KR20180073302A - System and method for analyzing alarm information in mulitple time-series monitoring system - Google Patents

Abstract

Provided are an alarm information analysis system in a multivariate time-series monitoring system, to provide a means for analyzing an association between an alarm and abnormality in a simple and efficient method; and a method thereof. According to one embodiment of the present invention, the alarm information analysis system comprises: a data collection unit to collect first binary data representing alarm occurrence by each alarm type, and second binary data representing alarm occurrence by each abnormality type; a data analysis unit to search for one or more association rules representing association between the alarm included in the first binary data and the abnormality included in the second binary data; and a data classification unit to determine an abnormality type associated with at least one of the alarm types from the searched association rule.

Description

TECHNICAL FIELD [0001] The present invention relates to an alarm information analyzing system and method for a multivariate time series monitoring system,

Embodiments of the present invention relate to techniques for monitoring multivariate time series data and analyzing alarm information that occurs therewith and the associated anomaly types.

Process monitoring technology is a technology that monitors and analyzes various data generated in the process to detect abnormalities early and minimize the risk of abnormalities. The Control Chart technique is one of these process monitoring techniques, which is a technique to diagnose process abnormalities based on statistical distribution of specific data. In addition, the Multivariate State Estimation Technique (MSET) is a monitoring technique that uses the prediction model and the residual concept based on the correlation between each variable to reflect the interaction, which is a limit of the univariate control chart. The MSET reflects the correlation between the variables and generates an alarm when the correlation is changed or the value of the variable changes.

However, since there are many variables in modern processes, it is very difficult to identify the exact meaning of various alarms generated through univariate management or MSET and to match the abnormal information with actual process information. Particularly, according to the conventional process monitoring technology, it is difficult to grasp the exact cause of abnormality from various data generated in the process.

Korean Patent Registration No. 10-1615346 (Apr. 25, 2016)

Embodiments of the present invention are intended to provide a means for analyzing the association between alarms and anomalies in a simpler and more efficient manner.

According to an exemplary embodiment of the present invention, a data collecting unit collects first binary data indicating whether an alarm is generated for each alarm type and second binary data indicating whether an abnormality is generated for each abnormal type; A data analyzer for searching at least one association rule indicating a degree of association between an alarm included in the first binary data and an abnormality included in the second binary data; And a data classifier for determining an abnormal type associated with at least one of the alarm types from the searched association rule.

The data analyzing unit derives an evaluation criterion including at least one of support, confidence, and lift of the rules between the alarm and the abnormality by using an association analysis technique , One or more of the rules may be searched using the evaluation criteria.

The data analyzer may search for a rule having the evaluation criterion equal to or higher than a predetermined value among the rules using the association rule.

Wherein the data classification unit searches the association rule having the highest reliability among the association rules for each alarm type or for each group including two or more alarm types, and the abnormality type included in the association rule having the highest reliability, The type of alarm included in the highest association rule, or the type of anomaly associated with the group.

Wherein the data classifier searches the association rule having the highest degree of improvement among the association rules for each alarm type or for each group including two or more alarm types, The type of alarm included in the association rule with the highest degree of improvement or the abnormal type associated with the group.

The alarm information analyzing system may further include a data providing unit for providing the user with an abnormal type and an abnormal occurrence probability associated with the type of the alarm generated when an alarm is generated in monitoring the target object.

The data providing unit may determine that the alarm generated when the probability of occurrence of an anomaly related to the type of the generated alarm is less than a predetermined value as a false alarm and update information about the false alarm to the database .

The alarm information analyzing system may further include a data providing unit for visualizing and displaying one or more of the association rules as a combination of two or more nodes and links between the nodes.

The data provider may display at least one of the color, size and shape of the node or link according to the degree of association.

According to another exemplary embodiment of the present invention, there is provided a data collection method comprising the steps of: collecting first binary data indicating whether an alarm is generated for each alarm type and second binary data indicating whether an abnormality has occurred for each abnormal type; Searching at least one association rule indicating a degree of association between an alarm included in the first binary data and an abnormality included in the second binary data in the data analysis unit; And in the data classifier, determining an abnormal type associated with at least one of the respective alarm types from the searched association rule.

