Combining Man & Machine: A Glimpse into the Future - David Meyer
- 1. © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 2016 FEDERALFORUM Presented by Produced by Intelligent Networking in the Modern Age: Brocade’s Approach to Machine Learning for Networking
- 2. © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION You might be surprised but what is going to drive innovation in the enterprise and in the public cloud is machine learning.
- 3. Agenda • What Is Machine Learning? • What Is All the Machine Learning Excitement About? • Brocade’s Approach to Machine Learning • Overview of Our Demo: Open Network Insight • Technical Explanations/Code – http://www.1-4-5.net/~dmm/ml © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 3
- 4. First, What Is Machine Learning? • Said another way, we want to discover the Data Generating Distribution that underlies the data we observe. This is the function that we want to learn. • Moreover, we care about primarily about the generalization accuracy of our model (function) – Accuracy on examples we have not yet seen -- How can this be? – As opposed the accuracy on the training set (note: overfitting) The complexity in traditional computer programming is in the code (programs that people write). In machine learning, learning algorithms are in principle simple and the complexity (structure) is in the data. Is there a way that we can automatically learn that structure? That is what is at the heart of machine learning. Andrew Ng © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 4
- 5. Data Program Output Traditional Programming Same Thing Said in Cartoon Form Computer Data Output Machine Learning Computer © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 5
- 6. Ok, We Know That Machines Are Getting Smarter, But Where Does Knowledge Come From? EXPERIENCEEVOLUTION CULTURE MACHINES Many orders of magnitude faster and larger So how can machines discover new knowledge? © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 6
- 7. How Machines Can Discover New Knowledge? These correspond to the 5 major schools of thought in machine learning Systematically reduce uncertainty. • Bayesians • Technology: Bayesian Inference Fill the gaps in existing knowledge. • Symbolists • Technology: Induction/Inverse Deduction Emulate the brain. • Connectionists • Technology: Deep Neural Nets Emulate evolution. • Evolutionaries • Technology: Genetic Algorithms Notice similarities between old and new. • Analogizers • Technology: Kernel Machines/Support Vector Machines © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 7
- 8. Agenda • What Is Machine Learning? • What Is All the Machine Learning Excitement About? • Brocade’s Approach to Machine Learning • Overview of Our Demo: Open Network Insight • Technical Explanations/Code – http://www.1-4-5.net/~dmm/ml © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 8
- 9. What Is All the ML Excitement About? ML applications you interact with everyday Why this is relevant: Compute, Storage, Networking, Security, and Energy (CSNSE) use cases will all use this technology © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 9
- 10. BTW, Think Object Recognition Is Impressive? © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 10
- 11. Lip Reading? © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 11
- 12. Real-Time Language Translation © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 12
- 13. One More © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 13
- 14. So What Kinds of Network Use Cases Are We Working On? • Security/Anomaly Detection • NFV orchestration and optimization • New automation tools for DevOps • Predicting and remediating problems in the mobile network • Network control plane optimization • Capture operator/analyst intuition • ... © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 14
- 15. Example: Using Flow Data for Anomaly Detection Linear Decision Boundary Generalization Graph Radial Nested Block State Model with Edge Bundling General Anomaly Detection Setting DNS Tunneling © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 15
- 16. Agenda • What Is Machine Learning? • What Is All the Machine Learning Excitement About? • Brocade’s Approach to Machine Learning • Overview of Our Demo: Open Network Insight • Technical Explanations/Code – http://www.1-4-5.net/~dmm/ml © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 16
- 17. Pushing the Boundaries: Brocade’s Approach Bringing deep reinforcement learning to networking Reinforcement learning meets Deep Learning and Monte Carlo Tree Search © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 17
- 18. Static Architecture vs. Reinforcement Architecture • ML doesn’t have “agency” • Hard-coded or open loop control • Doesn’t learn control • Assumes static underlying distribution Static ML Architecture Reinforcement Learning Architecture • Agent architecture • Agent learns control/action selection • Adapts to evolving environment • Network gamification Knowledge Human Decision Intent Language Automatic Decision Machine Learning SDN Controller Forwarding Elements Analytics Platform Reward Observation Environment Action © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 18
- 19. Reinforcement Learning Example Reinforcement Learning Setup Reinforcement Learning Example • Rules of the game are unknown • No supervisor, only a reward signal • Feedback is delayed • Agent’s actions affect the subsequent data it receives Agent State Observation Reward Action Environmental State © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 19
