Transforming IT Operations with AI and Reasoning

Artificial intelligence (AI) is the overarching concept to create systems that simulate the cognitive functions of the human brain like reasoning and problem solving. Machine Learning (ML), on the other hand leverages technology to learn from machine data and enable data-driven decision making. In the Enterprise IT context, AIOps refers to solutions that leverage AI and ML to acquire enterprise IT data, analyze it and take required actions for autonomous IT Operations. In this context, have you ever wondered what is at the core of an AIOps solution? Yes, it is very much the ability to reason.
ignio™ AIOps uniquely blends intelligence and automation to improve the effectiveness and efficiency of Enterprise IT datacenter operations by leveraging advanced AI-based reasoning techniques. It applies all the three modes of AI reasoning that is Rule-based, Case-based and Model-based, for autonomous IT operations.

Table 1: Types of Reasoning Techniques

Rule-based Reasoning

This is also known as the ‘traditional’ approach. It refers to explicit user defined rules which are required to take a decision. There is nothing cognitive about these rules. They set limitations, making it difficult to manage IT operations effectively. Although, initially it might seem simple and easy to configure, they are exponentially complex to maintain and not adaptive in complex environments. Rules can be set-up for a variety of actions such as alert suppression, maintenance windows, triaging and fixing, rule based alert prediction, alert aggregation and so on. For instance, if a rule has been setup to suppress alerts during the maintenance window, any incoming alert will be checked with the condition specified in the rule and if valid, the alert will be suppressed. Rule-based reasoning requires synthesis of tacit knowledge in rules and has to be constantly updated along with technology, policy, and environment changes. Hence the need for a more dynamic and intelligent reasoning mechanism.

Case-based Reasoning

Case based reasoning is completely dependent on data and is more adaptive to the changing scenario. The system learns frequent, dominant, and recent cases from the historic data and derives patterns. Based on these patterns, ignio™ automatically defines its rules. It uses the historical data to predict the future. For instance, based on the past trends, it is statistically derived that backup failure occurs on a server every Tuesday in 94% of the cases (47 of 50 occurrences). ignio™ learns from this pattern and predicts that the backup failure is likely to occur in the future as well. The confidence and accuracy of case-based reasoning and prediction depends largely on the quality of the dataset applied over a period so that significant, consistent and persistent changes can be analyzed to derive patterns.
The analysis, predictions and recommendations based on historical occurrences, frequencies and relationships are an outcome of “Case-based Reasoning”.

Following Figure 2 is an illustration of how ignio™ leverages case-based reasoning for Alert aggregation.

Model-based Reasoning

Model-based reasoning is primarily driven by two things – the situational data (CMDB, influencers based on relationship data, inventory list, and so on) and the factual data comprising of technology model or Meta model. Technology model here refers to the way systems work, how databases are supposed to interact with OS, what are the attributes of the technology components, what are the faults that can be associated with them and their corresponding solution and so on. ignio™ leverages the structural context and behavioral patterns of the systems and applies reasoning logic for deciding the course of action. Following are a few scenarios where ignio™ applies model-based reasoning:

• Triaging of incidents – ignio™ leverages the structural dependencies amongst various other components to decide the scope and hierarchy for triaging.
• Alert Aggregation – ignio™ leverages the structural dependencies amongst various other components to judge incoming alerts. Alerts that fall in the dependency sub-tree of an active alert are aggregated with the main alert.
• Probable cause analysis – On completion of real time health diagnostics, ignio™ identifies the list of influencers behaving abnormally along with finer details of their attributes. This provides a detailed understanding to ignio™ of the observed anomalies. ignio™ then uses its pre-built knowledge of cause-and-effect relationships (that is, which anomalies can cause what issues), and tries to identify most probable cause due to which the incident has occurred.

Figure 3: Model-based Reasoning

Thus, the level of reasoning exhibited by any AIOps solution indicates its intelligence maturity. The AIOps market has become much saturated with numerous domain-agnostic and domain-centric vendors (or point solutions). It is the reasoning, the ability to comprehend the data set and make decisions which helps to differentiate a product from others. AIOps needs to shift beyond the rules, to have a more deductive and predictive reasoning approach towards data analysis and automation. This will support digital business transformation as more and more enterprise operations become increasingly agile and intelligent.