Observations on modeling, semantic web and life

Shameless plug for my session at SemTech 2011

2011-05-19T15:55:00.001-07:00

I will be speaking in a few weeks at SemTech 2011 (actually on Tuesday afternoon, June 7th, from 1:40 to 2:30pm). The meeting is in San Francisco, and you can register at the SemTech website. I can even provide a 15% discount code (SPK15).

So, what am I talking about (actually, demoing!)? My passions for processing of natural language text to extract business vocabulary and rules, and semantic technologies (of course).

Here are a couple of high points from the presentation (I won't repost the abstract, since you can read that online):

Architectural overview and demo of the infrastructure (with explanations of what components are used and why)
In particular, I will focus on:
- Microsoft Word application add-in programming
- Grammatical Framework
- Stanford's language parser
- The Pellet reasoner
- The KAoS policy ontology from Florida's Institute for Human Machine Cognition
A short discussion of my experience to-date and the many next steps that are needed

I really encourage attendance at this conference, as I strongly believe that semantic technologies offer great insights and capabilities for business.

Andrea

Finishing Off the NIST Access Control Survey

2011-05-02T17:32:00.000-07:00

I am finally getting a chance to finish the analysis of the NIST survey on access control methods. My apologies ... Somehow, the month of April got away from me ...

The last control model is Risk Adaptive Access Control or RAdAC. It is a combination of attribute and policy-based control (on steroids) with heuristics and machine learning. That last part is what makes it unique, challenging and very exciting.

Saying that attributes include environmental conditions does not seem like rocket-science, but just common sense. It is like saying that no one has permission to enter a building unless they are already identified to the security system. That works great until you need to override the policy because the building is on fire (and the firemen are definitely not already identified). So, including data on the environment (in the set of attributes to be assessed) is prudent.

Next, saying that policy can modify existing rules (making them more lax or strict, or modifying them to co-exist - i.e., de-conflicting them) is "meta-policy" (policy about policy). To me, this is just policy based management - but the targets of the policy are rules themselves.

However, the fascinating bit comes into play when the NIST authors discuss taking "a probabilistic, heuristic approach to determine whether the access should be granted ... The heuristics include a historical record of access control decisions and machine learning. This means that a RAdAC system will use previous decisions as one input when determining whether access will be granted to a resource in the future." I would actually expand that last sentence a bit to say "use previous decisions with insider/outsider threat analysis".

Do IT systems have the necessary data to capture and analyze this information today? I believe that we do. We have cheap storage that can hold extensive log data, sophisticated sensor/management hardware and software, and advanced pattern recognition and analysis software. What we need is more experience and research into the heuristics and strategies to effectively utilize this information, hardware and software.

The NIST paper goes on to highlight the obstacles to overcome to achieve RAdAC. I want to just briefly note and comment on them here:

Integration of a wide variety of systems and data - Which is an area where semantics technologies would be very useful (something that I might have said before)
Unambiguous definition of digital policies - I would again encourage investigating and building on semantic technologies, such as the Institute for Human and Machine Cognition's KAoS ontology and framework
Trustworthy sources of user and environment information
Research into machine learning, genetic algorithms and heuristics - Which is discussed above, and ...
A broad swath of non-technical challenges - such as the liabilities associated with a security breach made by an automated entity

Although I have worked on policy-based management for many years, I still worry that automated policy will just allow us to make errors more quickly. So, to NIST's list of obstacles I want to add the need to improve testing, test beds and simulation.

Andrea

Dialog on "NIST and Access Control", my previous post

2011-03-21T22:47:00.000-07:00

I received a notification that the following comment was posted by Fred Wettling (from Bechtel) ... but it does not appear on the web site. So, I am re-posting it as a full entry and then adding a bit of dialog of my own.

My apologies to Fred that the site is not working quite right, and my appreciation for the additional insights! Here is Fred's post ....

Good post, Andrea ;-)

Here are a few initial thoughts...The overall NIST model can be viewed as moving from topology-based control (network boundaries) to policy-based control. RBAC, ABAC, PBAC... appear to be the evolution of how policies are instantiated and the level of granularity required for the target level of security. ACLs, firewall rules, and other topology-based controls will be around for a while and continue to serve as a coarse-grained access control for many hosted services within companies and also cloud providers that have requirements for zone-based controls.

But topologies are changing from at least three perspectives that must be addressed in tomorrow's security.
1. Resources and information are becoming more distributed as we move from a single source of access (monolithic applications) toward a "single source of truth" with mash-ups securely accessing and aggregating multiple authoritative information sources.
2. More distributed information sources including peer-to-peer communications.
3. Location-based services have an implication of geographic or physical context that may be relevant in security decisions.

There's also a needed (and implied) shift in WHERE security is applied. The trend must be toward the target resource or information to operate in the expanding Internet of Things. The implication of these topology-related trends will require changes to how information and resources are secured… and a rethinking of the hub and spoke models of access control on the past. This raised the question of where identity-based attributes are stored and how/when they are validated. Can peer-to-peer communications rely on attribute assertions from the peers? In some cases yes. In other cases, third-party validation may be required. In both cases a centralized infrastructure may NOT exist. That is a challenge that may be addressable through some level of standardization of vocabulary, policy, and rule structures that you mentioned. The challenge, as usual, is frequent vendor perception that product differentiation is achieved through proprietary technology.

I think there needs to be some industry awakening about the value of standard & policy-based access control. There is high-value to organizations to have common policy definitions accessible by PDPs and PEPs provided by multiple vendors.
1. DMTF has done some great work collaborating with others in standardizing policy models.
2. Before it merged with the Open Group in 2007, the Network Application Consortium (NAC) published the Enterprise Security Architecture. Link: https://www2.opengroup.org/ogsys/jsp/publications/PublicationDetails.jsp?catalogno=h071. A team has been established to update the 115 page doc. It has some great content that is relevant to this thread.

NIST could certainly help in pushing this work forward and promoting policy standardization in other standards organization including the two mentioned above. Unification would be a good thing.

Fred Wettling
Bechtel Fellow

And, here are my replies:

1. As for ACLs being around for a while, I totally believe that. However, I am not sure that they will be around out of necessity, but due to the persistence of legacy systems and the reluctance of vendors to move from tested and costly proprietary technologies. I think that we can move fully to PBAC or RAdAC policies, at least at the declarative level. Let me explain ... If hardware and software products understand a "standard" policy ontology and vocabulary, then they can implement/act on declarative policy, as opposed to processing device/OS/software-specific ACLs. Now, a device may only be capable of coarse-grained control or that may be the appropriate implementation for certain environments (for example, "zone-based control" in a cloud), where the fine-grained details are/should not be known. But, a different take on this, from requiring an ACL, is to say that a "standard" rule is translated to coarse-grained protection, as part of the PBAC/RAdAC processing. Even in the worst case of using only ACLs, the policy infrastructure can relate the ACL to the declarative policy that it was designed to implement. Traceability is a wonderful thing!

2. It is noted that a centralized infrastructure may not exist. I agree but also want to allow for centralized policy declaration (for example, from federal, state or local governments, or from a Governance/Compliance Policy-Setting Body in an enterprise) and decentralized, local policy definition and override. On the distribution side, it is necessary to disseminate the broad coverage policy (such as legislation), as well as the rules for how/when/by whom they can be modified. Does this mean "centralized" infrastructure? Not necessarily, but there may/should be "standard" policy repositories. Regarding policy decision and enforcement, there may be security aspects that can/should be processed locally, others that require third party validation, some that rely on sophisticated, controlled policy decision point analysis, etc. ... It eventually comes down to policy on policy. But, in any/all cases, security needs to work when offline/disconnected.

3. Fred lists work by DMTF and NAC. The NAC paper is very insightful and I encourage people to read it. As for the DMTF, they have indeed pushed the boundaries of policy-based management, although I find their model to be complex (due to the use of a query language in defining policy conditions and actions, and the disconnected instantiation of the individual rule components). Also, CIM requires extension to address all the necessary domain concepts and vocabularies, which will not be easy.

