Real-time fraud detection from IBM

IBM has recently published a Redbook on its solution in Real-time fraud detection. 

Fraud detection is a very important application, since every computerized system attracts people who attempt to hit the system.  While much of today's effort is dedicated to fraud in financial transaction systems, I guess that future efforts will be dedicated to those who are trying to sabotage your computerized car, or even bionic cells in your body.   The interesting fact about this IBM solution that two of the IBM products that participate in the solution are CICS and SPSS.   I worked a lot in SPSS during my first couple of years as a programmer in the Israeli air-force and this was in 1976.  At the same time CICS was used as the transaction processing system of the operational part of the air-force.   .   The SPSS modeler has a data-flow view from the family of event processing networks.  Interesting to see how old guys learn new tricks and handle very different applications relative to their original ones.

CICS event processing improved version

IBM CICS is an example for smart producer of event processing system, it does not do event processing inline, but instruments CICS transactions to emit events, and works in a loosely coupled mode with any event processing engine that can read its emitted events.  CICS TS 4.2  released recently has several improvements in the CICS event producing capabilities.  Among these improvement are:

• Including the event emission to be part of the transaction, by doing the event emission as part of the commit process.  Note that since it is loosely coupled with the event processing itself, this does not becomes atomic unit with the event processing itself, I have recently written about the relationships between transactions and events, and identified this area as one that need to be investigated more. 
• Change management inside the event instrumentation in CICS with appropriate tools
• Inclusion of system events inside the CICS instrumentation (e.g. connection/disconnection to databases, transactions aborts etc..). 

Since the strength of a chain s typically equivalent to the strength of the weakest link,  in many cases the producer is the weakest link, and the amount of work required to emit the right events and the right time is often much larger than the rest of the system.   Smart event producers like CICS making this weakest link much stronger.

On CICS event processing

Recently, IBM has announced "CICS Event Processing". A full presentation explaining what it is about, is available on the Web. As I have written many times in the past, the processing part of events is just a part of a bigger picture, that includes: producing the events before the processing, route the events to the right processing elements, and consuming the events by consumers. In some cases, devising the event processing application is the easier part of the work, and the more difficult part is to connect it to the rest of the world. Since a substantial amount of the world transactions are going through CICS, which is a rather old, but still alive and kicking transaction processor, then it makes good sense to take it as a place for instrumentation, and emit events that can be sent either to further processing or directly to a consumer or a dashboard. The event processing part of CICS perform simple and mediated event processing, e.g. filtering, transformation, enrichment and routing. For pattern matching it sends the event to an event processing engine. I think that we'll see more of the producer side event processing support, that will reduce the need to write ad-hoc adapters and make it more cost-effective to use. We'll also see the complementary part - the consumer side, on which I'll write in a later date.