The searching of the association rule may include an evaluation including at least one of Support, Confidence and Lift of the rules between the alarm and the abnormality by using Association Analysis A criterion can be derived, and one or more of the rules can be searched using the evaluation criterion.

The searching of the association rule may search for a rule having the evaluation criterion equal to or higher than the set value among the rules by the association rule.

Wherein the step of determining an anomaly type associated with each alarm type from the association rule comprises: searching the association rule having the highest reliability among the association rules by each alarm type or each group including two or more alarm types, The abnormal type included in the highest association rule can be determined as the abnormal type associated with the alarm type or group included in the association rule having the highest reliability.

Wherein the step of determining an anomaly type associated with each alarm type from the association rule comprises: searching an association rule having the highest degree of improvement among the association rules by each alarm type or each group including two or more alarm types; The abnormal type included in the association rule having the highest degree can be determined as the abnormal type associated with the alarm type or group included in the association rule having the highest degree of improvement.

The alarm information analyzing method may further include a step of determining an abnormal type associated with each alarm type from the association rule and associating the type of the alarm generated when an alarm is generated in the process of monitoring the target object, And providing the user with an abnormal type and an abnormal occurrence probability.

The alarm information analyzing method may further include a step of detecting a false alarm generated when the abnormality occurrence probability associated with the type of the alarm generated is less than a predetermined value, , And updating the information on the false alarm to the database.

The method of analyzing alarm information may further comprise the step of determining an abnormal type associated with each alarm type from the association rule, wherein, in data providing, at least one association rule is a link between two or more nodes and the node, And then displaying the visualized image.

Displaying one or more of the association rules may display one or more of the color, size and shape of the node or link differently according to the association.

According to embodiments of the present invention, the association rules between alarms and anomalies are more easily searched using associative analysis techniques and the anomaly types associated with at least one of the alarm types are determined, Can be understood efficiently. In particular, according to the embodiments of the present invention, it is possible to derive an association rule for each alarm type or each type of abnormality in a simpler way without processing data, and to efficiently use the associated alarm type and abnormality type in process mapping.

Also, according to embodiments of the present invention, it is determined whether or not the alarm generated based on the detected association rule and the classified data is a false alarm, and when it is determined that the false alarm is a false alarm, Can be improved.

Also, according to embodiments of the present invention, it is possible to display the discovered association rule in the form of a network graph and display the color or the size or the shape of the node or the link differently according to the detected association degree, Can provide a visual guideline for the user. In this case, the user can intuitively grasp the associated alarm type and the anomaly type, and thus the entire process can be easily understood.

1 is a block diagram showing a detailed configuration of an alarm information analyzing system according to an embodiment of the present invention;
2 illustrates an example of first binary data and second binary data according to an embodiment of the present invention.
3 shows an example of the association rule found in the data analysis unit 104 according to an embodiment of the present invention
Figure 4 is an illustration of the association rules displayed in the data provider in accordance with an embodiment of the present invention.
5 is a flowchart for explaining an alarm information analysis method according to an embodiment of the present invention.
6 is a diagram illustrating an example of utilizing an alarm information analysis system according to an embodiment of the present invention.
7 is a flowchart illustrating a data providing method according to an embodiment of the present invention.

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to provide a comprehensive understanding of the methods, apparatus, and / or systems described herein. However, this is merely an example and the present invention is not limited thereto.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intention or custom of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification. The terms used in the detailed description are intended only to describe embodiments of the invention and should in no way be limiting. Unless specifically stated otherwise, the singular form of a term includes plural forms of meaning. In this description, the expressions "comprising" or "comprising" are intended to indicate certain features, numbers, steps, operations, elements, parts or combinations thereof, Should not be construed to preclude the presence or possibility of other features, numbers, steps, operations, elements, portions or combinations thereof.

1 is a block diagram showing a detailed configuration of an alarm information analysis system 100 according to an embodiment of the present invention. 1, an alarm information analysis system 100 in a data monitoring system 300 (or a multivariate time series monitoring system) according to an embodiment of the present invention includes a data collection unit 102, a data analysis unit 104, a data classification unit 106, and a data providing unit 108.

