You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@eagle.apache.org by yo...@apache.org on 2016/07/27 05:48:48 UTC
svn commit: r1754217 [13/20] - in /incubator/eagle/site: ./ about/ css/
data/ docs/ docs/tutorial/ fonts/ images/ images/appManager/ images/docs/
images/posts/ images/slider/ images/usecases/ js/ post/ post/2015/
post/2015/10/ post/2015/10/26/
Added: incubator/eagle/site/docs/tutorial/topologymanagement.html
URL: http://svn.apache.org/viewvc/incubator/eagle/site/docs/tutorial/topologymanagement.html?rev=1754217&view=auto
==============================================================================
--- incubator/eagle/site/docs/tutorial/topologymanagement.html (added)
+++ incubator/eagle/site/docs/tutorial/topologymanagement.html Wed Jul 27 05:48:44 2016
@@ -0,0 +1,396 @@
+<!DOCTYPE html>
+<head>
+ <meta charset="utf-8">
+ <meta http-equiv="X-UA-Compatible" content="IE=edge">
+
+ <title>Eagle - Topology Management</title>
+ <meta name="description" content="Eagle - Analyze Big Data Platforms for Security and Performance">
+
+ <meta name="keywords" content="Eagle, Hadoop, Security, Real Time">
+ <meta name="author" content="eBay Inc.">
+
+ <meta charset="utf-8">
+ <meta name="viewport" content="initial-scale=1">
+
+ <link rel="stylesheet" href="/css/animate.css">
+ <link rel="stylesheet" href="/css/bootstrap.min.css">
+
+ <link rel="stylesheet" href="/css/font-awesome.min.css">
+
+ <link rel="stylesheet" href="/css/misc.css">
+ <link rel="stylesheet" href="/css/style.css">
+ <link rel="stylesheet" href="/css/styles.css">
+ <link rel="stylesheet" href="/css/main.css">
+ <link rel="alternate" type="application/rss+xml" title="Eagle" href="http://goeagle.io/feed.xml" />
+ <link rel="shortcut icon" href="/images/favicon.png">
+
+ <!-- Baidu Analytics Tracking-->
+ <script>
+ var _hmt = _hmt || [];
+ (function() {
+ var hm = document.createElement("script");
+ hm.src = "//hm.baidu.com/hm.js?fedc55df2ea52777a679192e8f849ece";
+ var s = document.getElementsByTagName("script")[0];
+ s.parentNode.insertBefore(hm, s);
+ })();
+ </script>
+
+ <!-- Google Analytics Tracking -->
+ <script>
+ (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
+ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
+ m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
+ })(window,document,'script','//www.google-analytics.com/analytics.js','ga');
+ ga('create', 'UA-68929805-1', 'auto');
+ ga('send', 'pageview');
+ </script>
+</head>
+<body>
+<!-- header start -->
+<div id="home_page">
+ <div class="topbar">
+ <div class="container">
+ <div class="row" >
+ <nav class="navbar navbar-default">
+ <div class="container-fluid">
+ <!-- Brand and toggle get grouped for better mobile display -->
+ <div class="navbar-header">
+ <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#bs-example-navbar-collapse-1"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button>
+ <a class="navbar-brand" href="/"><img src="/images/logo2.png" height="44px" style="margin-top:-7px"></a> </div>
+
+ <!-- Collect the nav links, forms, and other content for toggling -->
+ <!-- <div class="collapse navbar-collapse" id="bs-example-navbar-collapse-1">
+ <ul class="nav navbar-nav navbar-right" id="top-menu">
+ <li><a class="menu" href="/#home_page">HOME</a></li>
+ <li><a class="menu" href="/docs/">DOCS</a></li>
+ <li><a class="menu" href="/#about_page">ABOUT</a></li>
+ <li><a class="menu" href="/#diagram_page">ARCHITECTURE</a></li>
+ <li><a class="menu" href="/#modules_page">MODULES</a></li>
+ <li><a class="menu" href="/#usecase_page">USE CASES</a></li>
+ <li>
+ </li>
+ </ul> -->
+ </div>
+ </div>
+ <!-- /.container-fluid -->
+ </nav>
+ </div>
+ </div>
+ </div>
+ <div class="headerimage">
+ <div class="flexslider">
+ <ul class="slides">
+ <li><img src="/images/slider/4.jpg" alt="Slide 1"></li>
+ </ul>
+ </div>
+ </div>
+ <div class="particles" style="height:40%"> </div><!---particles-->
+ <div class="slider-caption" style="top:80px;">
+ <div class="homewrapper">
+ <div class="hometitle">
+ <a href="/">
+ <img src="/images/feather.png" height="80px">
+ </a>
+ </div>
+ <div class="hometext">
+ <h2>Analyze Big Data Platforms For Security and Performance</h2>
+ <div class="social-buttons">
+ <!-- <a href="https://github.com/ebay/eagle"><i class="fa fa-github"></i></a>
+ <a href="http://twitter.com/TheApacheEagle"><i class="fa fa-twitter"></i></a>
+ <a href="https://www.facebook.com/TheApacheEagle/"><i class="fa fa-facebook"></i></a>
+ <a href="#"><i class="fa fa-weixin"></i></a> -->
+ <!-- <a href="https://www.weibo.com/ApacheEagle/"><i class="fa fa-weibo"></i></a> -->
+ </div>
+ </div>
+ </div>
+ </div>
+</div>
+<!-- header end -->
+<div class="container-fluid page-content">
+ <a href="https://github.com/apache/incubator-eagle" target="_blank"><img style="z-index:10000;position: fixed; top: 0; right: 0; border: 0;" src="https://camo.githubusercontent.com/365986a132ccd6a44c23a9169022c0b5c890c387/68747470733a2f2f73332e616d617a6f6e6177732e636f6d2f6769746875622f726962626f6e732f666f726b6d655f72696768745f7265645f6161303030302e706e67" alt="Fork eagle on GitHub" data-canonical-src="https://s3.amazonaws.com/github/ribbons/forkme_right_red_aa0000.png"></a>
+
+ <div class="row">
+ <div class="col-md-10 col-md-offset-1">
+ <!-- sidebar -->
+ <div class="col-xs-6 col-sm-3" id="sidebar" role="navigation">
+ <ul class="nav" id="adminnav">
+
+ <li class="heading">Getting Started</li>
+
+ <li class="sidenavli "><a href="/docs/index.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Introduction</a></li>
+
+ <li class="sidenavli "><a href="/docs/usecases.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Use Cases</a></li>
+
+ <li class="sidenavli "><a href="/docs/terminology.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Terminology</a></li>
+
+ <li class="sidenavli "><a href="/docs/ecosystem.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Ecosystem</a></li>
+
+ <li class="sidenavli "><a href="/docs/community.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Community</a></li>
+
+ <li class="sidenavli "><a href="/docs/FAQ.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">FAQ</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Download</li>
+
+ <li class="sidenavli "><a href="/docs/download-0.4.0.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Latest version</a></li>
+
+ <li class="sidenavli "><a href="/docs/download.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Archived</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Installation</li>
+
+ <li class="sidenavli "><a href="/docs/quick-start.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Get Started with Sandbox</a></li>
+
+ <li class="sidenavli "><a href="/docs/deployment-in-docker.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Get Started with Docker</a></li>
+
+ <li class="sidenavli "><a href="/docs/deployment-env.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Setup Environment</a></li>
+
+ <li class="sidenavli "><a href="/docs/deployment-in-production.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Setup Eagle in Production</a></li>
+
+ <li class="sidenavli "><a href="/docs/configuration.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Eagle Topology Configuration</a></li>
+
+ <li class="sidenavli "><a href="/docs/serviceconfiguration.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Eagle Service Configuration</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/ldap.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Eagle LDAP Authentication</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Tutorial</li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/setup.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Site Management</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/policy.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Policy Management</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/policy-capabilities.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Policy Engine Capabilities</a></li>
+
+ <li class="sidenavli "><a href="/docs/hdfs-data-activity-monitoring.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">HDFS Data Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/hive-query-activity-monitoring.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">HIVE Query Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/hbase-data-activity-monitoring.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">HBASE Data Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/mapr-integration.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">MapR FS Data Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/jmx-metric-monitoring.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Hadoop JMX Metrics Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/import-hdfs-auditLog.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Stream HDFS audit logs into Kafka</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/userprofile.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">User Profile Feature</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/classification.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Data Classification Feature</a></li>
