This sample demonstrates how to set up an execution plan with a Siddhi query to use Siddhi PMML extension in order to detect network intruders. The input event stream is processed by the execution plan which uses the pmml predictive model to detect whether a particular user is an intruder to the network or not. The output stream contains the processed query results which includes the predicted response along with the feature values extracted from the input event stream. This sample uses CEP event simulator to input data and the logger publisher for logging the outputs to the CEP console.
The query used in this sample is as follows.
- Receives events through the IntruderInputStream.
- Use PMML extension to predict with the aid of the decision-tree.pmml model.
- Finally outputs results into the IntruderOutputStream.
Set up the following prerequisites before starting the configurations.
- Set up the prerequisites required for all samples.
Start the server in standard mode and install Siddhi PMML Extension as a feature. For more information see Install WSO2 GPL Features.
Building the sample
Start the WSO2 CEP server with the sample configuration numbered 0301. For instructions, see Starting sample CEP configurations. This sample configuration does the following:
- Points the default Axis2 repo to
<CEP_HOME>/sample/artifacts/0301(by default, the Axis2 repo is
Executing the sample
Log into the CEP management console which is located at https://localhost:9443/carbon.
- Go to Tools -> Event Simulator. Under the 'Multiple Events' section, you can see the listed 'intruder.csv' file which contains some sample data. Click 'play' to start sending sample events from the file.
You view the values of the IntruderOutputStream from the CEP console as shown below.