TWI763169B - Prediction system and prediction method for event type of cloud data center - Google Patents

Abstract

A prediction system and a prediction method for an event type of a cloud data center are provided. The prediction method includes: receiving log data from the cloud data center; receiving first parameter source metadata and generating first input data corresponding to the log data and the first parameter source metadata; generating a prediction result according to a first machine learning (ML) model and the first input data, wherein the prediction result indicates the event type corresponding to the log data; and outputting the prediction result.

Description

Prediction system and prediction method of event type in cloud data center

The present invention relates to a prediction system and prediction method for event types in a cloud data center.

Cloud data centers provide users with diverse and high-speed cloud services and applications, but in practical processing, virtualization technology complicates the relationship between software, network, and hardware devices. Based on this, for cloud data center managers, how to monitor and use information from the cloud data center to predict the occurrence of abnormal events in advance and quickly eliminate system obstacles is an important issue.

The present invention provides a prediction system and prediction method for event types in a cloud data center, which can predict the types of events that occur in the cloud data center through cloud service log content generated by the cloud data center.

An event type prediction system in a cloud data center of the present invention includes a processor, a storage medium and a transceiver. The transceiver communicates with the cloud data center. The storage medium stores multiple modules. The processor is coupled to the storage medium and the transceiver, and accesses and executes a plurality of modules, wherein the plurality of modules include a model management prediction module, a system text prediction sentence library, a system function execution module, an analysis module and a response module Group. The model management prediction module stores the first machine learning model. The system text prediction sentence library receives log data from the cloud data center through the transceiver. The system function execution module receives the first parameter source metadata through the transceiver, and generates first input data corresponding to the log data and the first parameter source metadata. The analysis module generates a prediction result according to the first machine learning model and the first input data, wherein the prediction result indicates the event type corresponding to the log data. The response module outputs the prediction result through the transceiver.

In an embodiment of the present invention, the above-mentioned modules further include a test data link module. The test data linking module performs feature screening on the log data to generate test data, wherein the system function execution module generates the first input data according to the test data.

In an embodiment of the present invention, the above-mentioned modules further include a system text training sentence database, an event type training sentence database, and a training data link module. The system text training sentence library receives historical log data from the cloud data center through the transceiver. The event type training sentence library receives the event type label data corresponding to the historical log data from the cloud data center through the transceiver. The training data linking module generates training data according to the historical log data and the event type label data, wherein the system function execution module receives the second parameter source relay data through the transceiver, and generates the training data and the second parameter source relay data corresponding to the data the second input data, and train the first machine learning model according to the second input data.

In an embodiment of the present invention, the above-mentioned training data linking module performs feature screening on historical log data to generate filtered historical log data, wherein the training data linking module deletes the filtered historical log data according to the event type label data and a plurality of data points corresponding to abnormal events in the event type label data to generate training data.

In an embodiment of the present invention, the above-mentioned system function execution module receives data from one of the test data link module and the training data link module, wherein the system function execution module includes an event type label in response to the data The data is determined as training data, wherein the system function execution module determines that the data is test data in response to the data not including event type label data.

In an embodiment of the present invention, the above-mentioned system function execution module receives data from one of the test data link module and the training data link module, wherein the system function execution module receives the system function through the transceiver. Relay data, and judge the data as one of test data and training data according to the system function relay data.

In an embodiment of the present invention, the above-mentioned model management prediction module stores a plurality of machine learning models including the first machine learning model, wherein the system function execution module receives the system function relay data through the transceiver, and according to the system function The data is relayed to select a first machine learning model from the plurality of machine learning models.

In an embodiment of the present invention, the above-mentioned multiple machine learning models correspond to at least one of the following: long short-term memory model, bidirectional long short-term memory model, bidirectional quadratic long short-term memory model, gated recurrent neural network model, Bidirectional gate cyclic neural network model and bidirectional secondary gate cyclic neural network model.

In an embodiment of the present invention, the above-mentioned prediction system further includes an output device. The output device is coupled to the processor, wherein the plurality of modules further includes a user interface module. The user interface module receives the query command through the transceiver, obtains the event information from the prediction result according to the query command, and outputs the event information through the output device.

A method for predicting event types in a cloud data center of the present invention includes: receiving log data from the cloud data center; receiving first parameter source relay data, and generating a first parameter corresponding to the log data and the first parameter source relay data input data; generate a prediction result according to the first machine learning model and the first input data, wherein the prediction result indicates an event type corresponding to the log data; and output the prediction result.

