Data generation device, data generation method, program, and machine learning system

Abstract

A data generation device according to one aspect of the present invention is equipped with a data classification unit and a data generation unit. The data classification unit classifies existing data collected from an environment that can be used to test a target production environment, into normal state data and failure data. The data generation unit generates failure data for the target production environment on the basis of normal state data for the target production environment and the classified normal state data and failure data.

Description

[Technical Field]

[0001] One aspect of the present invention relates to a data generation device, a data generation method, a program, and a machine learning system that generate learning data for a machine learning model that detects anomalies such as failures. [Background technology]

[0002] Systems are developed with the ultimate goal of being applied to a target production environment. However, before the product is released, it is essential to conduct testing in a verification environment or staging environment that mimics the production environment. The same is true for AI (Artificial Intelligence) development, which has increasingly been discussed in conjunction with MLOps (Machine Learning Operations).

[0003] In recent years, attempts have been made to operate networks by using AI models trained on learning data related to network operations. To train an AI model, it is necessary to provide a large amount of data on the network's normal operating state (normal state data) and data on when a failure occurs (failure data) to the untrained model. However, since reproducing a failure in a production environment involves significant risks, it is difficult to collect a large amount of this data. Therefore, a technology has been proposed in which a mirror environment of the production environment is constructed and both the normal state data and the abnormal state data required for machine learning are generated in the mirror environment (see Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] D. Li, K. Akashi, H. Nozue and K. Tayama, "A Mirror Environment to Produce Artificial Intelligence Training Data," in IEEE Access, vol. 10, pp. 24578-24586, 2022, doi: 10.1109 / ACCESS.2022.3154825. Summary of the Invention [Problem to be solved by the invention]

[0005] By repeating the process of simulating normal network operating conditions in a mirror environment, artificially inducing failures, and then restoring the network to normal, it is possible to obtain large amounts of normal and abnormal data. However, there is an issue in that building a mirror environment is difficult in the first place. In other words, it is desirable for the mirror environment to resemble the production environment as closely as possible, but the closer the two are, the higher the cost. Simply copying the environment can double the cost, or even more. Furthermore, there are some systems for which it is nearly impossible to build a mirror environment. There is a need for technology that can generate large amounts of useful learning data for individual network systems at low cost.

[0006] This invention was made in light of the above circumstances, and aims to provide a technology that can generate the training data necessary for training an AI model at low cost. [Means for solving the problem]

[0007] According to one aspect of the present invention, a data generation device includes a data classification unit and a data generation unit. The data classification unit classifies existing data collected from an environment applicable to verification of the production environment into normal state data and abnormal state data. The data generation unit generates abnormal state data for the production environment based on the normal state data for the production environment and the classified normal state data and abnormal state data. [Effects of the Invention]

[0008] According to one aspect of the present invention, it is possible to provide a technology that can generate training data required for training an AI model at low cost. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing an example of a system to which a data generating device according to an embodiment of the present invention is applied. [Figure 2] FIG. 2 is a block diagram showing an example of the training data generating device 3 shown in FIG. [Figure 3] FIG. 3 is a functional block diagram illustrating an example of the training data generating device 3 shown in FIG. [Figure 4] FIG. 4 is a functional block diagram illustrating an example of a machine learning system according to an embodiment. [Figure 5] FIG. 5 is a diagram illustrating the flow of data exchanged between the training data generation device 3, the existing environment 80, the AI ​​model 2, and the production environment 70. [Figure 6] FIG. 6 is a diagram illustrating an example of a processing procedure of the machine learning system according to the embodiment. [Figure 7] FIG. 7 is a diagram showing an example of changes in metrics values ​​in existing data. [Figure 8] FIG. 8 is a diagram for explaining calculation of abnormality data in the production environment. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. [One embodiment] <Configuration> Fig. 1 is a diagram showing an example of a system to which a data generation device according to an embodiment of the present invention is applied. The system shown in Fig. 1 is a system that operates a target system 1, such as a network system, using an AI model 2. This system further includes a training data generation device 3. The training data generation device 3 generates training data for training the AI ​​model 2.