+
+ <li class="sidenavli current"><a href="/docs/tutorial/topologymanagement.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Topology Management Feature</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/notificationplugin.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Alert Notification Plugin</a></li>
+
+ <li class="sidenavli "><a href="/docs/metadata-api.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Metadata RESTful API</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Development Guide</li>
+
+ <li class="sidenavli "><a href="/docs/development-quick-guide.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Development Quick Guide</a></li>
+
+ <li class="sidenavli "><a href="/docs/development-in-macosx.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Development in Mac OSX</a></li>
+
+ <li class="sidenavli "><a href="/docs/development-in-intellij.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">Development in Intellij</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Advanced</li>
+
+ <li class="sidenavli "><a href="/docs/user-profile-ml.html" data-permalink="/docs/tutorial/topologymanagement.html" id="">User Profile Machine Learning</a></li>
+
+ <li class="divider"></li>
+
+ <li class="sidenavli">
+ <a href="mailto:dev@eagle.incubator.apache.org" target="_blank">Need Help?</a>
+ </li>
+ </ul>
+ </div>
+ <div class="col-xs-6 col-sm-9 page-main-content" style="margin-left: -15px" id="loadcontent">
+ <h1 class="page-header" style="margin-top: 0px">Topology Management</h1>
+ <p><em>Since Apache Eagle 0.4.0-incubating. Apache Eagle (incubating) will be called Eagle in the following.</em></p>
+
+<blockquote>
+ <p>Application manager aims to manage topology status on EAGLE UI. Users can easily start/start topologies remotely or locally without any shell commands. At the same, it should be capable to sync the latest status of topologies on the execution platform (e.g., storm cluster).</p>
+</blockquote>
+
+<p>This tutorial will go through all parts of application manager and then give an example to use it.</p>
+
+<h3 id="design">Design</h3>
+<p>Application manager consists of a daemon scheduler and an execution module. The scheduler periodically loads user operations(start/stop) from database, and the execution module executes these operations. For more details, please refer to <a href="https://cwiki.apache.org/confluence/display/EAG/Application+Management">here</a>.</p>
+
+<h3 id="configurations">Configurations</h3>
+<p>The configuration file <code>eagle-scheduler.conf</code> defines scheduler parameters, execution platform settings and parts of default topology configuration.</p>
+
+<ul>
+ <li>
+ <p><strong>Scheduler properties</strong></p>
+
+ <p><strong>appCommandLoaderEnabled</strong>: enable application manager. <strong>TODO</strong>: change it to true. <br />
+ <strong>appCommandLoaderIntervalSecs</strong>: defines the interval of the scheduler loads commands. Default value is 1 second. <br />
+ <strong>appHealthCheckIntervalSecs</strong>: define the interval of health check, which tries to sync the topology execution status to Eagle. <br /></p>
+ </li>
+ <li>
+ <p><strong>Execution platform properties</strong></p>
+
+ <p><strong>envContextConfig.env</strong>: application execution platform. Default value is storm. <br />
+ <strong>envContextConfig.url</strong>: execution platform http url. Default is “http://sandbox.hortonworks.com:8744”. <br />
+ <strong>envContextConfig.nimbusHost</strong>: storm nimbus host. Default is “sandbox.hortonworks.com”. <br />
+ <strong>envContextConfig.nimbusThriftPort</strong>: default is 6627.<br />
+ <strong>envContextConfig.jarFile</strong>: storm fat jar path. <strong>TODO</strong>: change “/dir-to-jar/eagle-topology-0.3.0-incubating-assembly.jar” to your own jar path. <br /></p>
+ </li>
+ <li>
+ <p><strong>Topology default properties</strong></p>
+
+ <p>Some default topology properties are defined here.</p>
+ </li>
+</ul>
+
+<p>Note: these configurations can be overridden in the topology configurations, which is shown below. The only difference is to add a prefix <code>app.</code>. For example, ‘app.envContextConfig.jarFile’ is to override ‘envContextConfig.jarFile’ in eagle-schedule.conf</p>
+
+<h3 id="playbook">Playbook</h3>
+
+<ol>
+ <li>
+ <p>Editing eagle-scheduler.conf, and start Eagle service</p>
+
+ <pre><code> # enable application manager
+ appCommandLoaderEnabled=true
+ # provide jar path
+ envContextConfig.jarFile=/path-to-jar
+</code></pre>
+
+ <p>For more configurations, please back to <strong>Configuration</strong>. <br />
+ After the configuration is ready, start Eagle service <code>bin/eagle-service.sh start</code>.</p>
+ </li>
+ <li>
+ <p>Go to admin page
+<img src="/images/appManager/admin-page.png" alt="admin-page" />
+<img src="/images/appManager/topology-monitor.png" alt="topology-monitor" /></p>
+ </li>
+ <li>Go to management page, and create a topology description. There are three required fields
+ <ul>
+ <li>name: topology name</li>
+ <li>type: topology type [CLASS, DYNAMIC]</li>
+ <li>execution entry: either the class which implements interface TopologyExecutable or eagle <a href="https://github.com/apache/incubator-eagle/blob/master/eagle-assembly/src/main/conf/sandbox-hadoopjmx-pipeline.conf">DSL</a> based topology definition
+<img src="/images/appManager/topology-description.png" alt="topology-description" /></li>
+ </ul>
+ </li>
+ <li>
+ <p>Back to monitoring page, and choose the site/application to deploy the topology
+<img src="/images/appManager/topology-execution.png" alt="topology-execution" /></p>
+ </li>
+ <li>Go to site page, and edit site->application and add some new configurations. Blow are some example configurations for [site=sandbox, applicatoin=hbaseSecurityLog]
+<code>These configurations have a higher priority than those in eagle-scheduler.conf</code></li>
+</ol>
+
+<pre><code> classification.hbase.zookeeper.property.clientPort=2181
+ classification.hbase.zookeeper.quorum=sandbox.hortonworks.com
+ # platform related configurations
+ app.envContextConfig.env=storm
+ app.envContextConfig.mode=cluster
+ # data source related configurations
+ app.dataSourceConfig.topic=sandbox_hbase_security_log
+ app.dataSourceConfig.zkConnection=sandbox.hortonworks.com:2181
+ app.dataSourceConfig.zkConnectionTimeoutMS=15000
+ app.dataSourceConfig.brokerZkPath=/brokers
+ app.dataSourceConfig.fetchSize=1048586
+ app.dataSourceConfig.transactionZKServers=sandbox.hortonworks.com
+ app.dataSourceConfig.transactionZKPort=2181
+ app.dataSourceConfig.transactionZKRoot=/consumers
+ app.dataSourceConfig.consumerGroupId=eagle.hbasesecurity.consumer
+ app.dataSourceConfig.transactionStateUpdateMS=2000
+ app.dataSourceConfig.deserializerClass=org.apache.eagle.security.hbase.parse.HbaseAuditLogKafkaDeserializer
+ # service related configurations
+ app.eagleProps.site=sandbox
+ app.eagleProps.application=hbaseSecurityLog
+ app.eagleProps.dataJoinPollIntervalSec=30
+ app.eagleProps.mailHost=atom.corp.ebay.com
+ app.eagleProps.mailSmtpPort=25
+ app.eagleProps.mailDebug=true
+ app.eagleProps.eagleService.host=localhost
+ app.eagleProps.eagleService.port=9099
+ app.eagleProps.eagleService.username=admin
+ app.eagleProps.eagleService.password=secret
+</code></pre>
+
+<p><img src="/images/appManager/topology-configuration-1.png" alt="topology-configuration-1" />
+ <img src="/images/appManager/topology-configuration-2.png" alt="topology-configuration-2" /></p>
+
+<ol>
+ <li>
+ <p>Go to monitoring page, and start topologies
+<img src="/images/appManager/start-topology-1.png" alt="start-topology-1" />
+<img src="/images/appManager/start-topology-2.png" alt="start-topology-2" /></p>
+ </li>
+ <li>
+ <p>stop topologies on monitoring page
+<img src="/images/appManager/stop-topology-1.png" alt="stop-topology-1" />
+<img src="/images/appManager/stop-topology-2.png" alt="stop-topology-2" />
+<img src="/images/appManager/stop-topology-3.png" alt="stop-topology-3" /></p>
+ </li>
+</ol>
+
+
+ </div><!--end of loadcontent-->
+ </div>
+ <!--end of centered content-->
+ </div>
+</div>
+<!--end of container-->
+
+<!-- footer start -->
+<div class="footerwrapper">
+ <div class="container">
+ <div class="row">
+ <div class="col-md-12"><div style="margin-left:auto; margin-right:auto; text-align:center;font-size: 12px">
+<div>
+Apache Eagle is an effort undergoing incubation at The Apache Software Foundation (ASF), sponsored by the Apache Incubator. Incubation is required of all newly accepted projects until a further review indicates that the infrastructure, communications, and decision making process have stabilized in a manner consistent with other successful ASF projects. While incubation status is not necessarily a reflection of the completeness or stability of the code, it does indicate that the project has yet to be fully endorsed by the ASF.