Based on the above, the present invention can automatically aggregate the historical log data generated by the cloud data center service through the system text training sentence database as the training data of the machine learning model. The event intent training sentence base can automatically process the log data and event type label data in the cloud data center. The training data link module can integrate the above data to complete the establishment of the training data required for training the model. The present invention can also perform model training through the system function execution module, and can manage the trained machine learning model. On the other hand, the present invention can predict the event type corresponding to the log data through the system function execution module. The response module can output the prediction results of the stacked event types according to the user's needs.

In order to make the content of the present invention more comprehensible, the following specific embodiments are given as examples according to which the present invention can indeed be implemented. Additionally, where possible, elements/components/steps using the same reference numerals in the drawings and embodiments represent the same or similar parts.

FIG. 1 is a schematic diagram of a prediction system 100 according to an embodiment of the present invention, wherein the prediction system 100 can be used to predict event types in a cloud data center. The prediction system 100 may include a processor 110 , a storage medium 120 , a transceiver 130 and an output device 140 .

The processor 110 is, for example, a central processing unit (CPU), or other programmable general-purpose or special-purpose micro control unit (micro control unit, MCU), microprocessor (microprocessor), digital signal processing digital signal processor (DSP), programmable controller, application specific integrated circuit (ASIC), graphics processor (graphics processing unit, GPU), image signal processor (image signal processor, ISP) ), image processing unit (IPU), arithmetic logic unit (ALU), complex programmable logic device (CPLD), field programmable gate array (field programmable gate array) , FPGA) or other similar elements or a combination of the above. The processor 110 may be coupled to the storage medium 120 , the transceiver 130 and the output device 140 , and access and execute a plurality of modules and various application programs stored in the storage medium 120 .

The storage medium 120 is, for example, any type of fixed or removable random access memory (random access memory, RAM), read-only memory (ROM), and flash memory (flash memory). , a hard disk drive (HDD), a solid state drive (SSD), or similar components or a combination of the above components for storing a plurality of modules or various application programs executable by the processor 110 .

The transceiver 130 transmits and receives signals in a wireless or wired manner. Transceiver 130 may also perform operations such as low noise amplification, impedance matching, frequency mixing, up or down frequency conversion, filtering, amplification, and the like. The prediction system 100 can be connected to the cloud data center through the transceiver 130 . The cloud data center can be developed by software such as python, and can provide web services.

The output device 140 may include a communication interface, a display or a speaker, etc., and the present invention is not limited thereto.

2 is a schematic diagram illustrating a plurality of modules in the storage medium 120 according to an embodiment of the present invention, wherein the plurality of modules may include a system function execution module 11, a system text training sentence database 12, and an event type training sentence database 13. A training data link module 14 , a model management prediction module 15 , a response module 16 , a system text prediction sentence library 17 , a test data link module 18 , an analysis module 19 and a user interface 20 .

The model management prediction module 15 can store a plurality of machine learning models generated by the system function execution module 11 . The system function execution module 11 can train the machine learning model stored in the model management prediction module 15 according to the training data.

The system function execution module 11 can receive data from the training data link module 14 or the test data link module 18, and determine that the received data is training data or test data. If the received data is training data, the prediction system 100 can train the machine learning model according to the training data. If the received data is test data, the prediction system 100 can use the trained machine learning model to determine the event type corresponding to the test data, and generate corresponding prediction results for the user's reference.

In one embodiment, the system function execution module 11 can determine whether the data received from the training data link module 14 or the test data link module 18 includes event type label data. If the received data includes event type label data, the system function execution module 11 can determine that the data is training data. If the received data does not include event type label data, the system function execution module 11 can determine that the data is test data.

In one embodiment, the system function execution module 11 can receive system function metadata (metadata) through the transceiver 130 , and determine that the data received by the system function execution module 11 is training data according to the instruction of the system function metadata or test data. In other words, the user can transmit the system function metadata to the prediction system 100 through the terminal device, so as to control the prediction system 100 to perform machine learning model training or event type prediction.