- 20. Drilling Down Just a Bit © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 20
- 21. Why Is AlphaGo Important/Relevant? • Security: Agent can learn dynamic/evolving behavior of adversary • DevOPs: Agent can learn workflow automation (e.g., Openstack Mistral/StackStorm) • NFV: Agent can learn dynamic behavior of VNFs • General: Deep learning can capture human intuition © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 21
- 22. Brocade’s Approach to Machine Learning Bringing rigor to ML for Networking Clustering • Categorical and continuous (e.g., LDA, K-means, …) • Anomaly detection © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 22
- 23. Brocade’s Approach to Machine Learning Bringing rigor to ML for Networking Clustering • Categorical and continuous (e.g., LDA, K-means, …) • Anomaly detection Deep Neural Networks • Understand sequences such as network flows • Capture expert intuition • Recurrent/memory nets (LSTMs, NTMs, ...) • Time series/long range dependencies © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 23
- 24. Brocade’s Approach to Machine Learning Bringing rigor to ML for Networking Clustering • Categorical and continuous (e.g., LDA, K-means, …) • Anomaly detection Deep Neural Networks • Understand sequences such as network flows • Capture expert intuition • Recurrent/memory nets (LSTMs, NTMs, ...) • Time series/long range dependencies Reinforcement Learning • Give Machine Learning agency – Learn feedback control of actions • Non-stationary distributions • Deep neural networks (value/policy networks) • Understand/react in adversarial environments © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 24
- 25. Brocade’s Approach to Machine Learning Bringing rigor to ML for Networking Clustering • Categorical and continuous (e.g., LDA, K-means, …) • Anomaly detection Deep Neural Networks • Understand sequences such as network flows • Capture expert intuition • Recurrent/memory nets (LSTMs, NTMs, ...) • Time series/long range dependencies Reinforcement Learning • Give Machine Learning agency – Learn feedback control of actions • Non-stationary distributions • Deep neural networks (value/policy networks) • Understand/react in adversarial environments Standardized (and public) data sets • Required to evaluate techniques • Move the field forward – e.g. MNIST , ImageNet, … © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 25
- 26. Agenda • What Is Machine Learning? • What Is All the Machine Learning Excitement About? • Brocade’s Approach to Machine Learning • Overview of Our Demo: Open Network Insight • Technical Explanations/Code – http://www.1-4-5.net/~dmm/ml © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 26
- 27. Brocade Machine Learning Partnerships Intel Security/Cloudera • Open Network Insight – http://open-network-insight.org/ – https://github.com/Open-Network-Insight • Anomaly Detection for Network Data • Goal: Leverage flow and other packet data to help enterprises and service providers gain insight into events in their compute environments and identify potential security threats – In particular, DNS PCAP and netflow data • Uses Topic Modeling is used to cluster categorical data – A low probability flow in a cluster (topic) is an anomaly © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 27
- 28. BTW, What Exactly Is Anomaly Detection? • It is clear that one of the major challenges we face as a civilization is dealing with deluge of data that are being collected from our networks – While at the same time we are “knowledge starved” – Can’t find the needles in an exponentially growing haystack – Anomaly Detection is one piece of the puzzle – Machine Learning is a fundamental part of the answer • Key Assumption for Anomaly Detection – Anomalous events occur relatively infrequently (alternatively: most events normal) – Second order assumption: Common events follow a Gaussian distribution (likely to be wrong) • What is obvious: When anomalous events do occur, their consequences can be quite serious and often have substantial negative impact on our businesses, security, … © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 28
- 29. Open Network Insight Components Anomaly detection for network data http://open-network-insight.org/ Network Flows (nfcapd) DNS (pcap) Parallel Ingest Framework Machine Learning Operational Analytics • Sensors feed ONI • Filters billions to thousands • Baseline not required • Unsupervised, no rules required • Open Source Decoders • Creates CSV & compressed data in HDFS • Returns small number of credible threats from machine learning • Visualization, Noise Filter, Attack Heuristics Open Network Insight uses machine learning as a filter to detect anomalies and to characterize the unique behavior of network traffic © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 29
- 30. Brocade Data Fabric and Open Network Insight Demo deployment GRAPHIC COURTESY VARMA BHUPATIRAJU Data Fabric ONI Ingest Data Fabric Consumer ONI ML ONI OA Cloudera Enterprise Data Hub (EDH) Kafka Brocade Data Fabric and Open Network Insight Deployment Network © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 30
- 31. Don’t Miss Our Demo Brocade Data Fabric Enabling Real Time Data Ingestion by Open Network Insight © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION 31
- 32. © 2016 BROCADE COMMUNICATIONS SYSTEMS, INC. COMPANY PROPRIETARY INFORMATION Thank you