Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Semelhante a Machine Learning + Analytics
Semelhante a Machine Learning + Analytics (20)
Mais de Splunk
Mais de Splunk (20)
Último
Último (20)
Machine Learning + Analytics
- 1. Copyright © 2015 Splunk Inc. Operationalizing Machine Learning Kelly Feagans Sr. Sales Engineer Splunk, Inc.
- 4. Copyright © 2016 Splunk Inc. • Kelly Feagans – Data Centurion, Splunk Sr. Engineer, Splunk Transparency Maint. Engineer • ITOps Background • Vendor enabled (dark side) in 2000 • Previous Work: Network architecture & capacity planning, Infrastructure Compliance & Security • NOT a Ph.D. in Math nor Stats • (please be nice) • Star Wars over Star Trek (better weapons)
- 6. Copyright © 2016 Splunk Inc. Historical Data Real-time Data Statistical Models DB, HDFS, NoSQL, Splunk, etc Machine Learning T – a few days T + a few days Why is this so challenging using traditional methods? • DATA IS STILL IN MOTION, still in a BUSINESS PROCESS. • Enrich real-time MACHINE DATA with structured HISTORICAL DATA • Make decisions IN REAL TIME using ALL THE DATA Splunk Security Operations Center Network Operations Center Business Operations Center
- 8. 8 Machine Learning 101: What is it? • Machine Learning is a process for generalizing from examples – Examples = example or “training” data – Generalizing = building “statistical models” to capture correlations – Process = never quite done, we keep validating & refitting models for increasing accuracy • Simple Machine Learning workflow: – Explore data – FIT models based on data – APPLY models in production – Keep validating models “All models are wrong, but some are useful.”
- 9. 9 Three Types of Machine Learning 1. Supervised Learning: generalizing from labeled data OR? Gather data: • Dimensions • Stem Length • Color • Etc.
- 10. 10 Three Types of Machine Learning 2. Unsupervised Learning: generalizing from unlabeled data Will my home sell? Gather data: • Square feet • Levels • Parks nearby • Schools • Zipcode • Etc.
- 13. 13 IT Ops: Predictive Maintenance 1. Get resource usage data (CPU, latency, outage reports) 2. Explore data, and fit predictive models on past / real-time data 3. Apply & validate models until predictions are accurate 4. Forecast resource saturation, demand & usage 5. Surface incidents to IT Ops, who INVESTIGATES & ACTS Problem: Network outages and truck rolls cause big time & money expense Solution: Build predictive model to forecast outage scenarios, act pre-emptively & learn
- 14. 14 Security: Find Insider Threats Problem: Security breaches cause big time & money expense Solution: Build predictive model to forecast threat scenarios, act pre-emptively & learn 1. Get security data (data transfers, authentication, incidents) 2. Explore data, and fit predictive models on past / real-time data 3. Apply & validate models until predictions are accurate 4. Forecast abnormal behavior, risk scores & notable events 5. Surface incidents to Security Ops, who INVESTIGATES & ACTS
- 15. 15 Business Analytics: Predict Customer Churn Problem: Customer churn causes big time & money expense Solution: Build predictive model to forecast possible churn, act pre-emptively & learn 1. Get customer data (set-top boxes, web logs, transaction history) 2. Explore data, and fit predictive models on past / real-time data 3. Apply & validate models until predictions are accurate 4. Identify customers likely to churn 5. Surface incidents to Business Ops, who INVESTIGATES & ACTS
- 16. 16 Summary: The Machine Learning Process Problem: <Stuff in the world> causes big time & money expense Solution: Build predictive model to forecast <possible incidents>, act pre-emptively & learn 1. Get all relevant data to problem 2. Explore data, and fit predictive models on past / real-time data 3. Apply & validate models until predictions are accurate 4. Forecast KPIs & metrics associated to use case 5. Surface incidents to X Ops, who INVESTIGATES & ACTS Operationalize
