It all comes down to one simple question.
Anything electronic from the RFID in your credit card to the latest and greatest CPU or GPU and everything in-between is based on the very basic idea of the logic gate. In reality, there are only three basic types of logic gates that make this all possible. The AND gate, OR gate, and XOR gate. For that matter, there are only a few other pieces needed to turn these simple digital logic components into the most powerful system in the world.
Logic gates in their elementary form are quite simple. Input 1 AND input 2 turn on the AND gate. Input 1 OR input 2 or Input 1 AND input 2 turns on the OR gate. The XOR is an exclusive OR gate. This means that input 1 OR input 2 will turn on the gate but not input 1 and input 2 like the standard OR gate. Maybe the OR gate should have been the MAYBE gate. You can emulate an XOR gate by binding an AND and an OR gate together in a specific configuration, its all in the logic of outputs to inputs.
Chain enough of these together, and your input questions are only limited by the physical inputs and power consumption. Add the inverters and buffers to the mix, and you are on your way to building a computer. Of course, you need the support components such as capacitors and resistors and the production facilities to jam millions upon millions of them onto a piece of silicon the size of a dime. But in the end, no matter how complex the processing unit, the computing power comes from individual digital logic gates tied together as a hardware decision tree.
Some of these processors are general purpose, like the processor in your phone or desktop computer. Some of them are designed to be dedicated to only one task; these are generally called embedded processors. Still, in the end, it is all based on three simple logic gates. The graphic below shows these three gates and their possible states.
Sometimes as I work on these posts, especially the technical ones I have moments and awakenings as I think deeply about what I am trying to convey. In this instance, though I have been into digital electronics since before I was a teenager, I noticed something new, or a new way of looking at this.
The most basic gates always have 2 inputs. Technically the inverter could be considered a 1 input gate but it does not make any decisions, it only inverts 1 to 0 or 0 to 1. Though the inverter is a very powerful part of this puzzle that can help make the logic gates do tricks it has no true decision making function. The AND, OR, and XOR make all of the hard decisions. So what I noticed is that the AND gate and the OR gate have have 3 possibilities of one state and the XOR gate has two possibilities of one state. I realize this from the digital logic standpoint but up until this point I never thought about it other than to write the flow of a logic decision. There is an elegance in the balance of states that are available between these 3 logic gates.
Adding one of every gate and every state of that gate gives you equal possibility for either the 0 or 1, positive or negative answer. 6 possible yes answers, 6 possible no answers. And this is with just two inputs per gate. When we get up into the multi bit gates the possible answer chains are in the millions. Then to go way out in left field there are tri state gates, which is a deep topic for another post, or even beyond that the quantum gates that are being experimented with in the quantum computing field. Though in the end everything, even the way we think as humans comes down to a series of if then statements, a decision tree. It just happens that humans have an analog brain and a near infinite number of choices, just like our DNA.
These digital logic gates end up being the hardware decision tree that will ultimately give you the answers.
The If-then algorithms used by ML and pretty much all other software is based on the exact same thing. If this data matches that data AND that data matches this data OR that data then do this. The logic is the same, if all of your conditions are met then your output is a 1, go do this thing or get that data. If all of your conditions are not met then the answer is 0 and you do not store that data or get an alert or whatever else your software is setup to do.
You can write what is called a truth table for all combinations of logic gates. In the end your ML and AI if statements create their own truth table. Lets look at a comparison of the truth table for the logic gates above and the truth table for a simple if-then decision tree.
This is the basic truth table for each basic 2 input logic gate type. It runs on 1’s and 0’s, On, Off, High, Low, depending on your terminology. In the end they all just mean either the input is true or the input is false, pretty much the same as any if then decision tree.
Now lets look at an algorithm based on the same type of truth tables. We will assume that we are looking at Cisco ASA firewall logs. I am using this as an example since it is the most common type of firewall that I know of. The example log entry we are looking at is below.
