Compliance is a critical enterprise management concern, particularly in business process-oriented organizations. We introduce an event ontology part of a policy and rules ontology for compliance modeling and enforcement. The policy and rules ontology is able to take decisions depending on the state of an enterprise model. In our work, events are used to support modeling complex decision-making patterns and propagation. We present an ontology for modeling events for compliance policies and rules and discuss its use in our compliance management framework.
Compliance management has been identified as one core topic of research for making
business process management (BPM) the enabler for more reliability and business
sustainability. In [
In our approach, we separate between decision-making and action-taking. Decisions can request other rules to make other decisions and/or request a responsible entity to execute some action (fig 1). Our goal is to allow modeling complex decisionmaking by using events as a mean of linking decision-making units (business rules) to other decision-making units as in figure 1. In the following, we motivate this use of events by giving an use case scenario and explain our approach to realizing this. We then show how our approach integrates in the SUPER semantic BPM (SBPM) framework and then conclude our proposal.
Policy
AND Rule Action … AND
Complex Decision Logical Operator
for Complex decision Decision
Propagate
Decision
AND
Fig1.: Decision-Making Tree: Policies, Rules, decisions, Actions. 2 Event Management in a Compliance Framework
Let us take the example of a security rule for intrusion detection. A system is under jurisdiction of a security policy P. As individual I accesses a resource of system S, an intrusion detection rule (called IDR) fires and (using certain intrusion detection logic provided by a security rule) decides that I is an intruder. Another rule (called NF), which decides which person should be notified about this intrusion and another rule (called IDP), which decides on further actions that need to be made depending on the resource accessed by the intruder should also fire. Rules IDP and NF are dependent on rule IDR. Using events, we can easily link rule IDR to the NF and IDP rules. This can be done by making rule IDR generate a well defined event and subscribing rules NF and IDP (configuring NF and IDP to listen) to this event. The event carries among other information the ID of the rule that has fired it and the protected resource being accessed. Events become thus the link that provides declarative automation in modeling complex decision-making in our compliance framework. We think that this idea can be easily generated to all rule frameworks for modeling complex decisions.
In [
OR XOR NOT + containsComplexEvent * + * EventPattern
LogicalOperator * usesOperator *
* * ComplexEvent EventStream 1..*
definesStream 1 EventCorrelation definesEvent
EventExpression
0..1 * containsEvent Generalization isA
includesEvent
Even*t * *
* +TriggeredByRule: Rule[
isA Input Event
Output Event
TriggeredBy
GenerateEvent
* EventScope 1 hasEventScope
ProcessModel
hasLogicalScope State * activatedByState * 1
*
definesState
policyActsOn
* Polic*y
+* ++IPsoImlicpyleIDm[e1n]ted [
Subject *
* EventLogicScope * * 1 * * Rule *
* * hasPolicyRule belongsToPolicyEventScope belongsToRuleEventScope
Fig 2. A Core Event Ontology for the Business Policy and Rules Ontology.
An event can itself fire other events if necessary. An event can be itself implemented as one of two types: (i) Complex Events and (ii) Event Streams. These both approaches to event processing are identified and implemented by existing major complex event processing (CEP) solutions. Events can be event expressions which combine atomic events in logical events using Boolean operators (AND, OR, NOT, XOR) to express complex events. We give in that simply using Boolean operators for complex events is not expressive enough. First of all, complex events may be defined not only using event occurrences (e.g. Ev1 AND (Ev2 OR Ev3)) but also using metadata transported by these events (e.g. Ev1.Att1 == Value1 AND Ev2.Att2 == Value2). Complex events could thus be a combination of event occurrences and rules expressed on the state of the system modeled using event meta-data. This shows the high inter-dependency between events and rules, as events are used to model complex business decisions, and other rules are used to model complex events. Secondly a complex event could be itself a tree of logical expression of events, with each event being at the same time an event and a node that has a sub-tree of events attached to it. This view maps directly to fig. 1 where decision nodes could at the same time be business rule invocation and a call to some action taking entity. This means that the decision-making tree example given in fig. 1 could be implemented using a complex event in the form of an event tree, with rules attached to each node that contain policy enforcement logic. Each node in the tree is actually a Boolean expression of the events in its sub-tree. Event patterns form reusable sets of complex events expressed in generic way, possibly using place-holders for both event types in Boolean event expressions and rules on event meta-data, as well as pre-defined event trees.
Another way of modeling events would be event stream processing (ESP). The STREAM1 system tackles just this issue (more fundamentally for data streams) and the open source ESPER2 tool provides CEP/ESP functionalities. ESP engines rely on modeling correlations patterns between singletons in an event stream and offer a query language3 for identifying patterns (logical and temporal constraints). BPM and Middleware vendors also incorporate tools for CEP such as ARIS Process Event Monitor4 or TIBCO Business Events5. Our core ontology needs to interface with such systems in order to be able to process complex events as far as event processing doesn’t require it to be done on a formal semantic level. This question will be evaluated in future works where we will design an architecture for event-based decision-making for compliance management, together with the problem of serializing policy and rule ontology events in formats processable by CEP and ESP tools. Another interrogation of ours is how to combine our event ontology with the SUPER EVO ontology of events for business process analysis (BPA). As policybased compliance controlling (monitoring and analysis) is one component of our compliance framework, we will attempt using events for logging relevant information for later analysis purposes or even real-time compliance analysis.
We devised a core event ontology for supporting policy-based decision management, for use in compliance management. We will next seek to design an architecture for modeling compliance policies using complex event processing, and integrate this architecture in the SUPER platform for semantic business process management.