Synthetic Data Training for Anomaly Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed computing systems, efficiently detecting and classifying anomalies across multiple metrics is challenging due to the rarity of events and the high cost of labeling large datasets required for accurate classification, making it difficult to prevent business-impacting issues in dynamic microservice environments.
Innovation Solution
The use of synthetic data to train classification models, combining unsupervised and supervised learning techniques, where synthetic data generates training instances for anomaly detection and classification, and operator-labeled data is used to improve the model, balancing labeling effort with incident detection performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If supervised learning techniques are used to train classification models for anomaly detection, then classification accuracy is improved, but the cost and time required for labeling large datasets increases significantly
Solution Approach 1:
The system performs preliminary actions by generating synthetic anomaly data and pre-labeling it with anomaly types before actual operation. This pre-prepared synthetic labeled data serves as initial training material, eliminating the need to manually label large volumes of real operational data from scratch, thus reducing the time and expert effort required for model training while maintaining classification accuracy
Solution Approach 2:
The system creates synthetic copies of real anomaly patterns through data generation processes. These synthetic data copies replicate the characteristics and labeling requirements of real anomaly data but can be generated automatically without expert intervention. The synthetic copies serve as training data, replacing the need to manually collect and label extensive real-world anomaly examples
2Measurement precision
If more labeled data is collected to improve classifier precision and recall, then detection accuracy is improved, but the complexity and cost of data acquisition and labeling increases
Solution Approach 1:
The system generates synthetic copies of anomaly data that replicate the statistical properties and patterns of real anomaly data. These synthetic copies provide sufficient training material for high-precision classification without requiring the complex and expensive process of collecting, curating, and labeling large volumes of real operational data from multiple distributed systems
Solution Approach 2:
The system changes the parameters of data generation by adjusting synthetic data characteristics to match different anomaly scenarios. This allows flexible generation of diverse training data with varying anomaly types, severities, and patterns without the complexity of acquiring real data across all possible anomaly scenarios from distributed computing systems
3Manufacturing precision
If expert engineers manually label operational data, then data quality is improved, but the resource expenditure and cost become unsustainable
Solution Approach 1:
The system replaces expensive expert labeling with automatic synthetic data generation that copies the essential characteristics and labeling accuracy needed for training. The synthetic data is pre-labeled with ground truth anomaly types through automated processes, eliminating the need for expert engineer involvement while maintaining the data quality necessary for effective model training
Solution Approach 2:
The system uses inexpensive synthetic data objects that can be generated on-demand and discarded after use, replacing the expensive and time-consuming process of expert manual labeling. These synthetic data instances serve their purpose as training material without requiring the sustained resource investment of human expert engagement
Data Source
AI summary
Systems and methods include determination of a plurality of event types, determination of a plurality of associated metrics for each of the plurality of event types, generation of synthetic time-series data of each of the metrics associated with the event types for each of the plurality of event type, the synthetic time-series data representing metric anomalies and events of the event type, training of a first system to generate anomaly values based on the synthetic time-series data, training of a second system to classify event types based on the anomaly values, determination of an anomaly value for each data instance of actual time-series data, determination of event types for each determined value, selection of data instances based on the determined values and event types, reception of an event type for each selected data instance, and re-training of the second system based on the selected data instances and event types.