CLIPS: A Tool for Building Expert Systems
One way to get a copy of the paper would be to make a photocopy at a library or pay a service to do that.<p><i>Explanation</i> is a problem, also for my work.<p>Broadly, for a first cut, pick a <i>target</i> system want to monitor. Then use variables that are for the target, the whole target, nothing but the target or some such.  Then if get a detection, start diagnosis, looking for cause, with the target.<p>For two targets that interact, have detectors for each and then one more for variables from both of them.<p>Broadly, but crudely, have a hierarchy of detectors and then when start getting detections chase down the tree of the hierarchy, like the patient is sick so, look at the major measures and the major organs, etc.  When find a suspicious organ, zoom in, drill down, etc.  Finally discover the problem is a USB cable that is loose from vibrations from a cooling fan or some such??<p>In this tree, might want to have somewhat <i>coordinated</i> false alarm rates.<p>One motivation for my work was a <i>cluster</i> for transactions.  One day one computer in the cluster got a little sick in the head and was throwing away all its incoming transactions.  So, to the load leveling it looked not very busy and was getting nearly all the transactions and, thus, essentially ruined the work of the whole cluster.  And that&#x27;s not the only case of a cluster getting totally sick due to just one computer in the cluster getting sick.  So, I was hoping that getting data from all the computers in the cluster would raise an alarm from the cluster and data from each of the computers in the cluster would essentially do the diagnosis of which computer in the cluster was sick.<p>Likely more could be done.  E.g., might want to do some data <i>scaling</i>.<p>I don&#x27;t yet have a big server farm, and I don&#x27;t know anyone who does who cares enough about anomaly detection to use my work.  Expert systems?  At one time, yup.  My work?  Nope.  If my startup does well, then, sure, I&#x27;ll deploy my detector, lots of instances.<p>My startup isn&#x27;t anomaly detection.<p>At one time, I wrote lots of VCs about my anomaly detection work, that it was from IBM&#x27;s Watson lab, that it was published in <i>Information Sciences</i>, that I had work on fast algorithms, that I had good results on real data, etc. I got back just nothing.<p>I guessed that the target customers would be high end shops so that I would have to come in with a highly polished product, with lots of good data handling utility tools, some first class hand holding, etc., all of which would be expensive before the first sale.  So, I gave up on the idea that I could do a startup from my anomaly work.  There might be a way; if I ran a large, really serious server farm, I have at least a little project pursuing my work and&#x2F;or related work.  But, apparently mostly that&#x27;s not the way server farm management works.<p>So, I picked another problem for a startup, one where I could get a good solution and bring it to good revenue with just my own efforts as sole, solo founder.  I did that and am about to go for an alpha test.<p>Somehow anomaly detection just doesn&#x27;t get people very interested.<p>Once I gave a talk, and some in the audience mentioned that could use my work for fraud detection in, say, credit cards.  Well, maybe, but that audience had nothing to do with credit cards.<p>At one time there were some Soviets in England watching some government offices and keeping track of lights, comings, goings, etc.  They guessed that if a war was on the way, this data would show anomalies and early warning.  Yup, the Soviets saw the broad issue.  I don&#x27;t know if they used anything like my work or not.<p>So, maybe the secret is not just some good work in applied probability with some useful results but publicity, hype, fads, group think, a movement, etc., even if what are selling is just total nonsense.<p>My work is on the shelves of the research libraries.  I did my part.  If people want anomaly detection, there&#x27;s some good work there.  I&#x27;ve told the Sand Hill Road people, the Hacker News audience, several organizations, e.g., the main NASDAQ server farm at Trumbull, CT, etc.<p>My experience is that people will start to act, react, if they have a problem that, like a tight shoe, really hurts, and then start to work on the problem.  If some early work has the shoe not pinch so much, then they will f&#x27;get about that work and that problem and concentrate on something else, even if there&#x27;s lots of money to be made in better solutions to the original problem.<p>There is a time lag problem:  A lot of the math is on the shelves of the libraries, but only much more recently has suitable computing been available.  Only a tiny fraction of people in computing now, where the computing has the potential, know that old math that&#x27;s been sitting there waiting on the computing.<p>E.g., when I first did my work on anomaly detection, some people said that a lot of computing would be needed.  Well, yup.  The response was so obvious I didn&#x27;t have to make it:  The needed computing was coming.  Well, now, say, with solid state disks, big server farms, lots of system monitoring data gathering, etc., now the time is right for actual usage.  But, nope, interest is really low!<p>The startup I&#x27;m pursuing now is much more promising.  I don&#x27;t have to get a few bureaucratic, cautious, conservative, CIOs all fired up.  Instead I just have to please a lot of Internet users a little bit each, and that should be much easier.<p>The CIOs are running big server farms, and they are working.  So, they don&#x27;t have a shoe that pinches very much.  So, they are not motivated to do anything new or different.  Okay, lesson learned.