+</div>
+<div>
+<a href="http://www.apache.org">
+<img id="asf-logo" alt="Apache Software Foundation" src="/images/apache-logo-small.gif">
+</a>
+<a href="http://incubator.apache.org">
+<img id="incubator-logo" alt="Apache Incubator" src="/images/apache-incubator-logo-small.png">
+</a>
+</div>
+<div>
+Copyright © 2015 <a href="http://www.apache.org">The Apache Software Foundation</a>, Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.
+</div>
+<div>
+Apache Eagle, Eagle, Apache, the Apache feather logo, and the Apache Incubator project logo are trademarks of The Apache Software Foundation.
+</div>
+ </div></div>
+ </div>
+ </div>
+</div>
+<!-- footer end -->
+
+<!-- JavaScripts -->
+<script src="/js/jquery-1.11.1.min.js"></script>
+<script src="/js/jquery.singlePageNav.js"></script>
+<script src="/js/jquery.flexslider.js"></script>
+<script src="/js/modernizr.min.js"></script>
+<script src="/js/svg.js"></script>
+<script>
+ /************** FlexSlider *********************/
+ $('.flexslider').flexslider({
+ animation: "fade",
+ directionNav: false
+ });
+</script>
+
+<script>
+ /************** FlexSlider *********************/
+ $('.flexslider').flexslider({
+ animation: "fade",
+ directionNav: false
+ });
+</script>
+</body>
+</html>
Added: incubator/eagle/site/docs/tutorial/userprofile.html
URL: http://svn.apache.org/viewvc/incubator/eagle/site/docs/tutorial/userprofile.html?rev=1754217&view=auto
==============================================================================
--- incubator/eagle/site/docs/tutorial/userprofile.html (added)
+++ incubator/eagle/site/docs/tutorial/userprofile.html Wed Jul 27 05:48:44 2016
@@ -0,0 +1,357 @@
+<!DOCTYPE html>
+<head>
+ <meta charset="utf-8">
+ <meta http-equiv="X-UA-Compatible" content="IE=edge">
+
+ <title>Eagle - User Profile Tutorial</title>
+ <meta name="description" content="Eagle - Analyze Big Data Platforms for Security and Performance">
+
+ <meta name="keywords" content="Eagle, Hadoop, Security, Real Time">
+ <meta name="author" content="eBay Inc.">
+
+ <meta charset="utf-8">
+ <meta name="viewport" content="initial-scale=1">
+
+ <link rel="stylesheet" href="/css/animate.css">
+ <link rel="stylesheet" href="/css/bootstrap.min.css">
+
+ <link rel="stylesheet" href="/css/font-awesome.min.css">
+
+ <link rel="stylesheet" href="/css/misc.css">
+ <link rel="stylesheet" href="/css/style.css">
+ <link rel="stylesheet" href="/css/styles.css">
+ <link rel="stylesheet" href="/css/main.css">
+ <link rel="alternate" type="application/rss+xml" title="Eagle" href="http://goeagle.io/feed.xml" />
+ <link rel="shortcut icon" href="/images/favicon.png">
+
+ <!-- Baidu Analytics Tracking-->
+ <script>
+ var _hmt = _hmt || [];
+ (function() {
+ var hm = document.createElement("script");
+ hm.src = "//hm.baidu.com/hm.js?fedc55df2ea52777a679192e8f849ece";
+ var s = document.getElementsByTagName("script")[0];
+ s.parentNode.insertBefore(hm, s);
+ })();
+ </script>
+
+ <!-- Google Analytics Tracking -->
+ <script>
+ (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
+ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
+ m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
+ })(window,document,'script','//www.google-analytics.com/analytics.js','ga');
+ ga('create', 'UA-68929805-1', 'auto');
+ ga('send', 'pageview');
+ </script>
+</head>
+<body>
+<!-- header start -->
+<div id="home_page">
+ <div class="topbar">
+ <div class="container">
+ <div class="row" >
+ <nav class="navbar navbar-default">
+ <div class="container-fluid">
+ <!-- Brand and toggle get grouped for better mobile display -->
+ <div class="navbar-header">
+ <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#bs-example-navbar-collapse-1"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button>
+ <a class="navbar-brand" href="/"><img src="/images/logo2.png" height="44px" style="margin-top:-7px"></a> </div>
+
+ <!-- Collect the nav links, forms, and other content for toggling -->
+ <!-- <div class="collapse navbar-collapse" id="bs-example-navbar-collapse-1">
+ <ul class="nav navbar-nav navbar-right" id="top-menu">
+ <li><a class="menu" href="/#home_page">HOME</a></li>
+ <li><a class="menu" href="/docs/">DOCS</a></li>
+ <li><a class="menu" href="/#about_page">ABOUT</a></li>
+ <li><a class="menu" href="/#diagram_page">ARCHITECTURE</a></li>
+ <li><a class="menu" href="/#modules_page">MODULES</a></li>
+ <li><a class="menu" href="/#usecase_page">USE CASES</a></li>
+ <li>
+ </li>
+ </ul> -->
+ </div>
+ </div>
+ <!-- /.container-fluid -->
+ </nav>
+ </div>
+ </div>
+ </div>
+ <div class="headerimage">
+ <div class="flexslider">
+ <ul class="slides">
+ <li><img src="/images/slider/4.jpg" alt="Slide 1"></li>
+ </ul>
+ </div>
+ </div>
+ <div class="particles" style="height:40%"> </div><!---particles-->
+ <div class="slider-caption" style="top:80px;">
+ <div class="homewrapper">
+ <div class="hometitle">
+ <a href="/">
+ <img src="/images/feather.png" height="80px">
+ </a>
+ </div>
+ <div class="hometext">
+ <h2>Analyze Big Data Platforms For Security and Performance</h2>
+ <div class="social-buttons">
+ <!-- <a href="https://github.com/ebay/eagle"><i class="fa fa-github"></i></a>
+ <a href="http://twitter.com/TheApacheEagle"><i class="fa fa-twitter"></i></a>
+ <a href="https://www.facebook.com/TheApacheEagle/"><i class="fa fa-facebook"></i></a>
+ <a href="#"><i class="fa fa-weixin"></i></a> -->
+ <!-- <a href="https://www.weibo.com/ApacheEagle/"><i class="fa fa-weibo"></i></a> -->
+ </div>
+ </div>
+ </div>
+ </div>
+</div>
+<!-- header end -->
+<div class="container-fluid page-content">
+ <a href="https://github.com/apache/incubator-eagle" target="_blank"><img style="z-index:10000;position: fixed; top: 0; right: 0; border: 0;" src="https://camo.githubusercontent.com/365986a132ccd6a44c23a9169022c0b5c890c387/68747470733a2f2f73332e616d617a6f6e6177732e636f6d2f6769746875622f726962626f6e732f666f726b6d655f72696768745f7265645f6161303030302e706e67" alt="Fork eagle on GitHub" data-canonical-src="https://s3.amazonaws.com/github/ribbons/forkme_right_red_aa0000.png"></a>
+
+ <div class="row">
+ <div class="col-md-10 col-md-offset-1">
+ <!-- sidebar -->
+ <div class="col-xs-6 col-sm-3" id="sidebar" role="navigation">
+ <ul class="nav" id="adminnav">
+
+ <li class="heading">Getting Started</li>
+
+ <li class="sidenavli "><a href="/docs/index.html" data-permalink="/docs/tutorial/userprofile.html" id="">Introduction</a></li>
+
+ <li class="sidenavli "><a href="/docs/usecases.html" data-permalink="/docs/tutorial/userprofile.html" id="">Use Cases</a></li>
+
+ <li class="sidenavli "><a href="/docs/terminology.html" data-permalink="/docs/tutorial/userprofile.html" id="">Terminology</a></li>
+
+ <li class="sidenavli "><a href="/docs/ecosystem.html" data-permalink="/docs/tutorial/userprofile.html" id="">Ecosystem</a></li>
+
+ <li class="sidenavli "><a href="/docs/community.html" data-permalink="/docs/tutorial/userprofile.html" id="">Community</a></li>
+
+ <li class="sidenavli "><a href="/docs/FAQ.html" data-permalink="/docs/tutorial/userprofile.html" id="">FAQ</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Download</li>
+
+ <li class="sidenavli "><a href="/docs/download-0.4.0.html" data-permalink="/docs/tutorial/userprofile.html" id="">Latest version</a></li>
+
+ <li class="sidenavli "><a href="/docs/download.html" data-permalink="/docs/tutorial/userprofile.html" id="">Archived</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Installation</li>
+
+ <li class="sidenavli "><a href="/docs/quick-start.html" data-permalink="/docs/tutorial/userprofile.html" id="">Get Started with Sandbox</a></li>
+
+ <li class="sidenavli "><a href="/docs/deployment-in-docker.html" data-permalink="/docs/tutorial/userprofile.html" id="">Get Started with Docker</a></li>
+
+ <li class="sidenavli "><a href="/docs/deployment-env.html" data-permalink="/docs/tutorial/userprofile.html" id="">Setup Environment</a></li>
+
+ <li class="sidenavli "><a href="/docs/deployment-in-production.html" data-permalink="/docs/tutorial/userprofile.html" id="">Setup Eagle in Production</a></li>
+