4. I was a bit unclear in my reference to NIST and helping with "practices and standards". One of my NIST colleagues pointed out that they do not set industry standards, but support the development of "open, international, consensus-based" ones. In addition, they develop guidance for Federal agencies. This was what I meant, although I did not use enough words. :-) Federal, state, and local governments are the ones that write legislation/statutes. But, NIST could encourage government agencies to publish their policies in a standard format, and that would help industry and promote competition. This was indeed my goal in mentioning NIST - not for them to create a standard, but to help drive one and ensure its utilization by Federal agencies. NIST is in a unique position to help because they are not a policy-setting agency. And, as Fred noted above "the challenge ... is frequent vendor perception that product differentiation is achieved through proprietary technology."

Well, I'm sure that this is too long already. Look for more in the next few days.

Andrea

NIST and Access Control

2011-03-18T12:46:00.000-07:00

I ran across an excellent paper from NIST (the US's National Institute of Standards and Technology), A Survey of Access Control Methods. The document is a component of the publication, "A Report on the Privilege (Access) Management Workshop". I highly recommend reading it, since the security landscape is evolving ... as the technology, online information, regulations/legislation, and "need to share" requirements of a modern, agile enterprise keep expanding.

Access control is discussed from the hard-core (and painfully detailed) ACL approach (access control lists) all the way through policy and risk-adaptive control (PBAC and RAdAC). Here is a useful image from the document, showing the evolution:

Reading the paper triggered some visceral reactions, on my part ... For example, I strongly feel that role-based access control is no longer adequate for the real-world. Yet, it is where most of us live today.

The problem is the need for agility. The world is no longer only about restricting access to specific, known-in-advance entities using a one-size-fits-all-conditions analysis ("need to protect" with predefined roles) - but also about granting the maximum access to information that is allowed ("need to share" considering the conditions under which sharing occurs).

Here are some examples ... Firefighters need the maximum data about the location and conditions of a fire that they can legally obtain (see my previous post, Using the Semantic Web to Fight Fires). Law enforcement personnel, at the federal, state or local levels, need all the data about suspicious activities that can be legally shared. An information worker needs to see and analyze all relevant data that is permitted (legally and within the corporate guidelines). *The word, "legally", comes up a lot here ... more on that in another post.

So, how do you accomplish this with simple roles? You can certainly build new roles that take various situational attributes into account. But how far can you go with this approach? At some point, the number of roles (variations on a theme) spirals out of control. You really need attribute based control. As the NIST paper points out, with attributes, you don't need to know all the requesters in advance. You just need to know about the conditions of the access.

But, simply adding attribute data (data about the information being accessed, the entity accessing it, the environment where the access occurs or is needed, ...) can get quite complex. The real problem is figuring out how to harmonize and evaluate the attribute information if it is accessed from several data stores or infrastructures. Then, closely associated with that problem is the need to be consistent across an enterprise - to not allow access (under the same conditions) through one infrastructure that is disallowed by another.

Policy-based access control, the next concept in the evolution, starts to address some of these concerns. NIST describes PBAC as "a harmonization and standardization of the ABAC model at an enterprise level in support of specific governance objectives." It concerns the creation and administration of organization-wide rule sets (policies) for access control, using attribute criteria that are also semantically consistent across the enterprise.

Wow, reading that last sentence made my head hurt. :-) Let me decompose the concepts. For policy-based access control to really work, we need (IMHO, in order of implementation):

A well defined (dare I say "standard") policy/rule structure
A well understood vocabulary for the actors, resources and attributes
Ability to use #1 and #2 to define access control rules
Ability to analyze the rules for consistency and completeness
An infrastructure to support the evaluation and enforcement of the rules (at least by transforming between local data stores and infrastructures, and the well understood and defined vocabulary and policies/rules)

Some day, we will have best practices and standards for #1 and #2. Even better, we could have government-blessed renderings of the standard legislation (SOX, HIPAA, ...) using #1 and #2.

Can NIST also help with these activities? I hope that it can. In the meantime, there are some technologies like Semantic Web that can help.

As you can imagine, I have lots more things to discuss about the specifics of PBAC and RAdAC, in my next posts.

Andrea

Using the semantic web to fight fires

2011-01-10T11:49:00.000-08:00

On Dec 10th, I watched a fascinating webcast from SemanticWeb.com ... "Fighting Fire with the Semantic Web". I won't repeat the content (you can watch the presentation for yourself), but I will provide some of my take-aways.

We all have environments with problems similar to the fire fighters in Amsterdam (except, hopefully, not quite so dangerous or life-threatening). When going to a fire, they have to:

Navigate the city streets (understand what else is happening with respect to road congestion, construction, etc.)
Assess the conditions of the building, fire and available/closest resources
Get different data based on the situation - for example, the relevant data for a forest fire (wind speed) is quite different than data for a structural fire (asbestos levels)
Determine the tasks to be done and in what order
Work with incomplete data
Use tools that are not targeted to their particular situations (such as commercial GPSs targeted for normal driver needs)

And do this all in real-time (or faster, if possible).

In the fire fighting environment, data comes from a variety of locations (emergency infrastructure databases owned by the police, construction road reports, geospatial databases, internal fire department databases and spreadsheets, ...). This all sounds similar to the daily problems that a IT or business person experiences.

So, what did the Amsterdam fire department do? They created a flexible infrastructure based on accessing raw (RDF) data (adopting Tim Berners-Lee's mantra, "raw data now"). They pre-loaded any data that was (relatively) static, and obtained other data in real-time as needed. All the information was accessed and assembled on the fly ... based on the URI of the information. (The URI was used by the back-end system to determine how the data should be displayed to the user.) The goal was to get away from specific applications with their own UIs, system and display requirements, etc. As was stated, "we already have 8 screens in the fire truck... we don't need 9".

Because the environment focused on raw data, in a generic form (RDF triples), any relevant information could be requested and displayed. Since the infrastructure based its processing on the URI, a user could definitely "follow their nose". Taking this one step further, meta-data could also be supplied with a URI and/or a piece of data, for UI/display purposes. (Interestingly enough, I was just working on UI-related meta-data for CA's Unified Service Model, stealing some great insights from our Mainframe 2.0 team. :-)

So, what were the technical lessons that were highlighted:

Use of RDF triples allowed the data to evolve with no change to the interfaces (except to support radically new kinds of data and their display needs - which should be rare)
Use of raw data meant that there were no interfaces (and custom coding) with "exclusive" ways to access to data
Use of common tags allowed quick review of possible data and selection
All interfaces were data-driven ... meaning that the data/URI defined how it should be displayed
Use of RDF triples (and URIs) allowed a "follow your nose" approach to locating other, related data
What was needed could be defined by the user based on their needs (for example, what they already knew) and the situation

How cool is that? And, don't you wish that you had this yesterday?

Andrea

Starting the new year with a new post ...

2010-12-31T16:54:00.000-08:00

As one of my new year's resolutions, I am firmly committing to finding time to blog ... And to start off, I am taking some ideas from my job (jobs always provide interesting food for thought).

I want to post my thoughts on the qualifications of an ontologist/modeler ... What makes a good modeler?

* Senior developer with experience in different products (and an ability to draw analogies
and see commonalities between the products)
* Ability to discern use cases and create abstractions from basic problem statements
o The ability to solve a single problem with a specific solution is relatively easy, but
the ability to create a generic solution to a set of related problems is much more
valuable and difficult
* Ability to see "systems", determining boundaries and components (for
example, looking at a few trees and abstracting the forest - or - looking at a forest and
determining what is important about the trees)
* Interpersonal and communication skills (the job is really all about understanding
requirements for the ontology/model, learning about the domain and interacting with
subject matter experts)
* Ability and eagerness to learn (about new problems, new areas of work, specific details
that need abstraction, ...)

Not a very specific set of skills or qualifications, but I did start with the assumption that the person is senior, experienced and a great candidate.

