The Big Data revolution promises to build a data-driven ecosystem where better decisions are supported by enhanced analytics and data management.However, major hurdles still need to be overcome on the road that leads to commoditization and wide adoption of Big Data Analytics (BDA).Big Data complexity is the first factor hampering the full potential of BDA.The opacity and variety of Big Data technologies and computations, in fact, make BDA a failure prone and resource-intensive process, which requires a trial-and-error approach.This problem is even exacerbated by the fact that current solutions to Big Data application development take a bottom-up approach, where the last technology release drives application development.Selection of the best Big Data platform, as well as of the best pipeline to execute analytics, represents then a deal breaker.In this paper, we propose a return to roots by defining a Model-Driven Engineering (MDE) methodology that supports automation of BDA based on model specification.Our approach lets customers declare requirements to be achieved by an abstract Big Data platform and smart engines deploy the Big Data pipeline carrying out the analytics on a specific instance of such platform.Driven by customers' requirements, our methodology is based on an OWL-S ontology of Big Data services and on a compiler transforming OWL-S service compositions in workflows that can be directly executed on the selected platform.The proposal is experimentally evaluated in a real-world scenario focusing on the threat detection system of SAP.

Intrusion detection systems (IDS) look for digital patterns mainly over the network or host traffic. Increasing complexity of todays enterprise information systems (EIS) obliges enterprises to deploy multiple but yet isolated IDSs in their IT boundaries, namely in, network (NIDS), host (HIDS), DMZs and application (appIDS). Modern exploits being able to disguise may appear innocent from an individual IDS perspective, however, its maliciousness could be detected from an end to end application perspective. One of the core problems in this regard is the inability of detecting such end to end targeted attacks whose functional scopes may stretch across IT boundaries. In this paper, we first argue that complex end to end intrusions can be detected in real time by analyzing application level logs originating from various IT boundaries (network, proxy, web server, OS, application etc.). We propose an attack pattern framework for EIS that enables an appIDS, such as SAP Enterprise Threat Detection (ETD) [1], to perform log analysis simultaneously from multiple sources. The framework includes a reference architecture and its prototypical implementation can be the core engine of an appIDS. It also provides an attack pattern specification language and associated methodology for managing attack pattern lifecycle and appropriate alert mitigation response.