+ <li class="sidenavli "><a href="/docs/configuration.html" data-permalink="/docs/tutorial/userprofile.html" id="">Eagle Topology Configuration</a></li>
+
+ <li class="sidenavli "><a href="/docs/serviceconfiguration.html" data-permalink="/docs/tutorial/userprofile.html" id="">Eagle Service Configuration</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/ldap.html" data-permalink="/docs/tutorial/userprofile.html" id="">Eagle LDAP Authentication</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Tutorial</li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/setup.html" data-permalink="/docs/tutorial/userprofile.html" id="">Site Management</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/policy.html" data-permalink="/docs/tutorial/userprofile.html" id="">Policy Management</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/policy-capabilities.html" data-permalink="/docs/tutorial/userprofile.html" id="">Policy Engine Capabilities</a></li>
+
+ <li class="sidenavli "><a href="/docs/hdfs-data-activity-monitoring.html" data-permalink="/docs/tutorial/userprofile.html" id="">HDFS Data Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/hive-query-activity-monitoring.html" data-permalink="/docs/tutorial/userprofile.html" id="">HIVE Query Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/hbase-data-activity-monitoring.html" data-permalink="/docs/tutorial/userprofile.html" id="">HBASE Data Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/mapr-integration.html" data-permalink="/docs/tutorial/userprofile.html" id="">MapR FS Data Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/jmx-metric-monitoring.html" data-permalink="/docs/tutorial/userprofile.html" id="">Hadoop JMX Metrics Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/import-hdfs-auditLog.html" data-permalink="/docs/tutorial/userprofile.html" id="">Stream HDFS audit logs into Kafka</a></li>
+
+ <li class="sidenavli current"><a href="/docs/tutorial/userprofile.html" data-permalink="/docs/tutorial/userprofile.html" id="">User Profile Feature</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/classification.html" data-permalink="/docs/tutorial/userprofile.html" id="">Data Classification Feature</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/topologymanagement.html" data-permalink="/docs/tutorial/userprofile.html" id="">Topology Management Feature</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/notificationplugin.html" data-permalink="/docs/tutorial/userprofile.html" id="">Alert Notification Plugin</a></li>
+
+ <li class="sidenavli "><a href="/docs/metadata-api.html" data-permalink="/docs/tutorial/userprofile.html" id="">Metadata RESTful API</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Development Guide</li>
+
+ <li class="sidenavli "><a href="/docs/development-quick-guide.html" data-permalink="/docs/tutorial/userprofile.html" id="">Development Quick Guide</a></li>
+
+ <li class="sidenavli "><a href="/docs/development-in-macosx.html" data-permalink="/docs/tutorial/userprofile.html" id="">Development in Mac OSX</a></li>
+
+ <li class="sidenavli "><a href="/docs/development-in-intellij.html" data-permalink="/docs/tutorial/userprofile.html" id="">Development in Intellij</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Advanced</li>
+
+ <li class="sidenavli "><a href="/docs/user-profile-ml.html" data-permalink="/docs/tutorial/userprofile.html" id="">User Profile Machine Learning</a></li>
+
+ <li class="divider"></li>
+
+ <li class="sidenavli">
+ <a href="mailto:dev@eagle.incubator.apache.org" target="_blank">Need Help?</a>
+ </li>
+ </ul>
+ </div>
+ <div class="col-xs-6 col-sm-9 page-main-content" style="margin-left: -15px" id="loadcontent">
+ <h1 class="page-header" style="margin-top: 0px">User Profile Tutorial</h1>
+ <p>This document will introduce how to start the online processing on user profiles. Assume Apache Eagle (incubating) has been installed and <a href="http://sandbox.hortonworks.com:9099/eagle-service">Eagle service</a>
+is started.</p>
+
+<h3 id="user-profile-offline-training">User Profile Offline Training</h3>
+
+<ul>
+ <li>
+ <p><strong>Step 1</strong>: Start Spark if not started
+<img src="/images/docs/start-spark.png" alt="Start Spark" /></p>
+ </li>
+ <li>
+ <p><strong>Step 2</strong>: start offline scheduler</p>
+
+ <ul>
+ <li>
+ <p>Option 1: command line</p>
+
+ <pre><code>$ cd <eagle-home>/bin
+$ bin/eagle-userprofile-scheduler.sh --site sandbox start
+</code></pre>
+ </li>
+ <li>
+ <p>Option 2: start via Ambari
+ <img src="/images/docs/offline-userprofile.png" alt="Click "ops"" /></p>
+ </li>
+ </ul>
+ </li>
+ <li>
+ <p><strong>Step 3</strong>: generate a model</p>
+
+ <p><img src="/images/docs/userProfile1.png" alt="Click "ops"" />
+ <img src="/images/docs/userProfile2.png" alt="Click "Update Now"" />
+ <img src="/images/docs/userProfile3.png" alt="Click "Confirm"" />
+ <img src="/images/docs/userprofile4.png" alt="Check" /></p>
+ </li>
+</ul>
+
+<h3 id="user-profile-online-detection">User Profile Online Detection</h3>
+
+<p>Two options to start the topology are provided.</p>
+
+<ul>
+ <li>
+ <p><strong>Option 1</strong>: command line</p>
+
+ <p>submit userProfiles topology if it’s not on <a href="http://sandbox.hortonworks.com:8744">topology UI</a></p>
+
+ <pre><code>$ bin/eagle-topology.sh --main eagle.security.userprofile.UserProfileDetectionMain --config conf/sandbox-userprofile-topology.conf start
+</code></pre>
+ </li>
+ <li>
+ <p><strong>Option 2</strong>: Ambari</p>
+
+ <p><img src="/images/docs/online-userprofile.png" alt="Online userProfiles" /></p>
+ </li>
+</ul>
+
+<h3 id="evaluate-user-profile-in-sandbox">Evaluate User Profile in Sandbox</h3>
+
+<ol>
+ <li>Prepare sample data for ML training and validation sample data
+ <ul>
+ <li>a. Download following sample data to be used for training</li>
+ <li><a href="/data/user1.hdfs-audit.2015-10-11-00.txt"><code>user1.hdfs-audit.2015-10-11-00.txt</code></a></li>
+ <li><a href="/data/user1.hdfs-audit.2015-10-11-01.txt"><code>user1.hdfs-audit.2015-10-11-01.txt</code></a></li>
+ <li>b. Downlaod <a href="/data/userprofile-validate.txt"><code>userprofile-validate.txt</code></a>file which contains data points that you can try to test the models</li>
+ </ul>
+ </li>
+ <li>Copy the files (downloaded in the previous step) into a location in sandbox
+For example: <code>/usr/hdp/current/eagle/lib/userprofile/data/</code></li>
+ <li>Modify <code><Eagle-home>/conf/sandbox-userprofile-scheduler.conf </code>
+update <code>training-audit-path</code> to set to the path for training data sample (the path you used for Step 1.a)
+update detection-audit-path to set to the path for validation (the path you used for Step 1.b)</li>
+ <li>Run ML training program from eagle UI</li>
+ <li>
+ <p>Produce kafka data using the contents from validate file (Step 1.b)
+Run the command (assuming the eagle configuration uses kafka topic <code>sandbox_hdfs_audit_log</code>)</p>
+
+ <pre><code> ./kafka-console-producer.sh --broker-list sandbox.hortonworks.com:6667 --topic sandbox_hdfs_audit_log
+</code></pre>
+ </li>
+ <li>Paste few lines of data from file validate onto kafka-console-producer
+Check <a href="http://localhost:9099/eagle-service/#/dam/alertList">http://localhost:9099/eagle-service/#/dam/alertList</a> for generated alerts</li>
+</ol>
+
+ </div><!--end of loadcontent-->
+ </div>
+ <!--end of centered content-->
+ </div>
+</div>
+<!--end of container-->
+
+<!-- footer start -->
+<div class="footerwrapper">
+ <div class="container">
+ <div class="row">
+ <div class="col-md-12"><div style="margin-left:auto; margin-right:auto; text-align:center;font-size: 12px">
+<div>
+Apache Eagle is an effort undergoing incubation at The Apache Software Foundation (ASF), sponsored by the Apache Incubator. Incubation is required of all newly accepted projects until a further review indicates that the infrastructure, communications, and decision making process have stabilized in a manner consistent with other successful ASF projects. While incubation status is not necessarily a reflection of the completeness or stability of the code, it does indicate that the project has yet to be fully endorsed by the ASF.