- 18. 18 Analysts Business Users 1. Get Data & Find Decision-Makers! 1 IT Users ODBC SDK API DB Connect Look-Ups Ad Hoc Search Monitor and Alert Reports / Analyze Custom Dashboards GPS / Cellular Devices Networks Hadoop Servers Applications Online Shopping Carts Analysts Business Users Structured Data Sources CRM ERP HR Billing Product Finance Data Warehouse Clickstreams
- 19. 19 2. Explore Data, Build Searches & Dashboards • Start with the Exploratory Data Analysis phase – “80% of data science is sourcing, cleaning, and preparing the data” • For each data source, build “data diagnostic” dashboard – What’s interesting? Throw up some basic charts. – What’s relevant for this use case? – Any anomalies? Are thresholds useful? • Mix data streams & compute aggregates – Compute KPIs & statistics w/ stats, eventstats, etc. – Enrich data streams with useful structured data – stats count by X Y – where X,Y from different sources
- 20. 20 3. Get the ML Toolkit & Showcase App • Get the App! https://splunkbase.splunk.com/app/2890 • Leverages Python for Scientific Computing (PSC) add-on: – Open-source Python data science ecosystem – NumPy, SciPy, scitkit-learn, pandas, statsmodels • Showcase use cases: Hard Drive Failure, Server Power consumption, Server Response Time, Application Usage • Standard algorithms out of the box: – Supervised: Logistic Regression, SVM, Linear Regression, Random Forest – Unsupervised: KMeans, DBSCAN, Spectral Clustering • Implement one of 300+ algorithms by editing Python scripts
- 21. 21 4. Fit, Apply & Validate Models • Machine Learning SPL – New grammar for doing ML in Splunk • fit – fit models based on training data – [training data] | fit LinearRegression costly_KPI from feature1 feature2 feature3 into my_model • apply – apply models on testing and production data – [testing/production data] | apply my_model • Validate Your Model (The Hard Part) – Why hard? Because statistics is hard! Also: model error ≠ real world risk. – Analyze residuals, mean-square error, goodness of fit, cross-validate, etc. – Take Splunk’s Analytics & Data Science Education course
- 22. 22 5. Operationalize Your Models • Remember the ML Process: 1. Get data 2. Explore data & fit models 3. Apply & validate models 4. Forecast KPIs 5. Surface incidents to Ops team • Then operationalize: feed back Ops analysis to data inputs, repeat • Be patient, this takes time, but lots of value will come out. Operationalize
- 24. 24 Sneak Peak Recap: What’s new in GA • New Algorithms (Random Forest, Lasso, Kernel PCA, and more…) • More use cases to explore • Support added for Search Head Clustering • Removed 50k limit on model fitting • Sampling for training/test data • Guided ML via a ML Assistant aka Model / Query Builder • Install on 6.4 Search Head
- 25. 25 What Do I Do Next? • Reach out to your Tech Team! We can help architect Machine Learning (ML) workflows. • Lots of ML commands in Core Splunk (predict, anomalydetection, stats) • ML Toolkit & Showcase – available and free, ready to use .. GO! • Splunk ITSI: Applied ML for ITOA use cases – Manage 1000s of KPIs & alerts – Adaptive Thresholding & Anomaly Detection • Splunk UBA: Applied ML for Security – Unsupervised learning of Users & Entities – Surfaces Anomalies & Threats • ML Customer Advisory Program: – Connect with Product & Engineering teams - mlprogram@splunk.com
- 26. 26 SEPT 26-29, 2016 WALT DISNEY WORLD, ORLANDO SWAN AND DOLPHIN RESORTS • 5000+ IT & Business Professionals • 3 days of technical content • 165+ sessions • 80+ Customer Speakers • 35+ Apps in Splunk Apps Showcase • 75+ Technology Partners • 1:1 networking: Ask The Experts and Security Experts, Birds of a Feather and Chalk Talks • NEW hands-on labs! • Expanded show floor, Dashboards Control Room & Clinic, and MORE! The 7th Annual Splunk Worldwide Users’ Conference PLUS Splunk University • Three days: Sept 24-26, 2016 • Get Splunk Certified for FREE! • Get CPE credits for CISSP, CAP, SSCP • Save thousands on Splunk education! #splunkconf2016