The data collecting unit 102 collects the first binary data. The first binary data is alarm information obtained in real time by monitoring one or more target objects (not shown) in the data monitoring system 300. The first binary data is binary information (for example, 0 or 1) . The first binary data may be multivariate time series data. Also, in the present embodiments, the target object may be an object to be monitored, for example, various equipments, facilities, etc. used in a semiconductor manufacturing process. However, this is merely an example, and the type of the target object is not limited thereto.

The data monitoring system 300 can monitor one or more target objects using various sensors and can generate an alarm according to sensor values obtained from the sensors. At this time, the alarm may be generated in association with one or more variables. The variable may be a reference parameter for determining the state of a target object, for example, a process parameter such as a temperature, a humidity, a pressure, a density of a target object, a concentration of a specific gas in the atmosphere, As an example, the alarm 1 may be associated with the temperature and humidity of the target object, and more specifically, when the temperature and humidity of the target object exceeds the set value. As another example, the alarm 2 may be associated with the pressure of the target object, specifically, when the pressure of the target object is less than the set value. The data monitoring system 300 may record the presence or absence of the alarm and the type of the alarm and store the alarm information in the database 200. The data collection unit 102 may collect alarm information stored in the database 200, Can be collected.

Also, the data collection unit 102 may collect the second binary data. The second binary data is abnormal information associated with the erroneous (or bad) event, and is information indicating the occurrence of abnormality for each abnormal type in a binary form (e.g., 0 or 1).

As described above, the data monitoring system 300 can monitor one or more target objects using various sensors, and can generate alarms according to sensor values obtained from the sensors. After the alarm is generated, an abnormality may actually occur in the target object or no abnormality may occur. The alarm becomes a true alarm when an abnormality occurs in the target object after the alarm is generated, and the alarm becomes a false alarm if no abnormality occurs in the target object after the alarm is generated . The data monitoring system 300 may store in the database 200 information on whether or not an actual abnormality has occurred in the target object and an abnormal type that has occurred after the alarm is generated, , I.e., the second binary data can be collected. The occurrence of the abnormality and the type of abnormality can be automatically determined by the data monitoring system 300, but the present invention is not limited thereto and may be manually input by the administrator. The second binary data stored in the database 200 may further include an alarm type related to (or corresponding to) the second binary data, that is, information on the alarm type that generated the second binary data.

For the sake of convenience of explanation, it is assumed that the database 200 receives binary alarm information and abnormal information from the data providing system 300. However, the present invention is not limited to this, and the database 200 may include an alarm Information and abnormal information may be provided from the data providing system 300. In this case, the data converting unit (not shown) may convert the alarm information and the anomaly information stored in the database 200 into a binary form, and the data collecting unit 102 may convert the alarm information (i.e., the first binary data ) And abnormal information (i.e., second binary data).

2 is an illustration of first binary data and second binary data according to an embodiment of the present invention. As described above, the first binary data indicates whether or not an alarm has been generated for each alarm type in binary form, and the second binary data indicates the occurrence of abnormality for each abnormal type in binary form.

Referring to FIG. 2, alarm types include, for example, alarm 1, alarm 2, alarm 3 ... Etc., and more than one type, for example, more than 1, more than 2, more than 3 ... And the like. Here, " 1 " of the first binary data represents a case where an alarm occurs, and " 0 " of the first binary data represents a case where no alarm occurs. Further, " 1 " of the second binary data indicates a case where an error occurs, and " 0 " of the second binary data indicates a case where no abnormality occurs. As an example, at time T1, alarm 1 and alarm 3 occurred, indicating that abnormal 1 and abnormal 3 occurred. Also, at time T5, alarm 3 and alarm 4 occurred, which indicates that an abnormal 2 occurred.

The N first binary data and the N second binary data may be acquired by the data monitoring system 300 and stored in the database 200. The data collecting unit 102 may acquire N first binary data and N second binary data from the database 200, Data and second binary data. The database 200 may be a configuration of the data monitoring system 300, but is not limited thereto. The database 200 may be a separate storage space connected to the data monitoring system 300 through a network. In the foregoing description, the first binary data and the second binary data are stored in one storage space (database 200) for convenience of explanation, but the present invention is not limited thereto. For example, the database 200 may include a first database (not shown) for storing first binary data and a second database (not shown) for storing second binary data, respectively, The database and the second database may be configured separately.