+</div>
+<div>
+<a href="http://www.apache.org">
+<img id="asf-logo" alt="Apache Software Foundation" src="/images/apache-logo-small.gif">
+</a>
+<a href="http://incubator.apache.org">
+<img id="incubator-logo" alt="Apache Incubator" src="/images/apache-incubator-logo-small.png">
+</a>
+</div>
+<div>
+Copyright © 2015 <a href="http://www.apache.org">The Apache Software Foundation</a>, Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.
+</div>
+<div>
+Apache Eagle, Eagle, Apache, the Apache feather logo, and the Apache Incubator project logo are trademarks of The Apache Software Foundation.
+</div>
+ </div></div>
+ </div>
+ </div>
+</div>
+<!-- footer end -->
+
+<!-- JavaScripts -->
+<script src="/js/jquery-1.11.1.min.js"></script>
+<script src="/js/jquery.singlePageNav.js"></script>
+<script src="/js/jquery.flexslider.js"></script>
+<script src="/js/modernizr.min.js"></script>
+<script src="/js/svg.js"></script>
+<script>
+ /************** FlexSlider *********************/
+ $('.flexslider').flexslider({
+ animation: "fade",
+ directionNav: false
+ });
+</script>
+
+<script>
+ /************** FlexSlider *********************/
+ $('.flexslider').flexslider({
+ animation: "fade",
+ directionNav: false
+ });
+</script>
+</body>
+</html>
Added: incubator/eagle/site/docs/usecases.html
URL: http://svn.apache.org/viewvc/incubator/eagle/site/docs/usecases.html?rev=1754217&view=auto
==============================================================================
--- incubator/eagle/site/docs/usecases.html (added)
+++ incubator/eagle/site/docs/usecases.html Wed Jul 27 05:48:44 2016
@@ -0,0 +1,328 @@
+<!DOCTYPE html>
+<head>
+ <meta charset="utf-8">
+ <meta http-equiv="X-UA-Compatible" content="IE=edge">
+
+ <title>Eagle - Use Cases</title>
+ <meta name="description" content="Eagle - Analyze Big Data Platforms for Security and Performance">
+
+ <meta name="keywords" content="Eagle, Hadoop, Security, Real Time">
+ <meta name="author" content="eBay Inc.">
+
+ <meta charset="utf-8">
+ <meta name="viewport" content="initial-scale=1">
+
+ <link rel="stylesheet" href="/css/animate.css">
+ <link rel="stylesheet" href="/css/bootstrap.min.css">
+
+ <link rel="stylesheet" href="/css/font-awesome.min.css">
+
+ <link rel="stylesheet" href="/css/misc.css">
+ <link rel="stylesheet" href="/css/style.css">
+ <link rel="stylesheet" href="/css/styles.css">
+ <link rel="stylesheet" href="/css/main.css">
+ <link rel="alternate" type="application/rss+xml" title="Eagle" href="http://goeagle.io/feed.xml" />
+ <link rel="shortcut icon" href="/images/favicon.png">
+
+ <!-- Baidu Analytics Tracking-->
+ <script>
+ var _hmt = _hmt || [];
+ (function() {
+ var hm = document.createElement("script");
+ hm.src = "//hm.baidu.com/hm.js?fedc55df2ea52777a679192e8f849ece";
+ var s = document.getElementsByTagName("script")[0];
+ s.parentNode.insertBefore(hm, s);
+ })();
+ </script>
+
+ <!-- Google Analytics Tracking -->
+ <script>
+ (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
+ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
+ m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
+ })(window,document,'script','//www.google-analytics.com/analytics.js','ga');
+ ga('create', 'UA-68929805-1', 'auto');
+ ga('send', 'pageview');
+ </script>
+</head>
+<body>
+<!-- header start -->
+<div id="home_page">
+ <div class="topbar">
+ <div class="container">
+ <div class="row" >
+ <nav class="navbar navbar-default">
+ <div class="container-fluid">
+ <!-- Brand and toggle get grouped for better mobile display -->
+ <div class="navbar-header">
+ <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#bs-example-navbar-collapse-1"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button>
+ <a class="navbar-brand" href="/"><img src="/images/logo2.png" height="44px" style="margin-top:-7px"></a> </div>
+
+ <!-- Collect the nav links, forms, and other content for toggling -->
+ <!-- <div class="collapse navbar-collapse" id="bs-example-navbar-collapse-1">
+ <ul class="nav navbar-nav navbar-right" id="top-menu">
+ <li><a class="menu" href="/#home_page">HOME</a></li>
+ <li><a class="menu" href="/docs/">DOCS</a></li>
+ <li><a class="menu" href="/#about_page">ABOUT</a></li>
+ <li><a class="menu" href="/#diagram_page">ARCHITECTURE</a></li>
+ <li><a class="menu" href="/#modules_page">MODULES</a></li>
+ <li><a class="menu" href="/#usecase_page">USE CASES</a></li>
+ <li>
+ </li>
+ </ul> -->
+ </div>
+ </div>
+ <!-- /.container-fluid -->
+ </nav>
+ </div>
+ </div>
+ </div>
+ <div class="headerimage">
+ <div class="flexslider">
+ <ul class="slides">
+ <li><img src="/images/slider/4.jpg" alt="Slide 1"></li>
+ </ul>
+ </div>
+ </div>
+ <div class="particles" style="height:40%"> </div><!---particles-->
+ <div class="slider-caption" style="top:80px;">
+ <div class="homewrapper">
+ <div class="hometitle">
+ <a href="/">
+ <img src="/images/feather.png" height="80px">
+ </a>
+ </div>
+ <div class="hometext">
+ <h2>Analyze Big Data Platforms For Security and Performance</h2>
+ <div class="social-buttons">
+ <!-- <a href="https://github.com/ebay/eagle"><i class="fa fa-github"></i></a>
+ <a href="http://twitter.com/TheApacheEagle"><i class="fa fa-twitter"></i></a>
+ <a href="https://www.facebook.com/TheApacheEagle/"><i class="fa fa-facebook"></i></a>
+ <a href="#"><i class="fa fa-weixin"></i></a> -->
+ <!-- <a href="https://www.weibo.com/ApacheEagle/"><i class="fa fa-weibo"></i></a> -->
+ </div>
+ </div>
+ </div>
+ </div>
+</div>
+<!-- header end -->
+<div class="container-fluid page-content">
+ <a href="https://github.com/apache/incubator-eagle" target="_blank"><img style="z-index:10000;position: fixed; top: 0; right: 0; border: 0;" src="https://camo.githubusercontent.com/365986a132ccd6a44c23a9169022c0b5c890c387/68747470733a2f2f73332e616d617a6f6e6177732e636f6d2f6769746875622f726962626f6e732f666f726b6d655f72696768745f7265645f6161303030302e706e67" alt="Fork eagle on GitHub" data-canonical-src="https://s3.amazonaws.com/github/ribbons/forkme_right_red_aa0000.png"></a>
+
+ <div class="row">
+ <div class="col-md-10 col-md-offset-1">
+ <!-- sidebar -->
+ <div class="col-xs-6 col-sm-3" id="sidebar" role="navigation">
+ <ul class="nav" id="adminnav">
+
+ <li class="heading">Getting Started</li>
+
+ <li class="sidenavli "><a href="/docs/index.html" data-permalink="/docs/usecases.html" id="">Introduction</a></li>
+
+ <li class="sidenavli current"><a href="/docs/usecases.html" data-permalink="/docs/usecases.html" id="">Use Cases</a></li>
+
+ <li class="sidenavli "><a href="/docs/terminology.html" data-permalink="/docs/usecases.html" id="">Terminology</a></li>
+
+ <li class="sidenavli "><a href="/docs/ecosystem.html" data-permalink="/docs/usecases.html" id="">Ecosystem</a></li>
+
+ <li class="sidenavli "><a href="/docs/community.html" data-permalink="/docs/usecases.html" id="">Community</a></li>
+
+ <li class="sidenavli "><a href="/docs/FAQ.html" data-permalink="/docs/usecases.html" id="">FAQ</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Download</li>
+
+ <li class="sidenavli "><a href="/docs/download-0.4.0.html" data-permalink="/docs/usecases.html" id="">Latest version</a></li>
+
+ <li class="sidenavli "><a href="/docs/download.html" data-permalink="/docs/usecases.html" id="">Archived</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Installation</li>
+
+ <li class="sidenavli "><a href="/docs/quick-start.html" data-permalink="/docs/usecases.html" id="">Get Started with Sandbox</a></li>
+
+ <li class="sidenavli "><a href="/docs/deployment-in-docker.html" data-permalink="/docs/usecases.html" id="">Get Started with Docker</a></li>
+
+ <li class="sidenavli "><a href="/docs/deployment-env.html" data-permalink="/docs/usecases.html" id="">Setup Environment</a></li>
+
+ <li class="sidenavli "><a href="/docs/deployment-in-production.html" data-permalink="/docs/usecases.html" id="">Setup Eagle in Production</a></li>
+
+ <li class="sidenavli "><a href="/docs/configuration.html" data-permalink="/docs/usecases.html" id="">Eagle Topology Configuration</a></li>
+
