruleCore Event Model, and its Rule Evaluation Model and its definitions described in XML Schemas are placed in the public domain and thus freely usable for many purposes. To date, there exists one commercial implementation, marketed as the ruleCore CEP Server. and one open source version known simply as ruleCore.