Referring again to FIG. 1, the data analysis unit 104 determines an association rule (association rule) indicating a correlation (or correlation) between the alarm included in the collected first binary data and the abnormality included in the second binary data Search more than one. Specifically, the data analysis unit 104 analyzes the support of the rules between the alarms included in the first binary data and the anomaly included in the second binary data, the confidence of the rules included in the second binary data, And an elevation (Lift), and can search for one or more association rules of the rules using the evaluation criteria. For example, Apriori algorithm, DHP algorithm, FP-growth algorithm, etc. can be applied to associative analysis technique to search for meaningful correlation between each item (event) . The association analysis technique can use the degree of support, reliability, and degree of improvement as an association evaluation standard. In the present embodiments, two items to which the association analysis technique is applied may be an abnormality included in alarms and two binary data included in the first binary data. The data analyzing unit 104 can derive the above-described supportability, reliability, and improvement by applying the association analysis technique to the first binary data and the second binary data. The meaning of support, reliability and degree of improvement, and calculation method are as follows.

1) Support (A => B) = Pr (A∩B): Number of simultaneous occurrence of Alarm A and Error B among the total number (N) )

2) Confidence (A => B) = Pr (A∩B) / Pr (A): The number of alarm A and B that occurred at the same time The percentage of the cases including B or more)

3) Lift (A => B) = Pr (A∩B) / Pr (A) Pr (B) (The ratio when the abnormality B occurs simultaneously with the alarm A and the case where the abnormality B occurs alone)

The degree of support is used to grasp the occurrence frequency of the corresponding alarm according to the occurrence of the alarm. The higher the degree of support, the more frequently the occurrence of the alarm (for example, the alarm B) . In addition, the reliability is used to grasp the probability of occurrence of the corresponding abnormality according to the occurrence of the alarm. When the reliability is high, the corresponding abnormality (for example, abnormality B) occurs when the alarm This means that there is a high probability of becoming. The reliability can be utilized as an anomaly probability to increase the search accuracy of the associated alarm type or anomaly type and to reduce false alarms. The degree of improvement is used to identify an alarm type having a particularly high degree of association with the abnormality. When the degree of improvement is high, the alarm (for example, alarm A) Which means that it is the main alarm which appears especially frequently. The above degree of improvement can be utilized as an index for searching for, for example, an alarm type having a small probability of occurrence of an abnormality but mainly related to the abnormality, or recommending an abnormality type having a high degree of association with the most specific alarm .

The data analyzing unit 104 can search for a rule having an evaluation criterion equal to or higher than a predetermined value among the rules between the alarm included in the first binary data and the abnormality included in the second binary data. As an example, the data analysis unit 104 may search for a rule satisfying the condition of "support degree> 0.1, reliability> 0.6, and improvement degree> 1" among the above rules as an association rule. , And the kind and threshold value of the evaluation criterion used for searching the association rule can be appropriately adjusted as needed.

FIG. 3 is an illustration of association rules searched in the data analysis unit 104 according to an embodiment of the present invention. As described above, the data analyzing unit 104 can search the rules included in the first binary data and the anomaly included in the second binary data by a rule having the evaluation criterion equal to or higher than a set value. In the above example, the data analysis unit 104 can search for one or more association rules associated with the abnormality A, and an example of the found association rule is shown in FIG.

Referring to FIG. 3, it can be seen that the degree of support between alarm 7 and abnormality A is 0.11, the reliability is 1, and the degree of improvement is 2. That is, the ratio of the alarm 7 and the alarm A at the same time is 0.11, the ratio of the alarm 7 including the alarm A is 1 (that is, 100%), And the case where the abnormal A is generated alone is 2.

In addition, it can be confirmed that the degree of support between the alarms 1 and 2 and the alarm A is 0.19, the reliability is 0.9, and the degree of improvement is 1.45. That is, the ratio of the alarms 1 and 2 and the alarm A at the same time is 0.19, and the ratio of the alarms 1 and 2 including the alarm A is 0.9 (that is, 90%), The ratio of the case where both the alarms 1 and 2 occur simultaneously and the case where the alarm A occurs alone is 1.45.