+ <li class="sidenavli "><a href="/docs/serviceconfiguration.html" data-permalink="/docs/usecases.html" id="">Eagle Service Configuration</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/ldap.html" data-permalink="/docs/usecases.html" id="">Eagle LDAP Authentication</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Tutorial</li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/setup.html" data-permalink="/docs/usecases.html" id="">Site Management</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/policy.html" data-permalink="/docs/usecases.html" id="">Policy Management</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/policy-capabilities.html" data-permalink="/docs/usecases.html" id="">Policy Engine Capabilities</a></li>
+
+ <li class="sidenavli "><a href="/docs/hdfs-data-activity-monitoring.html" data-permalink="/docs/usecases.html" id="">HDFS Data Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/hive-query-activity-monitoring.html" data-permalink="/docs/usecases.html" id="">HIVE Query Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/hbase-data-activity-monitoring.html" data-permalink="/docs/usecases.html" id="">HBASE Data Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/mapr-integration.html" data-permalink="/docs/usecases.html" id="">MapR FS Data Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/jmx-metric-monitoring.html" data-permalink="/docs/usecases.html" id="">Hadoop JMX Metrics Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/import-hdfs-auditLog.html" data-permalink="/docs/usecases.html" id="">Stream HDFS audit logs into Kafka</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/userprofile.html" data-permalink="/docs/usecases.html" id="">User Profile Feature</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/classification.html" data-permalink="/docs/usecases.html" id="">Data Classification Feature</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/topologymanagement.html" data-permalink="/docs/usecases.html" id="">Topology Management Feature</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/notificationplugin.html" data-permalink="/docs/usecases.html" id="">Alert Notification Plugin</a></li>
+
+ <li class="sidenavli "><a href="/docs/metadata-api.html" data-permalink="/docs/usecases.html" id="">Metadata RESTful API</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Development Guide</li>
+
+ <li class="sidenavli "><a href="/docs/development-quick-guide.html" data-permalink="/docs/usecases.html" id="">Development Quick Guide</a></li>
+
+ <li class="sidenavli "><a href="/docs/development-in-macosx.html" data-permalink="/docs/usecases.html" id="">Development in Mac OSX</a></li>
+
+ <li class="sidenavli "><a href="/docs/development-in-intellij.html" data-permalink="/docs/usecases.html" id="">Development in Intellij</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Advanced</li>
+
+ <li class="sidenavli "><a href="/docs/user-profile-ml.html" data-permalink="/docs/usecases.html" id="">User Profile Machine Learning</a></li>
+
+ <li class="divider"></li>
+
+ <li class="sidenavli">
+ <a href="mailto:dev@eagle.incubator.apache.org" target="_blank">Need Help?</a>
+ </li>
+ </ul>
+ </div>
+ <div class="col-xs-6 col-sm-9 page-main-content" style="margin-left: -15px" id="loadcontent">
+ <h1 class="page-header" style="margin-top: 0px">Use Cases</h1>
+ <h3 id="data-activity-monitoring">Data Activity Monitoring</h3>
+
+<ul>
+ <li>
+ <p>Data activity represents how user explores data provided by big data platforms. Analyzing data activity and alerting for insecure access are fundamental requirements for securing enterprise data. As data volume is increasing exponentially with Hadoop, Hive, Spark technology, understanding data activities for every user becomes extremely hard, let alone to alert for a single malicious event in real time among petabytes streaming data per day.</p>
+ </li>
+ <li>
+ <p>Securing enterprise data starts from understanding data activities for every user. Apache Eagle (incubating, called Eagle in the following) has integrated with many popular big data platforms e.g. Hadoop, Hive, Spark, Cassandra etc. With Eagle user can browse data hierarchy, mark sensitive data and then create comprehensive policy to alert for insecure data access.</p>
+ </li>
+</ul>
+
+<h3 id="job-performance-analytics">Job Performance Analytics</h3>
+
+<ul>
+ <li>
+ <p>Running map/reduce job is the most popular way people use to analyze data in Hadoop system. Analyzing job performance and providing tuning suggestions are critical for Hadoop system stability, job SLA and resource usage etc.</p>
+ </li>
+ <li>
+ <p>Apache Eagle analyzes job performance with two complementing approaches. First Eagle periodically takes snapshots for all running jobs with YARN API, secondly Eagle continuously reads job lifecycle events immediately after the job is completed. With the two approaches, Eagle can analyze single job’s trend, data skew problem, failure reasons etc. More interestingly, Eagle can analyze whole Hadoop cluster’s performance by taking into account all jobs.</p>
+ </li>
+</ul>
+
+<h3 id="node-anomaly-detection">Node Anomaly Detection</h3>
+
+<ul>
+ <li>
+ <p>One of practical benefits from analyzing map/reduce job is node anomaly detection. Big data platform like Hadoop may involve thousands of nodes for supporting multi-tenant jobs. One bad node may not crash whole cluster thanks to failure tolerance design, but may affect specific jobs and cause a lot of rescheduling, job delay and hurt stability of whole cluster etc.</p>
+ </li>
+ <li>
+ <p>Apache Eagle developed out-of-the-box algorithm to compare task failure ratio for each node in a large cluster. If one node continues to fail running tasks, it may have potential issues, sometimes one of its disks is full or fails etc. In a nutshell, if one node behaves very differently from all other nodes within one large cluster, this node is anomalous and we should take action.</p>
+ </li>
+</ul>
+
+<h3 id="cluster-performance-analytics">Cluster Performance Analytics</h3>
+
+<ul>
+ <li>
+ <p>It is critical to understand why a cluster performs bad. Is that because of some crazy jobs recently onboarded, or huge amount of tiny files, or namenode performance degrading?</p>
+ </li>
+ <li>
+ <p>Apache Eagle in realtime calculates resource usage per minute out of individual jobs, e.g. CPU, memory, HDFS IO bytes, HDFS IO numOps etc. and also collects namenode JMX metrics. Correlating them together will easily help system adminstrator find root cause for cluster slowness.</p>
+ </li>
+</ul>
+
+<h3 id="cluster-resource-usage-trend">Cluster Resource Usage Trend</h3>
+
+<ul>
+ <li>
+ <p>YARN manages resource allocation through queue in a large Hadoop cluster. Cluster resource usage is exactly reflected by overall queue usage.</p>
+ </li>
+ <li>
+ <p>Apache Eagle in realtime collects queue statistics and provide insights of cluster resource usage.</p>
+ </li>
+</ul>
+
+
+ </div><!--end of loadcontent-->
+ </div>
+ <!--end of centered content-->
+ </div>
+</div>
+<!--end of container-->
+
+<!-- footer start -->
+<div class="footerwrapper">
+ <div class="container">
+ <div class="row">
+ <div class="col-md-12"><div style="margin-left:auto; margin-right:auto; text-align:center;font-size: 12px">
+<div>
+Apache Eagle is an effort undergoing incubation at The Apache Software Foundation (ASF), sponsored by the Apache Incubator. Incubation is required of all newly accepted projects until a further review indicates that the infrastructure, communications, and decision making process have stabilized in a manner consistent with other successful ASF projects. While incubation status is not necessarily a reflection of the completeness or stability of the code, it does indicate that the project has yet to be fully endorsed by the ASF.
+</div>
+<div>
+<a href="http://www.apache.org">
+<img id="asf-logo" alt="Apache Software Foundation" src="/images/apache-logo-small.gif">
+</a>
+<a href="http://incubator.apache.org">
+<img id="incubator-logo" alt="Apache Incubator" src="/images/apache-incubator-logo-small.png">
+</a>
+</div>
+<div>
+Copyright © 2015 <a href="http://www.apache.org">The Apache Software Foundation</a>, Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.
+</div>
+<div>
+Apache Eagle, Eagle, Apache, the Apache feather logo, and the Apache Incubator project logo are trademarks of The Apache Software Foundation.