[0011] 2 is a block diagram showing an example of the training data generation device 3 shown in FIG. The training data generation device 3 is a computer including a processor 10, a memory 20, a storage 30, an input / output interface (I / F) 40, and a bus 45 interconnecting these components. The input / output I / F 40 establishes communication links between the training data generation device 3 and the target system 1 and AI model 2, and exchanges various types of data. The processor 10 is a computing device such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), and realizes the processing functions of the embodiment in accordance with a program loaded from the storage 30 to the memory 20.

[0012] Fig. 3 is a functional block diagram showing an example of the training data generation device 3 shown in Fig. 2. In Fig. 3, a memory 20 is a semiconductor memory such as a ROM (Read Only Memory) or a RAM (Random Access Memory).

[0013] The storage 30 is a non-volatile memory such as a hard disk drive (HDD) or a solid state drive (SSD), and stores a program 34 for implementing the processing according to the embodiment in addition to basic software such as an operating system (OS). That is, the program 34 can be installed in the training data generation device 3.

[0014] The storage 30 also includes an existing data storage unit 31, a calculation data storage unit 32, and a learning data storage unit 33 as storage areas required to implement an embodiment of the present invention.

[0015] The existing data storage unit 31 stores existing data collected from an environment applicable to the verification of the production environment. The existing data may be, for example, metric values ​​such as CPU usage rate and memory usage rate. Here, an environment applicable to the verification of the production environment refers to an environment, such as a verification environment or a staging environment, whose constituent devices and environmental configuration are similar to those of the production environment. Such environments may be collectively referred to as similar environments. Furthermore, existing data (similar data) refers to data collected from an environment similar to the production environment.

[0016] The calculation data storage unit 32 stores abnormality data in the production environment generated by the processor 50. The learning data storage unit 33 stores the normal data in the production environment and the abnormal data in the production environment generated by the processor 50 as learning data for the machine learning model (AI model 2).

[0017] The processor 50 includes, as processing functions according to one embodiment of the present invention, a data classification unit 51, a data generation unit 52, and a data management unit 53. The data classification unit 51, the data generation unit 52, and the data management unit 53 are realized by the processor 10 executing a program loaded into the memory 20. In other words, the program 34 includes instructions that cause the processor 50 to function as the data classification unit 51, the data generation unit 52, and the data management unit 53.

[0018] The data classification unit 51 classifies the existing data stored in the existing data storage unit 31 into normal data and abnormal data. As a result, the existing data is classified into data when the existing environment is normal and data when the existing environment is abnormal.

[0019] The data generator 52 generates abnormal data for the production environment based on the normal data for the production environment, the normal data for the existing environment, and the abnormal data for the existing environment. The data generator 52 generates the abnormal data for the production environment, for example, by mapping the abnormal data for the existing environment to the abnormal data for the production environment based on the relationship between the normal data for the existing environment and the normal data for the production environment.

[0020] Data mapping is a term that refers to the process of, for example, resolving differences between databases of different systems and integrating digital data. Those skilled in the art can easily understand data mapping. Data mapping in the embodiments will be described later.

[0021] The data management unit 53 stores and manages the normal data in the production environment and the generated abnormal data in the production environment in the learning data storage unit 33 as learning data for the AI ​​model 2.

[0022] 4 is a functional block diagram showing an example of a machine learning system according to an embodiment. This system includes a mirror environment creating device 60 that recreates a production environment, and a learning data generating device 3. The AI ​​model 2 is trained by repeatedly providing learning data generated by either the mirror environment creating device 60 or the learning data generating device 3, and then deployed in a production environment 70.

[0023] 4, the mirror environment forming device 60 includes a production environment reproducing unit 11, an event generating unit 12, a recovery unit 13, and a data managing unit . The production environment reproducing unit 11 acquires information from the production environment, and creates a mirror environment corresponding to the production environment of the target system 1 (FIG. 1) based on the acquired information. The event generating unit 12 artificially generates, in the mirror environment, a first operating state that simulates a normal operating state and a second operating state that corresponds to an operation when a failure occurs. The recovery unit 13 performs a process of recovering the second operating state that has occurred in the mirror environment, and a process of causing the event generation unit 12 to generate the second operating state again in the mirror environment. The data management unit 14 has a function for selecting an operation mode. In this embodiment, three modes, Mode A, Mode B, and Mode C, are assumed.