What are your thoughts?

Andrea

Too Many Standards?

2009-10-12T12:44:00.000-07:00

LightReading had an interesting post last Thursday, http://www.lightreading.com/document.asp?doc_id=182818&f_src=lightreading_sitedefault. It was about discussions in Geneva by "a group of 19 chief technologists and other CXOs". It seems that they are upset about too many standards, and lack of interoperability between them. I can certainly understand that - given how many standards I have participated in, over the last 15+ years. :-)

"The standardization landscape has become too complicated and fragmented, with hundreds of industry forums and consortia," notes the ITU. "CTOs agreed that it has become increasingly challenging to identify and prioritize how to concentrate standardization resources."

If I am asked what standards to support (asked both by customers and product teams), I have to first ask about the customer segment (telecommunications versus enterprise), the domain (hardware, storage, software, services or networking), the need for supporting tooling (there are standards with little backing tooling), and the modeling experience of the teams (there are some unbelievably complicated specifications!). God forbid that a product needs to support many of these areas and has little time to build the right skill sets. Unfortunately, we have been there for several years now!

I especially liked the posted comment from "JayJay" ...

"And who is responsible for the fragmented standardization landscape? IF I don't get what I want in a standardization body, 'I make my own Forum' is a widely used approach ..."

I must admit, this happens all the time. We as an industry do need to take religious fervor and company politics out of our standards.

What Modelers Can Learn from WordNet

2009-09-23T14:33:00.000-07:00

In WordNet, there are several significant types of relationships, with very specific semantics. These semantics apply in modeling as well. However, some modeling approaches focus on (or only allow) some of the semantics - for example, focusing on inheritance and property definition with much else excluded.

So, what are the types of relationships in WordNet? They are listed below along with their linguistic terminology (holonym, meronym, troponym, etc.).

Inheritance information - the definition of hypernyms/superclasses and hyponyms/subclasses. Most modeling approaches handle this very well.
Coordinate terms - Related information, usually the sibling entities under a single superclass. Again, this is well covered.
Aggregation - the definition of holonyms/aggregates and meronyms/aggregated items. However, WordNet further refines aggregation as:

Whole/part information - For example, fingers are part of a hand, but can be treated as separate entities. Their lifetimes are influenced by the lifetime of the "whole". Obviously, if a hand is cut off, the fingers are cut off with the hand.
Substance/composition of an entity - For example, cement and sand are substances in concrete, but once mixed, they are not separate entities.
Membership information - For example, certain employees are members of a security group, but the entities are separate, with separate lifetimes. So, removing the security group does not remove the employees, or removing the employees from the group does not delete the group.

Attribute information - HAS-A data, well addressed by all modeling infrastructures.
Synonym information - Alias information and equivalent terms. Lack of this information (or meta-information) usually causes the arguments when defining the single "name" of a modeled entity.
Antonym/opposite information - There is usually no need to reflect this in a model. My preference is OWL's disjointWith distinction, that 2 classes have no common individuals.
Refinement information - Defining troponyms for verbs (relationships). This involves refining a verb by the manner in which it is performed. For example, to mumble is "to talk indistinctly by lowering the voice or partially closing the mouth". This could be modeled as a typing hierarchy involving associations. But, typically, typing hierarchies involving associations are defined based on a restriction of the referenced elements, versus a refinement of the semantics of the association. Often, we make too much of the restriction scenarios and too little of the refinement of semantics.
Entailment of information, in WordNet it is entailment of verbs - Entailment is the implication of one fact from another. For verbs, it is based on temporal inclusion. For example, the act of snoring implies sleeping. OCL is one example of how this is supported in today's modeling infrastructure - across nouns and verbs/associations.
Cause data for transitive, intransitive verbs - This is best described by example ... knowing that the wind storm broke the window is the CAUSE of the window being broken (a resulting state). Having this level of information as data or meta-data in a model could assist immeasurably with root cause analysis.

I don't know about you, but I am very impressed with the knowledge in WordNet.

Apologies on being MIA and a quote from Abraham Lincoln

2009-09-17T13:14:00.000-07:00

I started a new job (at CA, Inc.) and had to take a bit of time to learn the company and my role. Now that I am settled in (as much as one can ever settle in :-)), I can get back to devoting some time to blogging. With the disclaimer that ...

The opinions and statements on this site are my own and do not reflect the opinions or policies of CA, Inc.

So, onto my return post, I simply want to publish a quotation from Abraham Lincoln that is very relevant to semantics and models ...

How many legs does a dog have, if you call his tail a leg? The answer is four, because calling a tail a leg doesn't make it a leg.

It is unbelievable how often I hear things like "just change the name/representation of foo to be bar and we can get alignment". However, the real issue is not the representative name (which should indeed be clear), but the semantics that the people used, who defined the word "foo" in the first place. If we could move modeling to more than words on a UML diagram, to analyzing semantics ... we would be much better off.

Another thing that I sometimes hear is the question "what makes an instance a foo"? For example, "if I magically change the color and size of an elephant is it still an elephant?" Or, riffing on Nassim Nicholas Taleb's theory, "is a black swan a swan?" Semantics will help us understand what being a swan or an elephant or an IT service means - beyond the name. And, we have an added benefit ... if we make the essential definitions clear, then we have a better way to correct invalid definitions by removing problematic clauses (such as "all swans are white").

Andrea

Types of Models - For Business Versus For IT

2009-06-10T11:22:00.000-07:00

I was looking through my notes about articles that I had read - and found an interesting Burton Group report entitled Generalized and Detailed Data Models: Seeking the Best of Both Worlds. (I think that it was published earlier this year.) I must admit to having been both confused and intrigued by the title. :-)

In the paper, "generalized" models are those used to define database/storage structures and to find the general themes and fundamental aspects of the data (and its values). In short, they are the data models defined by IT to effectively and efficiently use the technologies that are in place (like SQL databases). Maybe "reduced" is a better word than "generalized" ...

On the other hand, "detailed" models are those that are useful to business people. They define and describe the information requirements of the business, and its vocabularies, rules and processes. They hold the details from the business perspective. Again, maybe another word like "conceptual" is better (since even the "generalized" models hold "details") ...

What is valuable is not the titles used for these models but their semantics. :-) The key message is that a business needs both types of models and they need to stay in sync. This is really important. The conceptual/detailed models hold the real business requirements and language. They haven't been reduced to basic data values whose semantics are lost in the technology used to define and declare them.

IMHO, a business loses information and knowledge when it only retains and works from the IT models. There is much to be gleaned from the business input and much value in keeping the business people engaged in the work. This is almost impossible once you reduce the business requirements to technology-speak.

As the report says, "do not allow generalized models to compromise your understanding of the business."

PriceWaterhouseCoopers Spring Technology Forecast (Part 3)

2009-06-08T14:46:00.000-07:00

This is the last in a series of posts summarizing the PriceWaterhouseCooper Spring Technology Forecast. I spent a lot of time on the report, since it highlights many important concepts about the Semantic Web and business.

The last featured article in the report is entitled 'A CIO's strategy for rethinking "messy BI"'. The recommendation is to use Linked Data to bring together internal and external information - to help with the "information problem". How does PwC define the "information problem"? As follows ... "there's no way traditional information systems can handle all the sources [of data], many of which are structured differently or not structured at all." The recommendation boils down to creating a shared or upper ontology for information mediation, and then using it for analysis, for helping to create a business ecosystem, and to harmonize business logic and operating models. The two figures below illustrate these concepts.