In order to generate the machine learning model, the system text training sentence base 12 can receive historical log data from the cloud data center through the transceiver 130, and the event type training sentence base 13 can receive the historical log data from the cloud data center through the transceiver 130 The event type label data for the data. The event type label data may include a label of the event type corresponding to the historical log data. Table 1 is an example of event types corresponding to historical log data. Table 1 Numbering type of event 1 ACLConfig provisioning failed 2 ACLConfig order supply failed 3 Host CPU usage is severely high 4 Host network card Admin service exception 5 Host network card Operation service exception 6 The total CPU usage of the ODL controller is seriously high 7 ODL controller device exception 8 OVS Bridge Status Abnormal 9 The connection status of the OpenFlow controller is abnormal 10 QoSPolicyConfig provisioning failed 11 QoSPolicyConfig provisioning failure event 12 SDN physical switch device is abnormal 13 SDN physical switch port device is abnormal 14 VNF CPU usage is severely high 15 VNF DHCP service is abnormal 16 VNF SLB service exception 17 VNF system exception 18 ebs supply failed 19 ebs order supply failed 20 host_cage provisioning failed twenty one host_cage order supply failed twenty two instance provisioning failed twenty three instance order supply failed twenty four interface provisioning failed 25 interface order supply failed 26 internetLinkDual_cht supply failed 27 internetLinkDual_cht order supply failed 28 pathTrace provisioning failed 29 pathTrace provisioning failure event 30 privateSubnetDual_cht failed to install 31 privateSubnetDual_cht order supply failed 32 qosQueueConfig_cht failed to supply 33 qosQueueConfig_cht supply failure event 34 Failed to supply scalingGroup 35 scalingGroup order supply failed 36 staticRouteConfig_vyosCluster provisioning failed 37 staticRouteConfig_vyosCluster order supply failed 38 staticRouteIPv6Config_ciscoNexusCluster provisioning failed 39 staticRouteIPv6Config_ciscoNexusCluster order supply failed 40 staticRouteIPv6Config_vyosCluster provisioning failed 41 staticRouteIPv6Config_vyosCluster order supply failed 42 syncVenus provisioning failed 43 syncVenus order supply failed 44 Failed to install vnfServer_cht 45 vnfServer_cht order supply failed

The training data linking module 14 can generate training data for training the machine learning model according to the historical log data and the event type label data. Specifically, the training data linking module 14 can perform feature screening on the historical log data to find key features in the text of the historical log data, so as to retain the data corresponding to the key features in the historical log data to generate a filtered history log data to reduce analysis noise. Features of historical log data may include, but are not limited to, information about physical device hosts, network servers, firewalls, operating systems, or network devices.

The training data linking module 14 can parse the format parameters of files such as Json, YAML or CSV in the historical log data to perform feature filtering. Specifically, the system text training sentence database 12 can temporarily store the historical log data received from the cloud data center through a message queue. The training data linking module 14 can use software such as python to analyze and process the historical log data. The training data linking module 14 can process and combine the historical log data through the rules set by the search engine (for example: Elasticsearch) (for example: combine the logs in the timestamp interval of the tag corresponding to the event type in the historical log data. values) and indexing, resulting in structured log data storage (for example, using the pandas suite in python software). The training data linking module 14 can view log data through a user interface (UI) of Kibana software, for example, through stop words (stop words) of natural language processing (NLP) tools commonly used in python software. ) removes the characters in the log data, and additionally calculates the inverse document frequency (idf) value of all the characters in the log data, so as to find the characters with a smaller idf value in the log data and filter them out as stop words , resulting in the text of key features in historical log data.

After generating the filtered historical log data, the training data linking module 14 can convert the text in the filtered historical log data into numerical values that can be used as input to the machine learning model. Specifically, the training data linking module 14 can convert the text in the filtered historical log data into binary values for heterogeneous data integration, and convert the key words into word vectors by counting key words, Thereby forming a distribution operation value that can be interpreted by the machine learning model. In one embodiment, the training data linking module 14 may also perform procedures such as hyphenation, encoding or noise reduction on the historical log data (or the filtered historical log data), so that a more accurate model can be trained from the historical log data .

On the other hand, the training data linking module 14 can determine which data points in the filtered historical log data or the event type label data correspond to abnormal events according to the event type label data. The training data linking module 14 can delete a plurality of data points corresponding to abnormal events in the filtered historical log data or event type label data, so as to improve the accuracy of the trained model. Then, the training data linking module 14 may combine the filtered historical log data and the event type tag data to generate training data.

The analysis module 19 can generate one or more machine learning models that can be stored by the model management prediction module 15 according to the training data, wherein the one or more machine learning models can correspond to at least one of the following: long short-term memory ( long short term memory (LSTM) model, bidirectional long short term memory (bidirectional LSTM) model, bidirectional quadratic long short term memory (bidirectional LSTM+ LSTM) model, gate recurrent unit (GRU) model, bidirectional gate recurrent neural network Road (bidirectional GRU) model and bidirectional secondary gate recurrent neural network (bidirectional GRU+ GRU) model. The model management prediction module 15 can store and manage the trained machine learning model through, for example, the HDF5 file format.