[0024] Mode A is a mode in which there is no existing environment and no existing data. In this mode, a mirror environment is used. Mode B is a mode in which there is an existing environment but no existing data. In this mode, the existing environment is used as the production environment reproduction unit 11 of the mirror environment. Mode C is a mode in which there is no existing environment but there is existing data. In this mode, normal data from the production environment is used as normal data for learning, and abnormal data from the production environment generated by the learning data generation device 3 is acquired as abnormal data for learning, and the AI ​​model 2 is trained using this data.

[0025] The AI ​​model 2 can be trained by using a mirror environment or by using an existing environment as the mirror environment's production environment reproduction unit 11. In the embodiment, the AI ​​model 2 is trained using training data generated by converting existing data (similar data) without artificially causing a failure.

[0026] In Figure 4, the production environment 70, the AI ​​model 2 to be trained, and existing data are confirmed. The data classification unit 51 of the training data generation device 3 classifies the existing data into normal data and abnormal data. The data generation unit 52 compares the classified normal data with the normal data of the production environment and calculates the difference between the two data. The data generation unit 52 substitutes the calculated difference into the classified abnormal data to generate abnormal data of the production environment.

[0027] The data management unit 53 acquires initial value settings related to machine learning and data necessary for the functions of the learning data generation device 3. The data management unit 53 also acquires normal data from the production environment and the generated abnormal data from the production environment, and trains the AI ​​model 2. The trained AI model 2 can be transferred to the production environment 70 and used in the operation of the network system.

[0028] Using only the mirror environment forming device 60, a large amount of learning data can be obtained by artificially repeating the occurrence and recovery of events such as user access and failures in an environment that reproduces the production environment. However, to use the mirror environment, the production environment must be reproduced by the production environment reproduction unit 11. In other words, if the production environment cannot be reproduced, data cannot be created in the mirror environment. Therefore, in this embodiment, the learning data generation device 3 makes it possible to generate learning data even if the production environment cannot be reproduced.

[0029] 5 is a diagram illustrating the flow of data exchanged between the training data generation device 3, the existing environment 80, the AI ​​model 2, and the production environment 70. Solid lines indicate data exchange within the training data generation device 3, and dotted lines indicate data exchange between the training data generation device 3 and the outside.

[0030] 5, the data management unit 53 sets information such as whether there is an existing environment and whether there is existing data as initial values ​​from existing information (a). The data management unit 53 also saves data from the normal production environment (d). Meanwhile, the required number and type of data are set as initial values ​​from the confirmed AI model 2 (c).

[0031] The data classification unit 51 classifies the existing data of the existing environment into data when the existing environment is normal and data when the existing environment is abnormal (b). The classified data when the existing environment is normal is saved as data when the existing environment is normal for calculation.

[0032] The data generation unit 52 acquires the existing environment normal state data (e) and acquires the production environment normal state data (f). The data generation unit 52 then calculates abnormal state data (j) using the difference between the existing environment normal state data (h) and the production environment normal state data (i). Furthermore, the data generation unit 52 applies the calculated difference to the existing environment abnormal state data (g) to generate abnormal state data for the production environment. The generated abnormal state data (k) is stored in the data management unit 53.

[0033] Then, the abnormal learning data and normal learning data are repeatedly given to the AI ​​model 2 (l) to allow it to learn, and the learning results (trained model) are used in the production environment 70 (m).

[0034] <effect> Next, the operation of the above configuration will be described. 6 is a diagram showing an example of a processing procedure of the machine learning system according to the embodiment. In FIG. 6, the data management unit 53 acquires information indicating the type and amount of learning data required for learning by the AI ​​model 2 from the AI ​​model 2 (step S10). The type of learning data may be, for example, normal data, abnormal data, or both. The amount of data may be, for example, the time or number of times data is collected.

[0035] Next, the data management unit 53 refers to the acquired information and determines whether to apply mode A, mode B, or mode C (step S11). If mode A is selected, the mirror environment is used (step S12) and learning of the AI ​​model 2 is performed (step S24). If mode B is selected, the existing environment is used (step S13), and then the mirror environment is used (step S12) and learning of the AI ​​model 2 is performed (step S24).