The article includes a great quote on the information problem, why today's approaches (even metadata) are not enough, and the uses of Semantic Web technologies ... "Think of Linked Data as a type of database join that relies on contextual rules and pattern matching, not strict preset matches. As a user looks to mash up information from varied sources, Linked Data tools identify the semantics and ontologies to help the user fit the pieces together in the context of the exploration. ... Many organizations already recognize the importance of standards for metadata. What many don’t understand is that working to standardize metadata without an ontology is like teaching children to read without a dictionary. Using ontologies to organize the semantic rationalization of the data that flow between business partners is a process improvement over electronic data interchange (EDI) rationalization because it focuses on concepts and metadata, not individual data elements, such as columns in a relational database management system. The ontological approach also keeps the CIO’s office from being dragged into business-unit technical details and squabbling about terms. And linking your ontology to a business partner’s ontology exposes the context semantics that data definitions lack."

PwC suggests taking 2 (non-exclusive) approaches to "explore" the Semantic Web and Linked Data:

Add the dimension of semantics and ontologies to existing, internal data warehouses and data stores
Provide tools to help users get at both internal and external Linked Data

And, as with the previous posts, I want to finish with a quote from one of the interviews in the report. This quote comes from Frank Chum of Chevron, and discusses why they are now looking to the Semantic Web and ontologies to advance their business. "Four things are going on here. First, the Semantic Web lets you be more expressive in the business logic, to add more contextual meaning. Second, it lets you be more flexible, so that you don’t have to have everything fully specified before you start building. Then, third, it allows you to do inferencing, so that you can perform discovery on the basis of rules and axioms. Fourth, it improves the interoperability of systems, which allows you to share across the spectrum of the business ecosystem. With all of these, the Semantic Web becomes a very significant piece of technology so that we can probably solve some of the problems we couldn’t solve before. One could consider these enhanced capabilities [from Semantic Web technology] as a “souped up” BI [business intelligence]."

PriceWaterhouseCoopers Spring Technology Forecast (Part 2)

2009-06-03T12:24:00.001-07:00

This post continues the review and summarization of PwC's Spring Technology Forecast, focused on the Semantic Web.

The second featured article is Making Semantic Web connections. It discusses the business value of using Linked Data, and includes interesting information from a CEO survey about information gaps (and how the Semantic Web can address these gaps). The article argues that to get adequate information, the business must better utilize its own internal data, as well as data from external sources (such as information from members of the business' ecosystem or the Web). This is depicted in the following two figures from the article ...

I also want to include some quotes from the article - especially since they support what I said in an earlier blog from my days at Microsoft, Question on what "policy-based business" means ... :-)

Data aren’t created in a vacuum. Data are created or acquired as part of the business processes that define an enterprise. And business processes are driven by the enterprise business model and business strategy, goals, and objectives. These are expressed in natural language, which can be descriptive and persuasive but also can create ambiguities. The nomenclature comprising
... the natural language used to describe the business, to design and execute business processes, and to define data elements is often left out of enterprise discussions of performance management and performance improvement.
... ontologies can become a vehicle for the deeper collaboration that needs to occur between business units and IT departments. In fact, the success of Linked Data within a business context will depend on the involvement of the business units. The people in the business units are the best people to describe the domain ontology they’re responsible for.
Traditional integration methods manage the data problem one piece at a time. It is expensive, prone to error, and doesn’t scale. Metadata management gets companies partway there by exploring the definitions, but it still doesn’t reach the level of shared semantics defined in the context of the extended virtual enterprise. Linked Data offers the most value. It creates a context that allows companies to compare their semantics, to decide where to agree on semantics, and to select where to retain distinctive semantics because it creates competitive advantage.

As in my last post, I want to reinforce the message and include a quote from one of the interviews. This one comes from Uche Ogbuji of Zepheira ... "... it’s not a matter of top down. It’s modeling from the bottom up. The method is that you want to record as much agreement as you can. You also record the disagreements, but you let them go as long as they’re recorded. You don’t try to hammer them down. In traditional modeling, global consistency of the model is paramount. The semantic technology idea turns that completely on its head, and basically the idea is that global consistency would be great. Everyone would love that, but the reality is that there’s not even global consistency in what people are carrying around in their brains, so there’s no way that that’s going to reflect into the computer. You’re always going to have difficulties and mismatches, and, again, it will turn into a war, because people will realize the political weight of the decisions that are being made. There’s no scope for disagreement in the traditional top-down model. With the bottom-up modeling approach you still have the disagreements, but what you do is you record them."

And, yes, I did say something similar to this in an earlier post on Semantic Web and Business. (Thumbs up :-)

PriceWaterhouseCoopers Spring Technology Forecast (Part 1)

2009-06-02T22:45:00.000-07:00

In an earlier post, I mentioned PriceWaterhouseCoopers' spring technology forecast and its discussion of the Semantic Web in business. In this and the following post, I want to overview and highlight several of the articles. Let's start with the first featured article ...

Spinning a data Web overviewed the technologies of the Semantic Web, and discussed how businesses can benefit from developing domain ontologies and then mediating/integrating/querying them across both internal and external data. The value of mediation is summarized in the following figure ...

I like this, since I said something similar in my post on the Semantic Web and Business.

Backing up this thesis, Tom Scott of BBC Earth provided a supporting quote in his interview, Traversing the Giant Global Graph. "... when you start getting either very large volumes or very heterogeneous data sets, then for all intents and purposes, it is impossible for any one person to try to structure that information. It just becomes too big a problem. For one, you don’t have the domain knowledge to do that job. It’s intellectually too difficult. But you can say to each domain expert, model your domain of knowledge— the ontology—and publish the model in the way that both users and machine can interface with it. Once you do that, then you need a way to manage the shared vocabulary by which you describe things, so that when I say “chair,” you know what I mean. When you do that, then you have a way in which enterprises can join this information, without any one person being responsible for the entire model. After this is in place, anyone else can come across that information and follow the graph to extract the data they’re interested in. And that seems to me to be a sane, sensible, central way of handling it."

The Semantic Web in 3 Words

2009-05-31T09:34:00.000-07:00

My husband asked me to explain the Semantic Web in three words (because I was going on about the web and my ideas) ... So, here they are:

Data
Linkages
Infrastructure

And now, I get to use more than 3 words :-).

Data is usually meta-data (data about data) - what a document is about, additional information like who the author is, etc. But, it can also be the raw information - like a business vocabulary.

Linkages are the relationships between the data. The information that ties the data together and lets you infer and extrapolate.

Infrastructure is the formalisms of the languages (RDF, RDF Schema, OWL, SPARQL, ...) and the services that are already provided (W3C's Linked Data, Protege, Pellet, ...). Data without backing services and formalisms means that you have to create everything yourself and there is no exponential building of knowledge that comes from sharing the data.

That's it. Let me know if you agree with my 3 words or have different ones.

Continuing on the topic of the Web of Data (aka Linked Data)

2009-05-29T14:47:00.000-07:00

There is lots being published about Linked Data. I just saw that the Spring 2009 PriceWaterhouseCooper technology forecast is full of data Web and Semantic web coolness. But, before I jump into the forecast, I would like to give some background on the Linked Data work that is happening in the industry today.

Linking Open Data (LOD) is a W3C project. According to their web site, "The goal of the W3C SWEO Linking Open Data community project is to extend the Web with a data commons by publishing various open data sets as RDF on the Web and by setting RDF links between data items from different data sources.RDF links enable you to navigate from a data item within one data source to related data items within other sources using a Semantic Web browser. RDF links can also be followed by the crawlers of Semantic Web search engines, which may provide sophisticated search and query capabilities over crawled data. As query results are structured data and not just links to HTML pages, they can be used within other applications. ... Collectively, the data sets consist of over 4.7 billion RDF triples, which are interlinked by around 142 million RDF links (May 2009)."

