CTHIOT-1010.Pdf

Making Sense of Data with Machine Reasoning

Samer Salam Principal Engineer, Cisco CHTIOT-1010 Cisco Spark

Questions? Use Cisco Spark to communicate with the speaker after the session

How 1. Find this session in the Cisco Live Mobile App 2. Click “Join the Discussion” 3. Install Spark or go directly to the space 4. Enter messages/questions in the space

Cisco Spark spaces will be cs.co/ciscolivebot#CHTIOT-1010 available until July 3, 2017.

• Introduction

• Climbing the Data Chain: Machine Reasoning Primer

• Use-Cases

• Conclusion Introduction Introduction Challenges in Network & IT Operations

Over 50% of network outages from human factors Orchestration ERRORS

Virtualization driving an explosion in data to be managed Controller / NMS / EMS

Service activation too slow with humans in the loop

Smart “things” connecting to network providing myriad of new data

Paradigm shift: manage system at operator desired level of abstraction

CLI API GUI Easy Button

Network Business APP Applications … Applications Machine Reasoning Machine Learning

Device Data Abstraction Base Service Controller APIs Application Communication & Models Functions Layer Services

Laptop

TP Manager Viewpoint

Switch IoT

SDN Viewpoint SDN Network Router Things Devices IP Phone Printer

Call Manager Firewall

Web Server Server Farm WLC Telepresence

Getting Machine Answers Intelligence

Building the Knowledge

Enriching with Context

Network Data + Understanding the Data Endpoint Meta-Data + Collecting the Application Data Meta-Data [DIKW Pyramid]

CHTIOT-1010 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 8 Climbing the Data Chain: Machine Reasoning Primer Establishing Common Understanding Vocabulary Getting Answers • Did you say “IP Address” ?

Building the Knowledge

Enriching with Context

Understanding • Machine vocabulary is defined using: the Data • Resources, i.e. identified things, that have Uniform Resource Identifiers (URIs) • Literals that have concrete values, and types (also identified by URIs) Collecting the Data Human Vocabulary Machine Vocabulary

Concept or Thing Resource

Resource Description Framework (RDF) Getting Answers • Going from words (URIs) to sentences (Statements) with RDF Triples

< Subject , Predicate , Object > Building the Knowledge isPartOf Linecard Router

Enriching with Context Resource Resource

Understanding the Data hasAddress Interface 10.10.10.1

Collecting the Data Resource Literal

Human Vocabulary Machine Vocabulary

Sentences RDF Statements (Triples)

Resource Description Framework Schema (RDFS) Getting Answers Defines constructs to describe things (Resources):

• Building the Properties: the relationships between things Knowledge • E.g.: isPartOf, hasAddress

• Classes: the buckets used to group the things Enriching with Context • E.g.: Routers = {ASR1K, ASR9K}, Switches = {Cat9K, N7K}

Understanding the Data

Collecting the Human Vocabulary Machine Vocabulary Data

Relationships between Properties things Buckets to group things Classes

Linking Statements Getting Answers • Subject of one Statement can be the Object of another, thereby

establishing context Building the Knowledge SFO-ASR9K NYC-ASR9K X Enriching with Gig1/1/1 (10.140.10.3) Gig2/2/1 (10.140.10.1) Context

Subject Predicate Object Understanding SFO-ASR9K hasInterface Gig1/1/1 the Data NYC-ASR9K hasInterface Gig2/2/1

Gig1/1/1 hasAddress 10.140.10.3 Collecting the Data Gig2/2/1 hasAddress 10.140.10.1 Gig1/1/1 isConnectedTo Gig2/2/1 Gig1/1/1 hasLineProtocolState Down

Web Ontology Language (OWL) Getting Answers On・tol・o・gy Building the Knowledge Formal definition and classification of concepts / entities, and the relationships between them in a specific knowledge domain Enriching with Context

• OWL extends RDF with semantics: Understanding the Data • Relationships between Classes: disjointWith, complementOf • Equality: sameAs, equivalentClass Collecting the • Richer Properties: symmetric, transitive, inverseOf Data • Class Property Restrictions: define Class members based on their Properties

Building the These constructs allow a Knowledge machine to express and make sense of first order Enriching with logic: Context

• All BGP speakers listen on

TCP port 179. Understanding the Data • Router1 is a BGP speaker.