+</div>
+ </div></div>
+ </div>
+ </div>
+</div>
+<!-- footer end -->
+
+<!-- JavaScripts -->
+<script src="/js/jquery-1.11.1.min.js"></script>
+<script src="/js/jquery.singlePageNav.js"></script>
+<script src="/js/jquery.flexslider.js"></script>
+<script src="/js/modernizr.min.js"></script>
+<script src="/js/svg.js"></script>
+<script>
+ /************** FlexSlider *********************/
+ $('.flexslider').flexslider({
+ animation: "fade",
+ directionNav: false
+ });
+</script>
+
+<script>
+ /************** FlexSlider *********************/
+ $('.flexslider').flexslider({
+ animation: "fade",
+ directionNav: false
+ });
+</script>
+</body>
+</html>
Added: incubator/eagle/site/docs/user-profile-ml.html
URL: http://svn.apache.org/viewvc/incubator/eagle/site/docs/user-profile-ml.html?rev=1754217&view=auto
==============================================================================
--- incubator/eagle/site/docs/user-profile-ml.html (added)
+++ incubator/eagle/site/docs/user-profile-ml.html Wed Jul 27 05:48:44 2016
@@ -0,0 +1,292 @@
+<!DOCTYPE html>
+<head>
+ <meta charset="utf-8">
+ <meta http-equiv="X-UA-Compatible" content="IE=edge">
+
+ <title>Eagle - User Profile Machine Learning</title>
+ <meta name="description" content="Eagle - Analyze Big Data Platforms for Security and Performance">
+
+ <meta name="keywords" content="Eagle, Hadoop, Security, Real Time">
+ <meta name="author" content="eBay Inc.">
+
+ <meta charset="utf-8">
+ <meta name="viewport" content="initial-scale=1">
+
+ <link rel="stylesheet" href="/css/animate.css">
+ <link rel="stylesheet" href="/css/bootstrap.min.css">
+
+ <link rel="stylesheet" href="/css/font-awesome.min.css">
+
+ <link rel="stylesheet" href="/css/misc.css">
+ <link rel="stylesheet" href="/css/style.css">
+ <link rel="stylesheet" href="/css/styles.css">
+ <link rel="stylesheet" href="/css/main.css">
+ <link rel="alternate" type="application/rss+xml" title="Eagle" href="http://goeagle.io/feed.xml" />
+ <link rel="shortcut icon" href="/images/favicon.png">
+
+ <!-- Baidu Analytics Tracking-->
+ <script>
+ var _hmt = _hmt || [];
+ (function() {
+ var hm = document.createElement("script");
+ hm.src = "//hm.baidu.com/hm.js?fedc55df2ea52777a679192e8f849ece";
+ var s = document.getElementsByTagName("script")[0];
+ s.parentNode.insertBefore(hm, s);
+ })();
+ </script>
+
+ <!-- Google Analytics Tracking -->
+ <script>
+ (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
+ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
+ m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
+ })(window,document,'script','//www.google-analytics.com/analytics.js','ga');
+ ga('create', 'UA-68929805-1', 'auto');
+ ga('send', 'pageview');
+ </script>
+</head>
+<body>
+<!-- header start -->
+<div id="home_page">
+ <div class="topbar">
+ <div class="container">
+ <div class="row" >
+ <nav class="navbar navbar-default">
+ <div class="container-fluid">
+ <!-- Brand and toggle get grouped for better mobile display -->
+ <div class="navbar-header">
+ <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#bs-example-navbar-collapse-1"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button>
+ <a class="navbar-brand" href="/"><img src="/images/logo2.png" height="44px" style="margin-top:-7px"></a> </div>
+
+ <!-- Collect the nav links, forms, and other content for toggling -->
+ <!-- <div class="collapse navbar-collapse" id="bs-example-navbar-collapse-1">
+ <ul class="nav navbar-nav navbar-right" id="top-menu">
+ <li><a class="menu" href="/#home_page">HOME</a></li>
+ <li><a class="menu" href="/docs/">DOCS</a></li>
+ <li><a class="menu" href="/#about_page">ABOUT</a></li>
+ <li><a class="menu" href="/#diagram_page">ARCHITECTURE</a></li>
+ <li><a class="menu" href="/#modules_page">MODULES</a></li>
+ <li><a class="menu" href="/#usecase_page">USE CASES</a></li>
+ <li>
+ </li>
+ </ul> -->
+ </div>
+ </div>
+ <!-- /.container-fluid -->
+ </nav>
+ </div>
+ </div>
+ </div>
+ <div class="headerimage">
+ <div class="flexslider">
+ <ul class="slides">
+ <li><img src="/images/slider/4.jpg" alt="Slide 1"></li>
+ </ul>
+ </div>
+ </div>
+ <div class="particles" style="height:40%"> </div><!---particles-->
+ <div class="slider-caption" style="top:80px;">
+ <div class="homewrapper">
+ <div class="hometitle">
+ <a href="/">
+ <img src="/images/feather.png" height="80px">
+ </a>
+ </div>
+ <div class="hometext">
+ <h2>Analyze Big Data Platforms For Security and Performance</h2>
+ <div class="social-buttons">
+ <!-- <a href="https://github.com/ebay/eagle"><i class="fa fa-github"></i></a>
+ <a href="http://twitter.com/TheApacheEagle"><i class="fa fa-twitter"></i></a>
+ <a href="https://www.facebook.com/TheApacheEagle/"><i class="fa fa-facebook"></i></a>
+ <a href="#"><i class="fa fa-weixin"></i></a> -->
+ <!-- <a href="https://www.weibo.com/ApacheEagle/"><i class="fa fa-weibo"></i></a> -->
+ </div>
+ </div>
+ </div>
+ </div>
+</div>
+<!-- header end -->
+<div class="container-fluid page-content">
+ <a href="https://github.com/apache/incubator-eagle" target="_blank"><img style="z-index:10000;position: fixed; top: 0; right: 0; border: 0;" src="https://camo.githubusercontent.com/365986a132ccd6a44c23a9169022c0b5c890c387/68747470733a2f2f73332e616d617a6f6e6177732e636f6d2f6769746875622f726962626f6e732f666f726b6d655f72696768745f7265645f6161303030302e706e67" alt="Fork eagle on GitHub" data-canonical-src="https://s3.amazonaws.com/github/ribbons/forkme_right_red_aa0000.png"></a>
+
+ <div class="row">
+ <div class="col-md-10 col-md-offset-1">
+ <!-- sidebar -->
+ <div class="col-xs-6 col-sm-3" id="sidebar" role="navigation">
+ <ul class="nav" id="adminnav">
+
+ <li class="heading">Getting Started</li>
+
+ <li class="sidenavli "><a href="/docs/index.html" data-permalink="/docs/user-profile-ml.html" id="">Introduction</a></li>
+
+ <li class="sidenavli "><a href="/docs/usecases.html" data-permalink="/docs/user-profile-ml.html" id="">Use Cases</a></li>
+
+ <li class="sidenavli "><a href="/docs/terminology.html" data-permalink="/docs/user-profile-ml.html" id="">Terminology</a></li>
+
+ <li class="sidenavli "><a href="/docs/ecosystem.html" data-permalink="/docs/user-profile-ml.html" id="">Ecosystem</a></li>
+
+ <li class="sidenavli "><a href="/docs/community.html" data-permalink="/docs/user-profile-ml.html" id="">Community</a></li>
+
+ <li class="sidenavli "><a href="/docs/FAQ.html" data-permalink="/docs/user-profile-ml.html" id="">FAQ</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Download</li>
+
+ <li class="sidenavli "><a href="/docs/download-0.4.0.html" data-permalink="/docs/user-profile-ml.html" id="">Latest version</a></li>
+
+ <li class="sidenavli "><a href="/docs/download.html" data-permalink="/docs/user-profile-ml.html" id="">Archived</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Installation</li>
+
+ <li class="sidenavli "><a href="/docs/quick-start.html" data-permalink="/docs/user-profile-ml.html" id="">Get Started with Sandbox</a></li>
+
+ <li class="sidenavli "><a href="/docs/deployment-in-docker.html" data-permalink="/docs/user-profile-ml.html" id="">Get Started with Docker</a></li>
+
+ <li class="sidenavli "><a href="/docs/deployment-env.html" data-permalink="/docs/user-profile-ml.html" id="">Setup Environment</a></li>
+
+ <li class="sidenavli "><a href="/docs/deployment-in-production.html" data-permalink="/docs/user-profile-ml.html" id="">Setup Eagle in Production</a></li>
+
+ <li class="sidenavli "><a href="/docs/configuration.html" data-permalink="/docs/user-profile-ml.html" id="">Eagle Topology Configuration</a></li>
+
+ <li class="sidenavli "><a href="/docs/serviceconfiguration.html" data-permalink="/docs/user-profile-ml.html" id="">Eagle Service Configuration</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/ldap.html" data-permalink="/docs/user-profile-ml.html" id="">Eagle LDAP Authentication</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Tutorial</li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/setup.html" data-permalink="/docs/user-profile-ml.html" id="">Site Management</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/policy.html" data-permalink="/docs/user-profile-ml.html" id="">Policy Management</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/policy-capabilities.html" data-permalink="/docs/user-profile-ml.html" id="">Policy Engine Capabilities</a></li>
+