In view of the above search results, the data analysis unit 104 can determine that the alarm 7, alarm 4, alarm 8, alarm 5, 6, 9 / alarm 1, That is, the data analysis unit 104 determines whether or not the rule "alarm 7 => abnormal A", the rule "alarm 4 => abnormal A", the rule "alarm 8 => abnormal A" A ", rule" alarm 1, 2 => abnormal A "can be judged as the association rule.

Referring again to FIG. 1, the data classifier 106 determines the anomaly type associated with at least one of each alarm type from the found association rule.

In one example, the data classification unit 106 searches for the association rule having the highest reliability among the association rules for each alarm type or for each group including two or more alarm types, May be determined as an alarm type included in the association rule having the highest reliability or an abnormal type associated with the group. In the example of FIG. 3, the highest reliability (1) is shown for alarm 7 / alarm 4 / alarm 5, 6, 9, which gives rise to alarm 7, alarm 4, , It means that 100% of abnormal A occurs. Therefore, the data classification unit 106 sets the abnormal A included in the association rule "alarm 7 => abnormal A", rule "alarm 4 => abnormal A", rule "alarm 5, 6, 9 => abnormal A" You can determine the type of anomaly associated with alarm 7 / alarm 4 / alarm 5, 6, 9 included in the association rule.

As another example, the data classification unit 106 may search the association rule having the highest degree of improvement among the association rules by each alarm type or each group including two or more alarm types, and may include the association rule having the highest degree of improvement The type of abnormality that is determined by the alarm type or group included in the association rule having the highest degree of improvement. In the example above in FIG. 3, the highest improvement (2) is shown for alarm 7, which is twice as dangerous as the probability that an alarm A will occur randomly if alarm 7 occurs stochastically ) Event. Therefore, the data classification unit 106 can determine the abnormal A included in the association rule " alarm 7 => abnormal A " as an abnormal type associated with the alarm 7 included in the association rule.

In the meantime, the data classification unit 106 has been described as detecting an association rule having the highest reliability or degree of improvement among the association rules and determining an abnormal type associated with at least one of the alarm types. However, the present invention is not limited thereto, The unit 106 may search for association rules whose association or confidence is greater than or equal to a set value of reliability or improvement to determine the anomaly type associated with at least one of each alarm type. For example, the data classifier 106 may search for an association rule having a reliability of 0.95 or higher or an association rule having an improvement of 1.8 or higher among the association rules to determine an abnormal type associated with at least one of the respective alarm types.

The data classifier 106 may then classify the alarm type and the anomaly type by mapping the associated alarm type and the anomaly type to each other. As an example, the data classifier 106 may map the associated alarm type and the anomaly type to each other as shown in Tables 1 and 2 below.

Alarm type Associated abnormal type Alarm 7 Abnormal A (Abnormal occurrence probability 100%, Support 2) Alarm 9 Abnormal C (Abnormal occurrence probability 100%, Support 1.96) Alarms 5, 6 Abnormal F (abnormal occurrence probability 97%, support 2) Alarms 1, 4, and 8 J (abnormal occurrence probability 98%, support 1.98)

Abnormal type Associated alarm types Above A Alarm 7 (Abnormal occurrence probability 100%, Support 2)
Alarm 4 (100% probability of abnormal occurrence, 1.98 degree of support)
Alarm 8 (abnormality occurrence probability 97%, support degree 1.65),
Alarms 5, 6 and 9 (100% probability of abnormal occurrence, 1.6 of support)
Alarms 1 and 2 (abnormality occurrence probability 90%, support degree 1.45), Or more B Alarm 4 (100% probability of abnormality occurrence, 1.95 rating)
Alarms 2 and 4 (Abnormal occurrence probability 100%, Support 1.93)
Alarm 9 (95% probability of occurrence, support 1.9) Above C Alarm 1, 8 (100% probability of abnormal occurrence, support 1.91)

At this time, each alarm may be mapped to one or more variables (e.g., temperature, humidity, pressure, etc.), so that when a type of alarm associated with a particular type of abnormality is determined, It can be determined as an abnormal cause of abnormal type.