[0036] In mode C, the learning data generation device 3 uses the normal production environment data and the existing environment data (step S14). That is, the learning data generation device 3 stores the normal production environment data in the learning data storage unit 33 (FIG. 3) (step S23) to use it as learning data (step S40).

[0037] The learning data generation device 3 also classifies the existing environment data into abnormal data and normal data (step S20) and provides the existing environment abnormal data to the data generation unit 52 (step S21). The learning data generation device 3 also provides the normal data as production environment normal data of the existing environment to the data generation unit 52 (step S30), and calculates the difference between the production normal data and the existing environment normal data (step S31). This difference is provided to the data generation unit 52 (step S21).

[0038] Based on these data, the data generation unit 52 performs data mapping and generates data on abnormal conditions in the production environment (step S22). The obtained data on abnormal conditions in the production environment is stored in the learning data storage unit 33 (FIG. 3) (step S23).

[0039] Then, the abnormal learning data and normal learning data are repeatedly provided to the AI ​​model 2 to train it (step S24). The trained model thus obtained is transferred to the production environment 70, and operation of the network system begins.

[0040] Figure 7 shows an example of changes in metric values ​​in existing data. When a specific fault occurs, metric values ​​such as CPU usage and memory usage change in the same way. In other words, they exhibit similar behavior. By utilizing this characteristic, it is possible to calculate abnormal data from the differences between normal data in different environments.

[0041] Figure 8 is a diagram for explaining the calculation of abnormality data in a production environment. In Figure 8, two examples (Example 1 and Example 2) were simulated and compared. In container orchestration environments with similar virtual layers, a similar environment and a production environment were created for each of Example 1 and Example 2. Example 1, for example, has the same number of network equipment for configuring the environment in the physical layer, but the equipment specifications are different. Example 2 has the same devices as the network equipment for configuring the environment in the physical layer, but the number is different.

[0042] For these two comparison types, we artificially generate the same failure in the virtual layer. In a container-based virtualization environment, a failure can be generated by, for example, running the Kill container. Then, we obtain a metric value, such as memory usage. Figure 8 shows an example of a value obtained only once, but it is also possible to use the average value obtained multiple times. We then show the obtained values ​​and calculation of the error.

[0043] The data when an error occurs in the production environment can be calculated using, for example, formula (1). The error can be calculated using, for example, formula (2).

number

[0044] Focusing on Example 1, the abnormal data for the production environment is calculated as (62672896 x 34668544) / 17645548 = 123134492. The error with the abnormal data for the production environment, 125607936, is calculated as |(125607936 - 123134492)| / 125607936 = 2%. The same applies to Example 2. In this way, it has been demonstrated that abnormal data for the production environment can be calculated by so-called data mapping, based on normal data and abnormal data obtained by classifying existing data.

[0045] Of course, specific examples of data mapping are not limited to formula (1), and any method can be considered for calculating the difference, such as addition, subtraction, multiplication, division, or function. There is also no need to be bound to a specific formula such as formula (2) for calculating the error.

[0046] <Effects> As described above, in the embodiment, after determining whether or not an existing environment exists, an AI model can be trained in three modes depending on the result. That is, the type of data (normal, fault), amount of data (indicators such as time and number of times), and existing environment and data information (information such as direct availability and data availability) are set as initial values. Then, which of the three modes is selected is determined based on the set initial values, and the AI ​​model is trained. The trained AI model can then be used in a production environment.

[0047] That is, in this embodiment, a production environment, an AI model to be trained, and existing similar data for a similar environment (an environment similar to the production environment) are prepared. Then, the normal data for the existing similar environment is classified into normal data and abnormal data. Next, the classified normal data is compared with the normal data for the production environment, and the difference is calculated. Next, the calculated difference is substituted into the classified abnormal data, and abnormal data for the production environment is generated by data mapping.

[0048] The data obtained from abnormal situations in the production environment is then fed into the AI ​​model repeatedly together with data from normal situations in the production environment to allow it to learn. Finally, the learned AI model is transferred to the production environment and put to use.

[0049] This makes it possible to efficiently acquire training data even when the production environment cannot be reproduced, eliminating the need to artificially generate failures and enabling efficient training of AI models even when the production environment cannot be reproduced.