Here is the LOD figure showing what is linked today (actually March 2009):

Just to get a feel for what is included ... let me note that DBpedia (the bigger circle in the left center of the image) provides structured access to Wikipedia's human-oriented data (actually, it provides a SPARQL interface). According to DBpedia's web site, "The DBpedia knowledge base currently describes more than 2.6 million things, including at least 213,000 persons, 328,000 places, 57,000 music albums, 36,000 films, 20,000 companies. The knowledge base consists of 274 million pieces of information (RDF triples). It features labels and short abstracts for these things in 30 different languages; 609,000 links to images and 3,150,000 links to external web pages; 4,878,100 external links into other RDF datasets, 415,000 Wikipedia categories, and 75,000 YAGO categories. The DBpedia knowledge base has several advantages over existing knowledge bases: it covers many domains; it represents real community agreement; it automatically evolve as Wikipedia changes, and it is truly multilingual. The DBpedia knowledge base allows you to ask quite surprising queries against Wikipedia, for instance “Give me all cities in New Jersey with more than 10,000 inhabitants” or “Give me all Italian musicians from the 18th century”. Altogether, the use cases of the DBpedia knowledge base are widespread and range from enterprise knowledge management, over Web search to revolutionizing Wikipedia search."

Going back to Tim Berners-Lee's request for us to imagine what it would be like to have people load and connect knowledge, let's imagine what all this data can do for a business and its decision making processes ....

Web 3.0 and the Web of Data

2009-05-26T11:42:00.000-07:00

Web 3.0 is coming up (a lot) in posts on Read-Write Web and in other places. One Read-Write Web posting (The Web of Data, written by Alexander Korth in April of this year) discussed the 3 aspects of the next web (Web 3.0) ... "In the coming years, we will see a revolution in the ability of machines to access, process, and apply information. This revolution will emerge from three distinct areas of activity connected to the Semantic Web: the Web of Data, the Web of Services, and the Web of Identity providers. These webs aim to make semantic knowledge of data accessible, semantic services available and connectable, and semantic knowledge of individuals processable ...".

Tim Berners-Lee focused on the Web of Data in his TED talk on the next Web (recorded in Feb 2009). The talk is only a little longer than 15 minutes in length, and I highly recommend it. The key points are that we are now moving from a document-centric approach to storing information, to making raw data available and processable. That raw data is "linked data" - data about things (identified by URIs), including other interesting information (as RDF triples) and highlighting the relationships between the things. It is important to note that this is not about making data available through specific APIs or anticipated/pre-programmed queries on a "pretty" web site - but about making the "unadulterated data" available for machine understanding and new uses. It is about sharing and adding to data, making connections and relationships in novel ways, and bridging disciplines.

If you think about business and an enterprise, think about how powerful this would be - to capture knowledge, share it via social networking technologies, allow update and addition to the knowledge within the enterprise (again using the social networking tools of today), and to bridge disciplines and knowledge using the Semantic web mining and matching technologies. Overall, we improve the ability of the enterprise to capture and access its knowledge, and increase the captured knowledge. In the talk, Tim Berners-Lee asks people to imagine the "incredible resource" of "people doing their bit to produce a little bit, and it all connecting."

Just imagine ....

Lots of Interest in Wolfram|Alpha, and Some Discussion of Microsoft's EDM

2009-05-18T07:25:00.000-07:00

Wolfram|Alpha is cool and uses great, new technology to provide question-answer query capabilities. But, it still has a way to go. As Read-Write-Web pointed out in their post, "the areas where Alpha exceeds are in Mathematics, Engineering, Chemistry, Physics, and the Life Sciences." What is needed is to take this technology and use it with business vocabularies and their backing databases.

To do this, you first need the capture of the vocabularies (yes, I will get back to this in my postings :-) - and then mappings to the physical stores. Microsoft's EDM (Entity Data Model) and Entity Framework are a start in enabling the mappings. They allow you to define a conceptual model, a physical model and then map between the two - although they don't help you create the conceptual or physical models, are not focused on conceptual modeling, and are too focused on the physical structure of the data store. Specifically, some of the ideal mappings are not possible (at least the last time that I tried), and all the data and meta-data that I would like to capture about the conceptual model are not possible to do (without extensions). But, they exist, are usable today, and will definitely be improved.

Another cool thing is that EDM and the framework allow you to write queries in the conceptual model, that are then translated to the physical one and run against the store. Pretty neat. Now, let's put a better query capability up front (like Wolfram|Alpha) ....

Going to School - Knowledge Management Style

2009-05-11T15:27:00.000-07:00

In May 2001, Michael Earl wrote about three main categories and seven schools of knowledge management. His article was published in the Journal of Management Information Systems (Vol 18, Issue 1).

The three categories for capturing and sharing knowledge are:

Technocratic - involved with tooling and the use of technology for knowledge management
Economic - relating knowledge and income
Behavioral -dealing with how to organize to facilitate knowledge capture and exchange

Because these categories are so different, Earl pointed out that they are not mutually exclusive, and could be used in conjunction. In fact, doing so should better enable overall knowledge capture and use.

Within each of the categories, Earl posited that there are "schools" or focuses for knowledge management. Earl's seven schools are listed below (with some short descriptions):

Systems - Part of the technocratic category, focusing on the use of technology and the storing of explicit knowledge in databases and various systems and repositories. The knowledge is typically organized by domain.
Cartographic - Part of the technocratic category, focusing on who the "experts" are, in a company, and how to find and contact them. So, instead of explicit captured knowledge, the tacit knowledge held by individuals is paramount.
Engineering - Part of the technocratic category, focusing on capturing and sharing knowledge for process improvement. In addition, the details and outputs of various processes and knowledge flows are captured. The knowledge in this school is organized by activities with the goal of business process improvement.
Commercial - This is the only "economic" school and focuses on knowledge as a commercial asset. The emphasis is on income, which can be achieved in various ways ... such as limiting access to knowledge, based on payments or other exchanges, or rigorously managing a company's intellectual portfolio (individual know-how, patents, trademarks, etc.).
Organizational - Part of the behavioral category, focusing on building and enabling knowledge-sharing networks and communities of practice, for some business purpose. Earl defines it as a behavioral school "because the essential feature of communities is that they exchange and share knowledge interactively, often in nonroutine, personal, and unstructured ways". For those not familiar with the term "community of practice", it is defined by Etienne Wenger as “groups of people who share a concern or a passion for something they do and learn how to do it better as they interact regularly.”
Spatial - Part of the behavioral category, focusing on how space is used to facilitate socialization and the exchange of knowledge. This can be achieved by how office buildings are arranged, co-locating individuals working on the same project, etc.
Strategic - Part of the behavioral category, focusing on knowledge (according to Earl) as "the essence of a firm's strategy ... The aim is to build, nurture, and fully exploit knowledge assets through systems, processes, and people and convert them into value as knowledge-based products and services." This may seem like the strategic school rolls all the others into it, and it does. But, what distinguishes it, again according to Earl, "is that knowledge or intellectual capital are viewed as the key resource."

My personal focus is the strategic school, but with less interest in the spatial component and more in the systems aspects ... I believe that good collaboration needs to be (and can be) enabled, regardless of the physical environment or physical distances separating teams.

And, how do you do this? Via capturing, publishing and mapping each business group's/community's vocabularies (ontologies) and processes, and understanding that community's organizational structure.

Organizing Knowledge

2009-05-05T12:15:00.001-07:00

I thought that I would examine what other writers think of "organizing knowledge", since I chose this for the title of my blog.

My passion for this title comes from the need to meld business knowledge with IT infrastructure - organizing the business' inherent and (usually) implicit knowledge by first capturing it and then making it usable, accessible and actionable (within the IT infrastructure). There is another aspect to this also - taking lots of information (already in the IT infrastructure) and organizing it to turn it into knowledge (not just bits of data).

Given these two goals, you find (or will find) lots of postings about ontologies, business processes, semantic web and similar topics in this blog. (Also, you will occasionally find some riffs on digital natives and education - since these are of particular interest to me.) I will not repeat postings from my earlier blog (while I was at Microsoft). You can read these yourself at http://blogs.msdn.com/policy_based_business.

Well, back to what others think about "organizing knowledge". Most of the work in this space is related to organizing and cataloging library materials, since libraries were the main repository of knowledge, and books the main format up until this digital age. This has now all changed. The need to catalog and classify books, using a single scheme, in order to find a particular book on a particular shelf in a physical library building is no longer a primary driver. One would argue that it is not even an appropriate driver, in a fast-paced, online business environment. (However, I must confess to a passion for reading real, physical books, away from the electronic distractions of today's environments.)