Specifically, the system function execution module 11 can receive training data from the training data linking module 14 , and can receive the second parameter source relay data for training the machine learning model through the transceiver 130 . The second parameter source metadata may be related to the type of machine learning model. For example, the second parameter source metadata may include hyperparameters used to train the machine learning model, such as batch size, learning rate, epoch or weight, etc.

The system function execution module 11 can generate the second input data for training the machine learning model according to the training data and the second parameter source metadata. The analysis module 19 can use software tools (eg, python tensorflow) to train the machine learning model according to the second input data. In one embodiment, the system function execution module 11 can receive the system function relay data through the transceiver 130 . The system function execution module 11 can determine the type of machine learning model to be trained according to the system function metadata. The analysis module 19 can train the machine learning model according to the type determined by the system function execution module 11 . After completing the training of the machine learning model, the system function execution module 11 may store the machine learning model in the model management and prediction module 15 .

The prediction system 100 can use the machine learning model stored in the model management prediction module 15 to determine the event type corresponding to the test data. The system text predictive sentence library 17 can receive log data from the cloud data center through the transceiver 130 . The test data link module 18 can generate test data according to the log data. The test data linking module 18 may perform feature filtering on log data to generate filtered log data. For example, the test data linking module 18 can parse the format parameters of files such as Json, YAML or CSV in the log data in a similar manner to the training data linking module 14 to perform feature filtering to find out the log data. key features in the text, thereby retaining the data in the log data corresponding to the key features to generate filtered log data to reduce analysis noise. The characteristics of log data may include, but are not limited to, information about physical device hosts, network servers, firewalls, operating systems, or network devices.

After generating the filtered log data, the test data linking module 18 can convert the text in the filtered log data into numerical values that can be used as input to the machine learning model in a similar manner as the training data linking module 14, thereby Generate test data. In one embodiment, the test data linking module 18 may hyphenate, encode, or denoise the log data (or filtered log data) so that the log data can be used to generate more accurate prediction results.

The analysis module 19 can generate a prediction result according to the test data and the machine learning model in the model management prediction module 15, wherein the prediction result can indicate the event type corresponding to the log data. Specifically, the system function execution module 11 can receive the test data from the test data link module 18 , and can receive the first parameter source relay data through the transceiver 130 . The first parameter source metadata may be related to the type of machine learning model that the analysis module 19 will use. For example, the first parameter source metadata may include hyperparameters, such as batch size, learning rate, pattern or weights, required to be used by the machine learning model used to generate the predicted results.

The system function execution module 11 can generate the first input data of the machine learning model according to the test data and the first parameter source metadata. The analysis module 19 can input the first input data to the machine learning model to generate the prediction result. In one embodiment, the system function execution module 11 can receive the system function relay data through the transceiver 130 . The system function execution module 11 can determine the type of machine learning model selected by the analysis module 19 according to the system function metadata. The analysis module 19 may select one of the plurality of machine learning models in the model management prediction module 15 according to the category to generate a prediction result.

After generating the prediction result, the response module 16 can temporarily store the prediction result through the message queue. The response module 16 can complete the construction of the prediction array structure according to the prediction results, stack and store one or more prediction results in a first in first out (FIFO) manner, and generate a corresponding prediction result. Timestamp. In one embodiment, the response module 16 can output the prediction result through the transceiver 130 for the user's reference. In one embodiment, the user interface module 20 can output the prediction result through the output device 140 for the user's reference.

In one embodiment, the user interface module 20 may receive a query command through the transceiver 130 and obtain event information from one or more prediction results stored in the response module 16 according to the query command. For example, when the user wants to inquire about the types of events occurring in the cloud data center from 21:00 to 22:00, the user can send an inquiry command to the prediction system 100 through the terminal device. The query command is, for example, a web service request (service request) based on a hypertext transfer protocol (HTTP). The user interface module 20 may receive query commands through a web application programming interface (API) written in Java, for example. The user interface module 20 may forward the query command to the response module 16 . The response module 16 can extract event information corresponding to the query command from the stacked one or more prediction results by using a software tool (eg, pandas numerical analysis library of python). The user interface 20 can output event information through the output device 140 for the user's reference.

FIG. 3 shows a flowchart of a prediction method according to an embodiment of the present invention, wherein the prediction method can be used to predict the event types of a cloud data center, and can be implemented by the prediction system 100 shown in FIG. 1 . In step S301, log data is received from the cloud data center. In step S302, the first parameter source metadata is received, and first input data corresponding to the log data and the first parameter source metadata are generated. In step S303, a prediction result is generated according to the first machine learning model and the first input data, wherein the prediction result indicates the event type corresponding to the log data. In step S304, the prediction result is output.

