Database Reference
In-Depth Information
apter for every new source; the Adapter Factory pattern with universal adapters has lim-
ited application here due to performance and reliability constraints.
Indeed, as mentioned earlier, a reflection attack involves two separate handshake sessions,
and the service agent running on Security Perimeter must analyze the broad session con-
text to detect it. Additional agents must be employed in order to analyze logs' repeatable
patterns or irregularities. For business services, the agent must control service invocation
footprints to check for invocation misses, belated responses, or certain response code (as
was mentioned during our ART discussion).
The last two agents' types can be combined in one Event Aggregator; this is how it is done
in AIA Foundation Pack (refer to the Development Guide DevGuide Version 11.1.1.6.3).
This aggregation model can be used for relation- and time-based aggregation (usually
both). Naturally, data cleansing and normalization will be required, so both transformation
patterns will be involved. Events aggregation should provide the following:
• Synchronization of an entity, providing a single, holistic view of the entity
• Consolidation of several fine-grained events into a single, coarse-grained event
• Merging of duplicates of the same event
Aggregation is probably the most difficult part of event filtering because correlations
between disparate event streams from event collectors and the necessity to analyze a data
block for an extended period of time is not always obvious. Declaring the constrained col-
lections against the available data, so-called data patterns, is one of the possible tech-
niques that requires Metadata Centralization in the way we described it in chapters dedic-
ated to metadata taxonomy and exception handling (
Chapter 5
,
Maintaining the Core -
ment of Rule Engine. As RE is necessary, Rule Centralization is also obligatory for the
second type of event service agents, and this is true not only for a time-driven event but
for request-driven event processing as well.
Tip
As an immediate conclusion of these analyses, we can point out Rule Engine as an essen-
tial part of EDN; consequently, a set of service agents (SCA decision services) are linked
to RE, which in turn implements the Rule Centralization pattern (at least for event pro-
cessing purposes). This RE-SR-SA implementation model is highly flexible because of its
decoupled realization. At the same time, the role of RE in EDN is so crucial that some-
times EDN can be entirely based on the RE alone. For instance, one of the leaders of com-
mercial rule management, namely, Blaze Advisor RE (from FICO) with a highly ad-
Search WWH ::
Custom Search