Jun 11 2021 04:54:48: %ASA-4-106023: Deny tcp src outside:192.168.208.63/46857 dst inside:192.168.150.77/443 by access-group "OUTSIDE" [0x5063b82f, 0x0]
This log line is fairly self explanatory, this says that a TCP connection from 192.168.208.63 port 46857 on the outside connection to 192.168.150.77 port 443 on the inside interface was denied by access-group OUTSIDE.
Now we need conditions for the ML to decide if this data should be saved. We will create the scenario where we are interested in all tcp traffic denied to port 443 on the inside interface within the last 15 minutes. So to first make sense of this it is best to break the log entry down into individual parts. I will use Elasticsearch formatting since this is what I know the best so it is easiest for me to work with.
The Elasticsearch beats system has built in decoders for many Cisco ASA devices. I am going to take this the logstash route and split it up with grok because I believe it gives a better understanding of how these things are broken down. The grok to split the above line is below.
%{CISCOTIMESTAMP:timestamp}: \%ASA-%{NOTSPACE:asa_id}: %{WORD:action} %{WORD:protocol}
%{WORD} %{WORD:src}:%{IP:src_ip}/%{NUMBER:src_port} %{WORD} %{WORD:dst}:%{IP:dst_ip}
/%{NUMBER:dst_port} by access-group "%{WORD:access_group}" %{GREEDYDATA:cisco_code}
With this grok splitting the data into fields we end up with 12 fields possible for input. Above I said that we were looking for tcp traffic denied to port 443 in the last 15 minutes. Compared to two input digital logic gates mentioned above this logic will have 3 inputs as shown in the truth table below. This will be a single AND gate because we have given it nothing to OR on. It has to be a specific time AND protocol AND port.
As you can see from the truth table our logic is a 3 input AND gate with 8 potential input positions. There are 7 chances of false and 1 chance of true in the output. The above log entry would hit all of the requirements of the truth table making this a true IF and in the simplest of terms a true AND gate. Graphically it would look like the image below.
Since at the basic level all logic gates are only two inputs you have to tie multiple gates together in a pattern based on the output that you want. You will notice in the logic above that protocol has an input to each AND gate. There are other ways to tie the gates together to bend the output to what you want but basically this is how a logic gate array, or decision tree works when comparing digital logic to if then logic.
This is one of the most basic examples of how this would works. Lets work up a slightly more complex example and draw the logic chart on that. So now we will say, if date was within the last 15 minutes, and traffic was denied to ports 80, 443, 22, or 25 only if the access group is outside. This will take AND along with OR gates.
The more you build upon your query the more complex the logic gets. Though digital logic gates work on the bit level and your queries work on a multi bit level so where showing the gates is good for a visual representation of how the logic works the job of turning your algorithm’s and queries into something the individual logic gates can use is a complex process.
Every piece of code that you write to run on a digital system has to convert what you have written all the way back down to 1’s and 0’s to be pushed through the logic gates that make up the processor or other digital device that you are working with. When you hear 32 bit or 64 bit instruction pipeline, that is just a count of how many 1’s and 0’s the computer can process in one batch. That is it, nothing more, a number of 1’s and 0’s equal to the bit count of your computer. This is where the number size limitations come in based on bit size. The system can only handle a number as big as the number of 1’s and 0’s it can fit on the bus at any onetime. Large jobs can be split up and processed a chunk at a time but you are still really limited by the processor bit count.
So any code or data that you use is always converted to binary 1’s and 0’s before the microprocessor can do anything with it. Like shown in the first image, the whole processor is millions of those logic gates, they only know on and off, nothing else. A decent slice of program running time is this conversion between the data you have and the binary data that the computer needs and then on the output again it only knows 1’s and 0’s so there is the time to convert that data back from 1’s and 0’s into something we can use.
To wrap up this post, the point is that no matter how complex your ML or AI it all comes back down to the simple 2 input logic gate that is the basis of everything digital that we know.
Ponder on this deeply, it may help your logic design for future projects.