-2 • Therefore, Router1 must listen Collecting the on TCP port 179. Data -1 (Super) Class Individual (Sub) Class CHTIOT-1010 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 15 Adding Rules

Semantic Web Rule Language (SWRL) Getting Answers • Support for rules, expressed in terms of OWL concepts, to provide

more powerful deductive reasoning capabilities than OWL alone Building the Knowledge • Example: If two interfaces have the same IP Address and the same VRF, then these interfaces have duplicate address Enriching with Context

Interface(?interface1)⌃hasIPAddress(?interface1, ?ip1)⌃hasVRF(?interface1, ?vrf1)⌃ Understanding Interface(?interface2)⌃hasIPAddress(?interface2, ?ip2)⌃hasVRF(?interface2, ?vrf2)⌃ the Data differentFrom(?interface1, ?interface2)⌃equal(?ip1,?ip2)⌃equal(?vrf1,?vrf2)  hasDuplicateAddress(?interface1, ?interface2) Collecting the Data

Inference with Semantic Reasoners Getting Answers • Create new triples based on existing triples by evaluating SWRL rules

and OWL relationships / restrictions Building the Knowledge • Deduce new (inferred) facts based on the stated (asserted) facts

Enriching with Context

hasIPAddress hasInterface Gig1/0 SFO-ASR9K Understanding 161.44.210.117 hasVRF the Data

Inference by the

BlueVRF Reasoner Collecting the Data hasVRF hasDuplicateAddress

hasIPAddress Eth3/2 NYC-ASR9K hasInterface

SPARQL Getting Answers • Walking (querying) the knowledge graph results in “answers”

Building the • SPARQL is to a knowledge base what SQL is to a relational database Knowledge

• Example: Which two routers have duplicate addresses? Enriching with Context

SELECT ?router1, ?router2 Understanding WHERE { the Data ?router1 hasInterface ?interface1.

Collecting the ?router2 hasInterface ?interface2. Data ?interface1 hasDuplicateAddress ?interface2. }

Network Troubleshooting • Mechanize logic that is currently in CCIE & engineers’ brains. Automation • Example: Traffic black hole root-cause determination

• Detect Network control/data plane anomalies. Anomaly Detection • Example: Analyze in-band OAM data (loss, end-to-end delay, per-hop delay) to detect anomaly

• Resolve inconsistency between network devices, or between network devices & Domain/Element controller automatically. Consistency • Example: Verify IGP/BGP configuration matches between PEs

• Monitor network state proactively, analyze data streams, identify faults and Fault Analysis & correlate with applications. Correlation • Example: Fault impact analysis on multicast video streams

• Build custom network operation workflows without requiring any programming Build Your Own Workflow language • Example: Ability to program the network with simple GUI

Knowledge Engineering Technology Axioms Best Practices

Algorithms / Workflows Business Goals / Policies

Conflict Root Cause Consistency Detection Analysis Checking

Conflict Remedy Consistency Resolution Identification Enforcement

Information Ontologies Reasoning Actionable Inferences Knowledge Generation & Analysis Remedial Operator APIs Action Alert

Data Actions Insights Recommendations

Network / System

Human Applications

User Interface & Applications

Getting Semantic Reasoner Answers

Rules: SWRL Building the Ontologies: OWL Knowledge Querying: SPARQL Taxonomies: RDFS Enriching with Context Schema Neutral Data Interchange: RDF

Normalized Syntax & Schema Dependent Data Interchange: MIB, YANG, XSD Understanding the Data Syntax: SMIv2, XML, JSON, Natural Language (CLI)

Character Set: Unicode, Collecting the Identifiers: OIDs, URIs… UTF8… Data

• Give us your feedback to be entered into a Daily Survey Drawing. A daily winner will receive a $750 gift card. • Complete your session surveys through the Cisco Live mobile app or on www.CiscoLive.com/us.

Don’t forget: Cisco Live sessions will be available for viewing on demand after the event at www.CiscoLive.com/Online.

• Demos in the Cisco campus

• Walk-in Self-Paced Labs

• Lunch & Learn

• Meet the Engineer 1:1 meetings

• Related sessions