Libraries had a need for a single, driving organizational scheme since they often only had a few copies of a book and could not have them scattered across many shelves, classified in different ways. Now, multiple classifications/organization schemes can exist and cross-reference each other.

Where before knowledge extraction was all manual ... someone had to read the books, examine the world, organize and build on the knowledge, draw new insights and conclusions ... we now have tons of data stored on our computers and on the Web, and the help of the semantic web and description logic reasoners. Notice that I said "the help of semantic web" - it still requires a person to classify, organize and query knowledge in valid ways, and to interpret the results. I am not close to advocating for or finding the HAL computer from 2001. :-)

So, back to what others think about "organizing knowledge". I did a search on "organizing knowledge" on Amazon. Here is what I found (all quotations are from the editorial reviews on Amazon):

Organizing Knowledge (Jennifer Rowley and Richard Hartley) - "Incorporates extensive revisions reflecting the increasing shift towards a networked and digital information environment, and its impact on documents, information, knowledge, users and managers ... [offers] a broad-based overview of the approaches and tools used in the structuring and dissemination of knowledge".
Organising Knowledge: Taxonomies, Knowledge and Organisational Effectiveness (Patrick Lambe) - Defines and discusses various taxonomic forms and how these "can help organizations to leverage and articulate their knowledge"
The Organization of Information (Arlene Taylor) - "Provides a detailed and insightful discussion of such basic retrieval tools as bibliographies, catalogs, indexes, finding aids, registers, databases, major bibliographic utilities, and other organizing entities"
The Intellectual Foundation of Information Organization (Elaine Svenonius) - Analyzes the foundations of information organization, and then presents three bibliographic languages: work languages, document languages, and subject languages. From the review, "The effectiveness of a system for accessing information is a direct function of the intelligence put into organizing it."
Organizing Business Knowledge (Thomas Malone) - "Proposes a set of fundamental concepts to guide analysis and a classification framework for organizing knowledge, and describes the publicly available online knowledge base developed by the project, which includes a set of representative templates and specific case examples as well as a set of software tools for organizing and sharing knowledge"

As you can see, there is some interesting material out there, and some mundane stuff. I have ordered several of the books listed above and will report on them in future posts on this blog. Hopefully, the information will be of help to all of us.

Thinking about the "Curse of Knowledge"

2009-04-30T10:06:00.000-07:00

I was reading some old blog posts from Semantic Focus, and ran across one that was good food for thought - The Curse of Knowledge and the Semantic Web. Although I do not agree with everything in the article, it highlighted some important topics.

The premise is that experts include everything and the kitchen sink in an ontology (because they know so much about it) and use technology-specific language (which means little to people outside the domain of expertise). So, there ends up being a mapping problem between experts and lay people, and therefore between computers programmed (by people) to search for certain information.

On the importance (or curse) of mapping, I totally agree. However, the issue that peaks my interest is not the mapping between lay people and domain experts, as much as the mapping between perspectives of different groups in a business. These perspectives are what define the groups' vocabularies and ontologies. There is no single, "right" perspective - and there is a huge need to map and align the perspectives - to allow the unimpeded flow of information between groups, and to correct inconsistencies.

That is why I advocate mapping to an upper ontology. Upper ontologies capture general and reusable terms and definitions (for more information, see my earlier post). They should not restrict a mapping to a certain perspective, but allow all the perspectives to be aligned. (That is also why you may need more than one.) There will certainly be subsets and supersets of information, as well as information in only one perspective. That is to be expected. However, the relationships should be known, mappable and should NOT conflict.

Getting back to the article, it does highlight a few things to help with the "curse of knowledge":

Focus on the intent of the ontology, instead of the details (However, I think that you need both.)
Define small, focused ontologies, each with a single intent and extensions for details
Determine the core concept(s) and label them

I must add that the article also comments that experts have a problem explaining their domain to non-experts - because they know so much about the topic. With this, I disagree. An expert is one who can explain the core concepts of a domain simply. They can abstract the details to get at the essence of the topic, and yet, they can go "deep" to explain or advance the domain. Someone who simply knows some of the domain and can use the terminology (but not explain it) is not an expert - at least in my "vocabulary".

Musings on a Study on Twitter and Amorality

2009-04-28T10:41:00.000-07:00

On April 14th, ScienceDaily published an article entitled "Can Twitter Make You Amoral? Rapid-File Media May Confuse your Moral Compass". The research discussed in this article held similar themes to another, published in the summer of 2008 by The Atlantic magazine, "Is Google Making Us Stupid?"

These articles with their grabbing titles first hook me, and then make me think. None of them are as dismissive of modern technology as their titles suggest. However, they are clearly not entirely positive on some of the impacts of technology on us as humans, especially on our children.

For some technologists, the articles are dismissed as fear-mongering. Read Write Web (RWW) had a post that did just that ("Twitter Leads to Immorality? C'mon"). One thing that jumps out at me is the difference in the single word immorality in the RWW title, versus amorality in the ScienceDaily title. Amorality is actually outside the sphere of morality (it is not moral or immoral). However, immorality is a lack of morals. There is a big difference.

Let me quote some of the RWW article, which itself includes quotes from the original work reported by ScienceDaily...

"According to first author Mary Helen Immordino-Yang, "for some kinds of thought, especially moral decision-making about other people's social and psychological situations, we need to allow for adequate time and reflection." Unfortunately, in our "real-time" web of information flow, some things happen too fast for us to process. This leads to us never being able to fully experience emotions about other people's psychological states. "That would have implications for your morality," said Immordino-Yang. ...

Fear-Mongering about Digital Media, Take 3?

Media scholar Manuel Castells, holder of the Wallis Anneberg Chair of Communication Technology and Society at USC went on to further interpret the findings saying, "in a media culture in which violence and suffering becomes an endless show, be it in fiction or in infotainment, indifference to the vision of human suffering gradually sets in."

We can't help but feel we've heard similar strains of this same argument before. Doesn't it remind you of that old saying "TV will rot your brain?" Or maybe it's a throwback to the worrisome findings from the past decade about how violent video games supposedly lead to actual violence. ...

But is digital media really that bad? We think not. Maybe we can't properly feel the correct amount of compassion or pain when watching the Twitter stream update in TweetDeck, but is the Twitter stream really the place to go to experience these emotions anyway?"

The last sentence is indeed the question. At issue is the vast amount of time and attention that is paid to technological access of information, versus what is learned from person-to-person communication, self-reflection, deep reading, etc.

I would describe the current digital environment as one full of “distractions”. You can (simultaneously) carry on 5 different IMs, listen to music with an earbud in one ear, watch/listen to TV (and change the channel incessantly), and be online on your computer. I have seen it done! So, how do people today learn empathy, and to deal with quiet, with frustration, with maintaining focus while doing boring, mundane work? More and more, I see people who cannot read and write English - they instead read and write IM TXT (shortened words, no capitalization, no punctuation, ...). That is hardly the best for conveying deep thoughts!

Many children today (including mine) do not want to be in a quiet space because it is boring. Many want external influences to soothe them. Reading is a last resort activity, when there is nothing “more interesting” to do. It takes too much time!

We have created a world of constant stimulation and immediate reward – which does not equip us to live in human time (versus computer time), to learn to understand ourselves and others, and to deal with other people as well as life’s boredom and frustrations.

As technologists, I argue that we have a responsibility to at least understand the impacts of technology, if not work to correct them!

What Makes Semantic Web and OWL Useful?

2009-04-27T12:36:00.000-07:00

Well, to start with, the answer does NOT involve the use of XML (although that is convenient). XML is just a syntax (in search of a semantic :-). The real value in OWL is in the semantics that you can convey about a concept and its meaning relative to other concepts.