+ <li class="sidenavli "><a href="/docs/hdfs-data-activity-monitoring.html" data-permalink="/docs/user-profile-ml.html" id="">HDFS Data Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/hive-query-activity-monitoring.html" data-permalink="/docs/user-profile-ml.html" id="">HIVE Query Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/hbase-data-activity-monitoring.html" data-permalink="/docs/user-profile-ml.html" id="">HBASE Data Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/mapr-integration.html" data-permalink="/docs/user-profile-ml.html" id="">MapR FS Data Activity Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/jmx-metric-monitoring.html" data-permalink="/docs/user-profile-ml.html" id="">Hadoop JMX Metrics Monitoring</a></li>
+
+ <li class="sidenavli "><a href="/docs/import-hdfs-auditLog.html" data-permalink="/docs/user-profile-ml.html" id="">Stream HDFS audit logs into Kafka</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/userprofile.html" data-permalink="/docs/user-profile-ml.html" id="">User Profile Feature</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/classification.html" data-permalink="/docs/user-profile-ml.html" id="">Data Classification Feature</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/topologymanagement.html" data-permalink="/docs/user-profile-ml.html" id="">Topology Management Feature</a></li>
+
+ <li class="sidenavli "><a href="/docs/tutorial/notificationplugin.html" data-permalink="/docs/user-profile-ml.html" id="">Alert Notification Plugin</a></li>
+
+ <li class="sidenavli "><a href="/docs/metadata-api.html" data-permalink="/docs/user-profile-ml.html" id="">Metadata RESTful API</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Development Guide</li>
+
+ <li class="sidenavli "><a href="/docs/development-quick-guide.html" data-permalink="/docs/user-profile-ml.html" id="">Development Quick Guide</a></li>
+
+ <li class="sidenavli "><a href="/docs/development-in-macosx.html" data-permalink="/docs/user-profile-ml.html" id="">Development in Mac OSX</a></li>
+
+ <li class="sidenavli "><a href="/docs/development-in-intellij.html" data-permalink="/docs/user-profile-ml.html" id="">Development in Intellij</a></li>
+
+ <li class="divider"></li>
+
+ <li class="heading">Advanced</li>
+
+ <li class="sidenavli current"><a href="/docs/user-profile-ml.html" data-permalink="/docs/user-profile-ml.html" id="">User Profile Machine Learning</a></li>
+
+ <li class="divider"></li>
+
+ <li class="sidenavli">
+ <a href="mailto:dev@eagle.incubator.apache.org" target="_blank">Need Help?</a>
+ </li>
+ </ul>
+ </div>
+ <div class="col-xs-6 col-sm-9 page-main-content" style="margin-left: -15px" id="loadcontent">
+ <h1 class="page-header" style="margin-top: 0px">User Profile Machine Learning</h1>
+ <p>Apache Eagle (incubating, called Eagle in the following) provides capabilities to define user activity patterns or user profiles for Hadoop users based on the user behavior in the platform. The idea is to provide anomaly detection capability without setting hard thresholds in the system. The user profiles generated by our system are modeled using machine-learning algorithms and used for detection of anomalous user activities, where users’ activity pattern differs from their pattern history. Currently Eagle uses two algorithms for anomaly detection: Eigen-Value Decomposition and Density Estimation. The algorithms read data from HDFS audit logs, slice and dice data, and generate models for each user in the system. Once models are generated, Eagle uses the Storm framework for near-real-time anomaly detection to determine if current user activities are suspicious or not with respect to their model. The block diagram below shows the current pipeline for user profile train
ing and online detection.</p>
+
+<p><img src="/images/docs/userprofile-arch.png" alt="" /></p>
+
+<p>Eagle online anomaly detection uses the Eagle policy framework, and the user profile is defined as one of the policies in the system. The user profile policy is evaluated by a machine-learning evaluator extended from the Eagle policy evaluator. Policy definition includes the features that are needed for anomaly detection (same as the ones used for training purposes).</p>
+
+<p>A scheduler runs a Spark-based offline training program (to generate user profiles or models) at a configurable time interval; currently, the training program generates new models once every month.</p>
+
+<p>The following are some details on the algorithms.</p>
+
+<ul>
+ <li><strong>Density Estimation</strong>: In this algorithm, the idea is to evaluate, for each user, a probability density function from the observed training data sample. We mean-normalize a training dataset for each feature. Normalization allows datasets to be on the same scale. In our probability density estimation, we use a Gaussian distribution function as the method for computing probability density. Features are conditionally independent of one another; therefore, the final Gaussian probability density can be computed by factorizing each feature’s probability density. During the online detection phase, we compute the probability of a user’s activity. If the probability of the user performing the activity is below threshold (determined from the training program, using a method called Mathews Correlation Coefficient), we signal anomaly alerts.</li>
+ <li><strong>Eigen-Value Decomposition</strong>: Our goal in user profile generation is to find interesting behavioral patterns for users. One way to achieve that goal is to consider a combination of features and see how each one influences the others. When the data volume is large, which is generally the case for us, abnormal patterns among features may go unnoticed due to the huge number of normal patterns. As normal behavioral patterns can lie within very low-dimensional subspace, we can potentially reduce the dimension of the dataset to better understand the user behavior pattern. This method also reduces noise, if any, in the training dataset. Based on the amount of variance of the data we maintain for a user, which is usually 95% for our case, we seek to find the number of principal components k that represents 95% variance. We consider first k principal components as normal subspace for the user. The remaining (n-k) principal components are considered as abnormal subspace.</
li>
+</ul>
+
+<p>During online anomaly detection, if the user behavior lies near normal subspace, we consider the behavior to be normal. On the other hand, if the user behavior lies near the abnormal subspace, we raise an alarm as we believe usual user behavior should generally fall within normal subspace. We use the Euclidian distance method to compute whether a user’s current activity is near normal or abnormal subspace.</p>
+
+<p><img src="/images/docs/userprofile-model.png" alt="" /></p>
+
+
+ </div><!--end of loadcontent-->
+ </div>
+ <!--end of centered content-->
+ </div>
+</div>
+<!--end of container-->
+
+<!-- footer start -->
+<div class="footerwrapper">
+ <div class="container">
+ <div class="row">
+ <div class="col-md-12"><div style="margin-left:auto; margin-right:auto; text-align:center;font-size: 12px">
+<div>
+Apache Eagle is an effort undergoing incubation at The Apache Software Foundation (ASF), sponsored by the Apache Incubator. Incubation is required of all newly accepted projects until a further review indicates that the infrastructure, communications, and decision making process have stabilized in a manner consistent with other successful ASF projects. While incubation status is not necessarily a reflection of the completeness or stability of the code, it does indicate that the project has yet to be fully endorsed by the ASF.
+</div>
+<div>
+<a href="http://www.apache.org">
+<img id="asf-logo" alt="Apache Software Foundation" src="/images/apache-logo-small.gif">
+</a>
+<a href="http://incubator.apache.org">
+<img id="incubator-logo" alt="Apache Incubator" src="/images/apache-incubator-logo-small.png">
+</a>
+</div>
+<div>
+Copyright © 2015 <a href="http://www.apache.org">The Apache Software Foundation</a>, Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.
+</div>
+<div>
+Apache Eagle, Eagle, Apache, the Apache feather logo, and the Apache Incubator project logo are trademarks of The Apache Software Foundation.
+</div>
+ </div></div>
+ </div>
+ </div>
+</div>
+<!-- footer end -->
+
+<!-- JavaScripts -->
+<script src="/js/jquery-1.11.1.min.js"></script>
+<script src="/js/jquery.singlePageNav.js"></script>
+<script src="/js/jquery.flexslider.js"></script>
+<script src="/js/modernizr.min.js"></script>
+<script src="/js/svg.js"></script>
+<script>
+ /************** FlexSlider *********************/
+ $('.flexslider').flexslider({
+ animation: "fade",
+ directionNav: false
+ });
+</script>
+
+<script>
+ /************** FlexSlider *********************/
+ $('.flexslider').flexslider({
+ animation: "fade",
+ directionNav: false
+ });
+</script>
+</body>
+</html>