Event classification using synthetic data sets
Systems and methods include determination of a plurality of event types, determination of a plurality of associated metrics for each of the plurality of event types, generation of synthetic time-series data of each of the metrics associated with the event types for each of the plurality of event type, the synthetic time-series data representing metric anomalies and events of the event type, training of a first system to generate anomaly values based on the synthetic time-series data, training of a second system to classify event types based on the anomaly values, determination of an anomaly value for each data instance of actual time-series data, determination of event types for each determined value, selection of data instances based on the determined values and event types, reception of an event type for each selected data instance, and re-training of the second system based on the selected data instances and event types.
1 . A system comprising:
a memory storing processor-executable program code; and
at least one processing unit to execute the processor-executable program code to cause the system to:
determine a plurality of metrics;
generate synthetic time-series data of each of the plurality of metrics;
determine a plurality of data instances, each of the plurality of data instances comprising a value of each generated synthetic time-series data for a first respective time period;
associate an event type label with each of the plurality of data instances;
train a first system based on the plurality of data instances to generate a score predicting a degree to which an input data instance represents an anomaly;
train a second system based on the plurality of data instances and their associated event type labels to classify scores generated by the first system;
receive actual time-series data of each of the plurality of metrics at the first system;
generate actual data instances from the actual time-series data, each actual data instance associated with a respective time period;
determine a score for each actual data instance using the trained first system;
determine an event types for each determined score using the trained second system;
select one or more of the actual data instances based on at least one of the determined scores and the determined event types;
present the selected data instances to an operator and, for each selected data instance, receive an operator-specified event type from the operator; and
re-train the second system based on the selected data instances and their operator-specified event types.
2 . A system according to claim 1 , wherein selection of one or more of the actual data instances comprises identification of maximum determined scores for which no event type was determined, and selection of data instances associated with the maximum determined scores.
3 . A system according to claim 2 , wherein selection of one or more of the actual data instances comprises identification of scores for which an event type was determined, and selection of data instances associated with the scores for which an event type was determined.
4 . A system according to claim 3 , wherein selection of the one or more of the actual data instances comprises selection of a predetermined ratio of data instances associated with scores for which no event type was determined to data instances associated with scores for which an event type was determined.
5 . A system according to claim 3 , wherein a score for each actual data instance is determined based on a score for each metric of the actual data instance, and wherein selection of the one or more of the actual data instances comprises selection of actual data instances associated with a non-NULL event type and having a highest average score for the metrics associated with its non-NULL event type.
6 . A system according to claim 1 , wherein a score for each actual data instance is determined based on a score for each metric of the actual data instance, and wherein selection of the one or more of the actual data instances comprises selection of actual data instances associated with a non-NULL event type and having a highest average score for the metrics associated with its non-NULL event type.
7 . A system according to claim 1 , wherein a score for each actual data instance is determined based on a score for each metric of the actual data instance, and wherein selection of the one or more of the actual data instances comprises selection of actual data instances associated with a non-NULL event type and having a lowest average score for the metrics associated with its non-NULL event type.
8 . A computer-implemented method comprising:
generating synthetic time-series data of each of a plurality of metrics;
determining a plurality of data instances, each of the plurality of data instances comprising a value of each generated synthetic time-series data for a first respective time period;
associating an event type label with each of the plurality of data instances;
training a first system based on the plurality of data instances to generate a score predicting a degree to which an input data instance represents an anomaly;
training a second system based on the plurality of data instances and their associated event type labels to classify scores generated by the first system into event types;
receiving actual time-series data of each of the plurality of metrics at the first system;
generating actual data instances from the actual time-series data, each actual data instance associated with a respective time period;
determining a score for each actual data instance using the trained first system;
determining an event types for each determined score using the trained second system;
selecting one or more of the actual data instances based on at least one of the determined scores and the determined event types;
presenting the selected data instances to an operator and, for each selected data instance, receiving an operator-specified event type from the operator; and
re-training the second system based on the selected data instances and their operator-specified event types.
9 . A method according to claim 8 , wherein selecting one or more of the actual data instances comprises identification of maximum determined scores for which no event type was determined, and selecting actual data instances associated with the maximum determined scores.
10 . A method according to claim 9 , wherein selecting one or more of the actual data instances comprises identifying scores for which an event type was determined, and selecting actual data instances associated with the scores for which an event type was determined.
11 . A method according to claim 10 , wherein selecting the one or more of the actual data instances comprises selecting a predetermined ratio of actual data instances associated with scores for which no event type was determined to actual data instances associated with scores for which an event type was determined.
12 . A method according to claim 10 , wherein a score for each actual data instance is determined based on a score for each metric of the actual data instance, and wherein selecting the one or more of the actual data instances comprises selecting actual data instances associated with a non-NULL event type and having a highest average score for the metrics associated with its non-NULL event type.
13 . A method according to claim 8 , wherein a score for each actual data instance is determined based on a score for each metric of the actual data instance, and wherein selecting the one or more of the actual data instances comprises selecting actual data instances associated with a non-NULL event type and having a highest average score for the metrics associated with its non-NULL event type.
14 . A method according to claim 8 , wherein a score for each actual data instance is determined based on a score for each metric of the actual data instance, and wherein selecting the one or more of the actual data instances comprises selecting actual data instances associated with a non-NULL event type and having a lowest average score for the metrics associated with its non-NULL event type.
15 . A computer-readable medium storing processor-executable program code, the program code executable by a computing system to:
determine a plurality of metrics;
generate synthetic time-series data of each of the plurality of metrics;
determine a plurality of data instances, each of the plurality of data instances comprising a value of each generated synthetic time-series data for a first respective time period;
associate an event type label with each of the plurality of data instances;
train a first system based on the plurality of data instances to generate a score predicting a degree to which an input data instance represents an anomaly;
train a second system based on the plurality of data instances and their associated event type labels to classify scores generated by the first system into event types;
receive actual time-series data of each of the plurality of metrics at the first system;
generate actual data instances from the actual time-series data, each actual data instance associated with a respective time period;
determine a score for each actual data instance using the trained first system;
determine an event types for each determined score using the trained second system;
select one or more of the actual data instances based on at least one of the determined scores and the determined event types;
present the selected data instances to an operator and, for each selected data instance, receive an operator-specified event type from the operator; and
re-train the second system based on the selected data instances and their operator-specified event types.
16 . A medium according to claim 15 , wherein selection of one or more of the actual data instances comprises identification of maximum determined scores for which no event type was determined, and selection of actual data instances associated with the maximum determined scores.
17 . A medium according to claim 16 , wherein selection of one or more of the actual data instances comprises identification of scores for which an event type was determined, and selection of actual data instances associated with the scores for which an event type was determined.
18 . A medium according to claim 17 , wherein selection of the one or more of the actual data instances comprises selection of a predetermined ratio of actual data instances associated with scores for which no event type was determined to actual data instances associated with scores for which an event type was determined.
19 . A medium according to claim 17 , wherein a score for each actual data instance is determined based on a score for each metric of the actual data instance, and wherein selection of the one or more of the actual data instances comprises selection of actual data instances associated with a non-NULL event type and having a highest average score for the metrics associated with its non-NULL event type.
20 . A medium according to claim 15 , wherein a score for each actual data instance is determined based on a score for each metric of the actual data instance, and wherein selection of the one or more of the actual data instances comprises selection of actual data instances associated with a non-NULL event type and having a lowest average score for the metrics associated with its non-NULL event type.