[0050] A mirror environment must reproduce the production environment by replicating the production environment. Alternatively, in an embodiment, if an existing environment or similar environment, such as a staging environment or a verification environment, exists, learning data can be obtained by using already collected existing data (metric values ​​such as CPU usage and memory usage) or the existing environment, without reproducing the production environment or artificially causing a failure. This makes it possible to handle cases where there is little data or no data at all. In other words, data mapping technology using normal data can unify data between different environments.

[0051] As a result, even if the costs of reproducing a production environment or artificially generating failures are kept to a minimum, it is possible to obtain training data for training a learning model and to train an AI efficiently. As a result, according to the embodiment, it is possible to generate a large amount of training data required for training an AI model related to network operation at low cost.

[0052] The present invention is not limited to the above-described embodiments. For example, in FIG. 1, the target system 1 may be, for example, a server device, a communication device, an office device, a medical device, an in-vehicle device, or various types of home appliances. The AI ​​model 2 and the data generation device may be included in the target system 1 or may be connected to each other via a communication line. The data generation device may be included in the AI ​​model 2 or may be connected to each other via a communication line.

[0053] In addition, any type of AI model can be applied, such as DNN (Deep Neural Network), CNN (Convolutional Neural Network), or RNN (Recurrent Neural Network).

[0054] In short, this invention is not limited to the above-described embodiments, and in the implementation stage, the components can be modified and embodied without departing from the spirit of the invention. Furthermore, various inventions can be formed by appropriately combining multiple components disclosed in the above-described embodiments. For example, some components may be omitted from all the components shown in the embodiments. Furthermore, components from different embodiments may be appropriately combined. [Explanation of symbols]

[0055] 1. Target system 2. AI model 3...Learning data generation device 10...Processor 11...Production Environment Reproduction Department 12...Event generation section 13...Restoration Department 14...Data Management Department 20...Memory 30…Storage 31... Existing data storage unit 32...Calculation data storage unit 33...Learning data storage unit 34...Program 40...Input / output interface 45...Bus 50...processor 51...Data classification section 52...Data generation unit 53...Data Management Department 60...Mirror environment forming device 70...Production environment 80...Existing environment.

Claims

1. A data classification unit that classifies existing data collected from an existing environment into normal data and abnormal data; a data generating unit that generates abnormal data of the production environment based on normal data of the production environment and the classified normal data and abnormal data; a data management unit that manages the normal data of the production environment and the generated abnormal data of the production environment as learning data for a machine learning model.

2. The data generation device described in Claim 1, wherein the data generation unit data-maps the classified abnormal data to the abnormal data in the production environment based on the relationship between the classified normal data and the normal data in the production environment.

3. 2. The data generating device according to claim 1, wherein the data generating unit calculates a difference between the classified normal data and the normal data of the production environment, and applies the difference to the classified abnormal data to generate the abnormal data of the production environment.

4. A data generation method by a computer having a memory unit that stores existing data collected from an existing environment and a processor, a step of classifying the existing data into normal data and abnormal data by the processor; generating abnormal data of the production environment based on the normal data of the production environment and the classified normal data and abnormal data by the processor; and a step in which the processor manages the normal data of the production environment and the generated abnormal data of the production environment as learning data for a machine learning model.

5. A program installable in a computer having a memory unit that stores existing data collected from an existing environment and a processor, instructions to cause the processor to classify the existing data into normal data and abnormal data; instructions to cause the processor to execute a step of generating abnormal data of the production environment based on normal data of the production environment and the classified normal data and abnormal data; and instructions for causing the processor to execute a process of managing the normal data of the production environment and the generated abnormal data of the production environment as learning data for a machine learning model.

6. a mirror environment forming device that forms a mirror environment of the production environment; a data generation device that generates learning data for a machine learning model; The data generating device a data classification unit that classifies existing data collected from an environment different from the mirror environment and applicable to verification of the production environment into normal data and abnormal data; a data generating unit that generates abnormal data of the production environment based on the normal data of the production environment and the classified normal data and abnormal data; A machine learning system comprising: a data management unit that manages the normal data of the production environment and the generated abnormal data of the production environment as learning data for a machine learning model.

Images