OWL builds on RDF and RDF-Schema (I talked about these briefly in an earlier post). From RDF and RDF-S, you get the ability to define classes (types of things), subclasses (more specific types of things), properties (and tie the applicability of the properties to different classes), and individuals (of a class). You can also label everything, and say where the concepts were defined using standard annotations. Interesting, but not enough, IMHO.

OWL then adds equality/inequality information for classes and properties, various property characteristics and restrictions (including cardinality), union/intersection and complement of classes, versioning information (like what an ontology is incompatibleWith), and other semantic details such as defining a class by an enumeration of its members or by specific values of its properties!

Sounds interesting - but what does this really mean? How about some examples?

equivalentClass, equivalentProperty - You can say that a class "Dog" and a class "Canine" are equivalent. Therefore any instances of the class, Canine, are reasoned to also be instances of the class, Dog. This is very necessary when aligning databases and different representation schemes!
disjointWith (class-level) - You can say that a class "Man" is disjoint from the class "Woman". Therefore, an instance cannot simultaneously belong to both classes - and a reasoner can infer that an instance that IS a Man, IS NOT a Woman.
sameAs and differentFrom (individual-level) - You can say that the Man named "Frank" is different from the Man named "George". In the Open World Assumption (see my definitions post if this doesn't mean anything to you), the Man Frank and the Man George may be the same person. Sometimes this is useful, and sometimes it is dangerous. Both Open and Closed World Assumptions come in handy.
inverseOf (property-level) - You can say that the property HasHusband is the inverse of HasWife. And, knowing that John's HasWife property is set to Mary, means that Mary's HasHusband property should/could be set to John.
TransitiveProperty, SymmetricProperty and FunctionalProperty - These concepts take you back to your math days in high school. A transitive property means that if a is related to b, and b is related to c, then a is related to c. The most often cited example of this is ancestry. If Mary is the ancestor of Bob, and Bob is the ancestor of Sue, then Mary is the ancestor of Sue. A symmetric property is one that holds in any order. An example of this is friendship - if Mary is friends with Julie, then Julie is friends with Mary (or so we hope). Lastly, a functional property means that there is zero or one unique value for an individual (remember a function has one output for each input). Cool!
allValuesFrom, someValuesFrom (property restrictions) - You can say that all values of the property, HasWife, must come from the class, Woman. Or, using the someValuesFrom restriction, you can indicate that at least one of the values of a property must range over the instances of a particular class. For example, a medical doctor can have a property HasCollegeDegrees, that must include at least one instance of the M.D. degree.
oneOf - A great example of this is the property DaysOfTheWeek, which must be oneOf Sunday, Monday, Tuesday, ... (at least in English). This is your basic enumeration!
hasValue - You can define a class by the value of its properties. For example, a Student is defined as someone with a value in its property, CurrentSchool.
unionOf, complementOf, intersetionOf (class-level) - These allow the combination of classes and restrictions. A great example is the membership of the European Union - which can be defined as the union of all citizens of all the member countries.

"Top Down" or "Bottom Up" Ontologies

2009-04-15T10:41:00.001-07:00

I received the following question from a colleague of mine... He asked about the benefits and risks of using a single standardized ontology (a “top down” approach) versus using local, private, or community ontologies (“bottom up”). Unfortunately, the benefits of one are the risks of the other! A single standardized ontology admits no errors of translation or omission. However, consensus ranges from difficult to impossible to obtain, and usually many concessions have to be made during its definition. Local or community ontologies are natural, and admit no frustrations or human errors due to learning new representations, or due to using concepts that have little semantic meaning in a community. However, you typically have lots of community ontologies and need to interoperate between them.

What is a possible answer? Take the local, private and community ontologies of your business and map them "up" to an existing "standardized ontology" - such as exists in medicine or even construction - see, for example, ISO 15926. (I already discussed the possibilities of ontology alignment provided by the Semantic Web in earlier posts, and will provide more details over the next few weeks.)

Or, if a standard ontology does not exist, create one from the local ontologies by mapping the local ones to one or more "upper" ontologies. At this point, some people will say "ughhh" another term - "upper" ontology - what the heck is that? Upper ontologies capture very general and reusable terms and definitions. Two examples that are both interesting and useful are:

SUMO (http://www.ontologyportal.org), the Suggested Upper Merged Ontology - SUMO incorporates much knowledge and broad content from a variety of sources. Its downside is that it is not directly importable into the Semantic Web infrastructure, as it is written in a different syntax (something called KIF). Its upsides are its vast, general coverage, its public domain IEEE licensing, and the many domain ontologies defined to extend it.
Proton (http://proton.semanticweb.org/D1_8_1.pdf), PROTo ONtology - PROTON takes a totally different approach to its ontology definition. Instead of theoretical analysis and hand-creation of the ontology, PROTON was derived from a corpus of general news sources, and hence addresses modern day, political, financial and sports concepts. It is encoded in OWL (OWL-Lite to be precise) for Semantic Web use, and was defined as part of the European Union's SEKT (Semantically Enabled Knowledge Technologies) project, http://www.sekt-project.com. (I will definitely be blogging more about SEKT in future posts. There is much interesting work there!)

Now, I must be clear that I do NOT advocate pushing the standard ontology down to the local communities - unless there are only small tweaks to making the standard ontologies work there. With ontology alignment technologies, you can have the best of all worlds - a standard ontology to use when unifying and analyzing the local ontologies, but all the naturalness of the local ontologies for the communities.

What knowledge does a business need to capture?

2009-04-13T21:49:00.000-07:00

If you talk to business rules or security vendors, you get one answer. If you talk to database and modeling folks, you get another answer. If you talk to business process or social networking vendors, you guessed it - yet other answers!

However, to understand, support and protect a business, its work products and its organizational units, you need all the following knowledge:

Who - the social/organizational aspects to understand responsibilities, privileges, networks, interdependencies and more
How - the processes and tasks of the business, describing the states of the business and interactions among its agents, hopefully tying together and allowing a progression from high-level descriptions to the necessary level of detail (and this information should address both the human and automated aspects of the processes and tasks)
Why - the intentions, goals and beliefs of the business (they really need to be written down and used in decision-making)
What - the basic terminologies and domain concepts, along with their meanings, details/attributes and relationships

BTW, you also need the lineage or pedigree of the knowledge and how it has changed over time. Time and change are very critical aspects of business! Details of a change (before and after) or the temporal relevancy of information are often important to retain, especially for compliance reasons.

Any of this data defined and used in isolation is incomplete and therefore, subject to interpretation and erroneous assumptions. At worst, the data disagrees from one usage or silo to the next, and then your business is just waiting for the next fire to put out!

It is necessary to find a way to tie all the usages and silos of information (written of course in different syntaxes, from different vendors, using different standards) together!

Semantic Web and Business (Part 3)

2009-04-09T11:25:00.000-07:00

In case anyone is confused by all the technical terms used in semantic computing, here is an explicit translation from ontology "language" to English:

Concept = class = noun = vocabulary word
Triple = subject-predicate-object (such as "John went to the library" - where "John" is the subject, "went-to" is the predicate, and "library" is the object)
Role = relation = association = the predicate in the triple = verb
Instance = a specific occurrence of a concept or relationship (can be manually defined or inferred)
Axiom = a statement of fact/truth that is taken for granted (i.e., is not proved)
Inference = deriving a logical conclusion from definitions and axioms
T-Box = a set of concepts and relationships (i.e., the definitions)
A-Box = a set of instances of the concepts and relationships
Hierarchy = arrangement of concepts or instances by some kind of classification/relationship mechanism - typical classification hierarchies are by type ("is-a" relationships - for example, "a tiger is a mammal") or by composition ("has-a" relationships - for example, "a person's name has the strucutre: personal or first name, zero or more middle names, and surname or last name")
Subsumption = is-a classification (determining the ordering of more general to more specific categories/concepts)
Consistency analysis = check to see that all specific instances make sense given the definitions, rules and axioms of an ontology
Satisfiability analysis = check to see that an instance of a concept can be created (i.e., that creating an instance will not produce an inconsistency/error)
Key = one or more properties that uniquely identify an individual instance of a concept/class
Monothetic classification = identifying a particular instance with a single key
Polythetic classification = identifying a particular instance by several possible keys which may not all exist for that instance
Surrogate key = an artificial key
Natural key = a key that has semantic meaning
CWA = Closed World Assumption (in databases) = anything not explicitly known to be true is assumed to be false (for example, if you know that John is the son of Mary but have a total of 3 children defined - John, Sue and Albert - and you ask who all the children of Mary are ... you get the answer "John" - 1 child)
OWA = Open World Assumption (in semantic computing) = anything not explicitly known is assumed to be true (using the same scenario above, asking the same question ... you get the answer "John, Sue and Albert" - 3 children)

These are the terms that come to the top of my mind, when I think about ontologies. But, if there are others, just send me email or leave me a comment.