The data providing unit 108 provides the user with an abnormal type and an abnormal occurrence probability associated with the type of the alarm generated when an alarm is generated in monitoring the target object. When an alarm is generated in the course of monitoring the target object in the data monitoring system 300, the data providing unit 108 receives information about the generated alarm from the data monitoring system 300 (or the database 200) can do. The information on the alarm may include information on the number, type, and the like of the generated alarm. The data providing unit 108 is configured to determine whether the alarm type and the abnormal type associated with the type of the alarm generated from the information about each alarm type and the abnormal type classified in the data classification unit 106 (for example, Table 1 and Table 2 above) It is possible to grasp the abnormality occurrence probability (i.e., reliability). Data provider 108 may then provide the user with an anomaly type and an anomaly probability associated with the type of alarm generated. As an example, the data provider 108 may be configured to detect an anomaly type (e.g., anomalous A) and an anomalous probability (e.g., confidence 1) associated with the type of alarm (e.g., alarm 7) Or transmitting the information to a user terminal (not shown), or the like.

Thus, according to embodiments of the present invention, associative analysis techniques can be used to more easily navigate the association rules between alarms and anomalies and determine the type of anomaly associated with at least one of each alarm type, It is possible to efficiently grasp the mutual relationship between the respective variables. In particular, according to the embodiments of the present invention, it is possible to derive an association rule for each alarm type or each type of abnormality in a simpler way without processing data, and to efficiently use the associated alarm type and abnormality type in process mapping.

At this time, if the probability of occurrence of an anomaly related to the type of the generated alarm is less than or equal to a predetermined value (for example, 0.1), the data providing unit 108 determines that the generated alarm is a false alarm, Information on the false alarm can be updated in the database 200. [ That is, according to the embodiments of the present invention, it is determined whether or not the alarm generated based on the detected association rule and the classified data is a false alarm. If it is determined that the alarm is false, the false alarm is fed back to the database 200, The monitoring efficiency can be improved.

In addition, the data providing unit 108 may display one or more association rules found in the data analysis unit 104 in the form of a network graph. The network graph may represent an association rule by visualizing a combination of two or more nodes and links between the nodes. At this time, the data providing unit 108 may display at least one of the color, the size and the shape of the node or the link according to the discovered association degree.

FIG. 4 is an illustration of the association rules displayed in data provider 108 according to one embodiment of the present invention. Here, a description will be made of a process of displaying the association rule associated with the abnormality B in the data provider 108 in the form of a network graph for convenience of explanation.

Referring to FIG. 4, data provider 108 may visualize and display an association rule associated with anomaly B as a combination of two or more nodes and links between the nodes. As an example, in FIG. 4, the user can intuitively confirm that the alarm type associated with the abnormality B is Alarm 2, Alarm 3, Alarm 4, Alarm 6, Alarm 9, Further, as will be described later, the user can intuitively confirm that the probability of occurrence of the abnormality B is high when the alarm 2 and the alarm 4 occur simultaneously or the alarm 3 occurs.

At this time, the data providing unit 108 may display at least one of the color, the size and the shape of the node or the link according to the discovered association degree. As an example, the data providing unit 108 may increase the size of a node connected to the alarm event as the alarm event having a high degree of support is increased. Accordingly, in FIG. 4, It is intuitively confirmed that there are relatively many. As another example, the data providing unit 108 may display the color of the node connected to the alarm event more intensively as the alarm event has a higher reliability, It is intuitively confirmed that the probability of occurrence of abnormality B is relatively large. As another example, the data providing unit 108 may display the link type of the event linked to the alarm event in a bolder manner as the alarm event having a higher degree of improvement is displayed. Accordingly, in FIG. 4, It can be intuitively confirmed that the alarm is the main alarm which occurs particularly in the abnormality B only.

That is, according to the embodiments of the present invention, it is possible to display the discovered association rule in the form of a network graph and display the color or the size or the shape of the node or the link differently according to the detected association degree, Can provide a visual guideline for the user. In this case, the user can intuitively grasp the associated alarm type and the anomaly type, and thus the entire process can be easily understood.