To sum up, the present invention can achieve the following effects: a large amount of log information generated by the cloud data center is collected for training, and used to predict the event type of abnormal events; the operation of the traditional analysis platform is improved, and the cloud data center is collected through automated steps. log, and establish a prediction model; through the functional architecture, establish a cloud data center abnormal event prediction model algorithm training process, thereby speeding up the model training and prediction process; and for the prediction results of the cloud data center event types, users can By operating the user interface, the information of interest to the user can be inquired from the prediction result.

100: Predictive Systems 110: Processor 120: Storage Media 130: Transceiver 140: Output device 11: System function execution module 12: System text training sentence library 13: Event type training sentence library 14: Training data link module 15: Model Management Prediction Module 16: Response module 17: System text prediction sentence library 18: Test data link module 19: Analysis module 20: User Interface S301, S302, S303, S304: steps

FIG. 1 is a schematic diagram of a prediction system according to an embodiment of the present invention. FIG. 2 is a schematic diagram illustrating a plurality of modules in a storage medium according to an embodiment of the present invention. FIG. 3 is a flowchart illustrating a prediction method according to an embodiment of the present invention.

S301, S302, S303, S304: steps

Claims (5)

An event type prediction system in a cloud data center, comprising: a transceiver, connected to the cloud data center in communication; a storage medium, for storing a plurality of modules; and a processor, coupled to the storage medium and the transceiver, And access and execute the plurality of modules, wherein the plurality of modules include: a model management prediction module, storing a plurality of machine learning models including the first machine learning model; system text prediction sentence library, through the The transceiver receives log data from the cloud data center; the system text training sentence library receives historical log data from the cloud data center through the transceiver; the event type training sentence library uses the transceiver to The cloud data center receives the event type label data corresponding to the historical log data; the training data link module generates training data according to the historical log data and the event type label data; the test data link module, for The log data is subjected to feature screening to generate test data; the system function execution module receives the first parameter source relay data through the transceiver, and generates corresponding log data and the first parameter according to the test data. the first input data of the parameter source metadata, wherein the system function execution module receives the second parameter source metadata through the transceiver, and generates a corresponding training data and the second input data of the second parameter source metadata, and train the first machine learning model according to the second input data; an analysis module, according to the first machine learning model and the The first input data generates a prediction result, wherein the prediction result indicates the event type corresponding to the log data; and a response module outputs the prediction result through the transceiver, wherein the system function execution module Receive data from one of the test data link module and the training data link module, and determine that the data is one of the training data and the test data according to one of the following : determining that the data is the training data in response to the data including the event type label data, and determining that the data is the test data in response to the data not including the event class label data; and Receive system function relay data through the transceiver, and determine that the data is one of the test data and the training data according to the system function relay data, wherein the system function execution module The first machine learning model is selected from the plurality of machine learning models according to the system function metadata. The prediction system of claim 1, wherein the training data linking module performs feature filtering on the historical log data to generate filtered historical log data, wherein the training data linking module is based on the event type Tag data delete the filtered historical log data and the event category tag data in relation to anomalous events corresponding data points to generate the training data. The prediction system of claim 1, wherein the plurality of machine learning models correspond to at least one of: a long short term memory model, a bidirectional long short term memory model, a bidirectional quadratic long short term memory model, a gated recurrent neural network model, two-way gate recurrent neural network model and two-way secondary gate recurrent neural network model. The prediction system according to claim 1, further comprising: an output device, coupled to the processor, wherein the plurality of modules further comprises: a user interface module for receiving a query command through the transceiver, according to The query command obtains event information from the prediction result, and outputs the event information through the output device. A method for predicting event types in a cloud data center, comprising: storing a plurality of machine learning models including a first machine learning model; receiving log data, historical log data, and events corresponding to the historical log data from the cloud data center type label data; generate training data according to the historical log data and the event type label data; perform feature screening on the log data to generate test data; obtain a data including one of the training data and the test data data, and determine that the data is the one of the training data and the test data according to one of the following: In response to the data including the event type label data, it is determined that the data is the training data, and in response to the data not including the event and judging that the data is the test data; and receiving the system function relay data, and judging the data as the test data and the training data according to the system function relay data. One: Receive second parameter source metadata, generate second input data corresponding to the training data and the second parameter source metadata, and train the first machine learning according to the second input data model; receiving the first parameter source metadata, and generating first input data corresponding to the log data and the first parameter source metadata according to the test data; The first machine learning model is selected from the plurality of machine learning models; a prediction result is generated according to the first machine learning model and the first input data, wherein the prediction result indicates a data corresponding to the log data. the event category; and outputting the predicted result.

Images