Semantic Web and Business (Part 2)

2009-04-09T11:03:00.000-07:00

In the last post, I talked about business' implicit ontologies and using semantic computing to help map and align different ontologies. In this post, I want to spend some time on the basics of ontology analysis and what a semantic (description logic) reasoner can do.

A description-logic reasoner (DL reasoner) takes concepts, individual instances of those concepts, roles (relationships between concepts and individuals) and sometimes constraints and rules - and then "reasons" over them to find inconsistencies (errors), infer new information, and determine classifications and hierarchies. Some basic relationships that are always present come from first-order logic - like intersections, unions, negations, etc. These are explicitly formalized in languages like OWL.

The reasoner that I am now using is Pellet from Clark and Parsia (http://clarkparsia.com/pellet/). It is integrated with Protege (which I mentioned in an earlier post), but also operates standalone. The nice thing is that Pellet has both open-source and commercial licenses to accomodate any business model - and is doing some very cool research on data validation and probabilistic reasoning (which you can read about on their blog, http://clarkparsia.com/weblog/).

How cool is it when you can get a program to tell you when your vocabulary is inconsistent or incomplete? Or, when a program can infer new knowledge for you, when you align two different vocabularies and then reason over the whole? No more relying on humans and test cases to spot all the errors!

Semantic Web and Business (Part 1)

2009-04-08T10:30:00.000-07:00

Most people think of Semantic Web as a "pie in the sky", impossible "field of dreams". But, that is being short-sighted. Semantic web technologies are here today and being used for some extremely interesting work.

Typically, you hear about semantic web as a way for computers to understand and operate over the data on the web, and not just exchange it via (mostly XML-based) syntaxes. However, to "understand" something, you must speak a common language and then have insight into the vocabulary and concepts used in that language. Well, the semantic web languages exist - they are standards like RDF (Resource Description Language), RDF-S (RDF Schema), and OWL (Web Ontology Language). These syntaxes carry the details of the concepts, terms and relationships of the vocabulary. (Note that I provided only basic links to the specifications here. There is much more detail available!)

One problem is defining the syntax - and we are getting there via the work of the W3C. The next problem is getting agreement about the vocabulary. That is much harder - since every group has their own ideas about what the vocabulary should be. So, here again, the Semantic Web steps in. Semantic Web proponents are not just researching how to define and analyze vocabularies (you could also use the word, "ontology", here) - but how to merge and align them!

So, where does this intersect with business? Businesses have lots of implicit vocabularies/ontologies (for example, belonging to procurement, accounts payable, specific domain technologies integral to the organization, IT and other groups). And, business processes and data flows cross groups and therefore, cross vocabularies - and this leads to errors! Typically, lots of them!

Does this mean that everyone adopt a single vocabulary? Usually that is not even possible ... People who have learned a vocabulary and use it to mean very specific things, cannot easily change to use a new, different word. Another problem is agreeing on what a term means - like "customer" (is that the entity that pays for something, an end-user, or some other variant on this theme?).

Changing words will cause a slow down in the operations of the business due to the need to argue over terminology and representation. Then if a standard vocabulary is ever in place, there will be slowdowns and errors as people try to work the new vocabulary into their practices and processes. (BTW, I think that this is one reason that "standard" common models or a single enterprise information model are so difficult to achieve.)

How do we get around this? Enter the Semantic Web to help with the alignment of vocabularies/ontologies. But, first the vocabularies have to be captured. Certainly, no one expects people to write RDF, RDF-S or OWL. But, we all can write our natural languages - and that takes us back to "controlled languages" as I discussed in my previous post. I have a lot of ideas on how to achieve this ... but, this will come in later posts.

So, more on this in later weeks, but hopefully this post provides some reasons to be interested in the semantic web (more than just its benefits to search) ...

DSLs - Do we have to love them?

2009-04-07T10:30:00.000-07:00

DSL stands for "domain-specific language". And, according to Wikipedia (http://en.wikipedia.org/wiki/Domain-specific_programming_language), it is "a programming languaage or specification language dedicated to a particular problem domain, a particular problem representation technique, and/or a particular solution technique." Most likely, because the tools to produce them are programmer-oriented, DSLs define specific syntax (usually with seemingly bizarre semi-colons at the end of each definition) providing the inputs to computer frameworks or applications. Some examples are syntax to define security or systems management policies, definitions of how an application should be created or deployed, or even something simple like giving your name and a list of friends.

Why do systems engineers think that these are cool? Because they are fun to create, and are simpler to write and use than writing in a programming language or XML.

But, when is enough enough? Every application could end up with its own DSL - because each application expects specific data in some specific format. So, just like today, there are tons of user interfaces (but the industry is trying to standardize on a few due to customer pushback), we have (or if you don't think that we are there yet, will likely have) tons of DSLs. Talk about a business/IT nightmare! Think about everything that you have to remember!

What are some alternatives? How about natural language? Not the messy grammar and slang of everyday natural language ... but a "controlled" version of this. What does this mean? Well, I like using Wikipedia (when its definitions are solid) - so, let's take their definition (http://en.wikipedia.org/wiki/Controlled_natural_language). Controlled NLs are "subsets of natural languages, obtained by restricting the grammar and vocabulary in order to reduce or eliminate ambiguity and complexity. Traditionally, controlled languages fall into two major types: those that improve readability for human readers (e.g. non-native speakers), and those that enable reliable automatic semantic analysis of the language."

Two excellent examples of the latter category are Attempto Controlled English (http://attempto.ifi.uzh.ch/site/) and a translation of OMG's Semantics of Business Vocabulary and Business Rules into English (in the appendices of the spec at http://www.omg.org/spec/SBVR/1.0/). (Note: the "official" SBVR definition is XML-based, and not very human readable/writable or anything close to controlled English.) :-) An interesting fact is that Attempto Controlled English has an add-in for Protege which allows the translation of English-defined vocabulary and rules into OWL and SWRL! (If you don't know what these are - no worries - I plan on spending some time defining them ... they are semantic computing standards.)

At the end of the day, I think that we need more natural interfaces and input mechanisms for business and IT people, and less techy specific languages (insert here: DSLs).

Welcome ...

2009-04-06T13:29:00.000-07:00

For those who know me, you know that I used to have a blog at msdn (http://blogs.msdn.com/policy_based_business), and I used to work for Microsoft. Well, that all changed in early 2009 when my incubation was de-funded, and then in March when I headed out on my own.

I am now consulting and working on software for capturing, analyzing and using the "implicit" ontologies and domain knowledge that exists in business people's heads. The work is based on several technologies addressing:

ontology development and alignment
controlled natural language processing
semantic web
knowledge engineering
business process development and modeling
and more!

... all accessed through normal business tooling like Word and Excel!

What I will try to do in my posts is to explain the technology and how it can be useful. My goal is to communicate with both business and IT people - providing summaries, additional thoughts, and technical details. I also will provide pointers to the basic information and research, as well as a pointers to my own work. There is a lot out there, if you have the time to investigate it!

So, please stay tuned. And, I hope that this blog will be of great value to you.