This  paper (Karthikeyan Bhargavan and Carl A. Gunter of the University of Pennsylvania) describes some key of the requirements for event recognition for black box monitoring of packet-mode communication protocols, particularly protocols built on the Internet Protocol (IP).

Such protocols produce packets as low-level events but analysis typically focuses on properties derived from collections of packets that are amalgamated to produce high-level events. The authors argue that a new language is appropriate for this task and describe a collection of requirements for the language. - goto
origianlly Posted to cep.weblogger.com by David Soul on 2/15/04; 8:02:17 PM in the CEP section.