Event correlation

Abstract

The advent of modern computer technology has enabled the development of many complex man-made systems. These include discrete manufacturing systems, communication networks, computer systems, traffic control systems, and inventory systems. A common characteristic of these systems is that they have discrete states (e.g., idle, processing, queue empty/full, and normal/faulty). Also, their state transition is triggered by events (e.g., part arrival/dispatch, alarms, commands, and timeout). For this reason, these systems are called discrete event systems or event-driven systems. As today's industry moves towards more complex, distributed and heterogeneous discrete event systems, there is a growing need for integration, consolidation, correlation, and distribution of the events coming from the systems. Event correlation achieves those objectives using methods borrowed mostly from artificial intelligence and formal methods. Historically, event correlation systems were developed for real-time monitoring of many classical mission-critical systems such as power plant and water/gas/oil distribution systems. Recently, it has been spreading into new areas such as messaging, network management and computer intrusion detection.