5 is a flowchart illustrating an alarm information analysis method according to an embodiment of the present invention. In the illustrated flow chart, the method is described as being divided into a plurality of steps, but at least some of the steps may be performed in reverse order, combined with other steps, performed together, omitted, divided into detailed steps, One or more steps may be added and performed.

In step S102, the data collecting unit 102 collects the first binary data and the second binary data. As described above, the first binary data is information indicating whether an alarm is generated for each alarm type in a binary form (for example, 0 or 1), and the second binary data is binary type For example, 0 or 1).

In step S104, the data analysis unit 104 derives an evaluation criterion including at least one of supportability, reliability, and degree of improvement by applying the association analysis technique to the first binary data and the second binary data.

In step S106, the data analyzer 104 searches for one or more association rules among the alarms included in the first binary data and the anomaly included in the second binary data using the evaluation criteria. Specifically, the data analysis unit 104 may search for a rule having an evaluation criterion of a value equal to or greater than a predetermined value among the rules, using an association rule. As an example, the data analysis unit 104 may search for a rule satisfying the condition of "support degree> 0.1, reliability> 0.6, improvement degree> 1" among the above rules as an association rule. 104) can set a threshold to the evaluation criteria and search for an association rule that satisfies the threshold.

In step S108, the data classification unit 106 classifies the alarm type and the abnormal type by determining an abnormal type associated with at least one of the alarm types from the detected association rule, and by mutually mapping the associated alarm type and the abnormal type . As described above, the data classification unit 106 searches for association rules having the highest reliability or improvement among the association rules for each alarm type or each group including two or more alarm types, and the reliability or the degree of improvement is the highest The abnormal type included in the association rule can be determined as the abnormal type associated with the alarm type or group included in the association rule having the highest reliability or the highest degree of improvement.

In step S110, the data providing unit 108 provides the user with an anomaly type and an anomaly occurrence probability associated with the type of alarm generated at the time of alarm occurrence. As an example, the data providing unit 108 may display information on the type of the anomaly and the probability of occurrence of the anomaly associated with the type of the generated alarm, or transmit the information to the user through a method such as display to a user terminal (not shown) can do. At this time, the data providing unit 108 may display the association rule associated with the generated alarm in the form of a network graph, thereby providing the user with a visual guideline for the entire process.

FIG. 6 is an explanatory diagram illustrating an application of the alarm information analysis system 100 according to an embodiment of the present invention.

Referring to FIG. 6, the alarm information analysis system 100 collects first binary data (alarm information) and second binary data (abnormal information) stored in the database 200, and searches for an association rule therefrom. The database 200 may store not only the first binary data, the second binary data, but also the information related to the false alarm. The alarm information analysis system 100 can learn what probabilistic characteristic the alarm has when an alarm is generated.

If it is determined that the alarm has a probabilistic significance (that is, when it is determined that the reliability and the degree of improvement of the rule between the alarm and the specific abnormality are equal to or greater than the set value), the alarm information analysis system 100 (I. E., Meaningful information) about the associated anomaly type and the probability of occurrence of the anomaly to the data monitoring system 300. In this case, the user can utilize the information in the data monitoring process.

In addition, when it is determined that the alarm has a probabilistic significance (that is, when it is determined that the reliability and the degree of improvement of the rule between the alarm and the specific abnormality are equal to or greater than the set values), the alarm information analysis system 100 To the weighting system (400). The weighting system 400 may weight a corresponding alarm (or variable) to a monitoring statistic operation based on the analysis result, and may reflect the alarm (or variable) to the data monitoring system 300. In this case, the condition under which the alarm occurs may be changed dynamically, and the data monitoring system 300 may provide the user with information about which future alarms (or variables) have.

If it is determined that the alarm does not have probability significance (that is, when it is determined that the reliability and the degree of improvement of the rule between the alarm and the specific abnormality are less than the set values), the alarm information analysis system 100 And may update the information related to the false alarm stored in the database 200 by feeding back the false alarm to the database 200. [ In addition, the alarm information analysis system 100 can feedback the information on the false alarm to the data monitoring system 300 so that the data monitoring system 300 can prevent the corresponding alarms from being generated in the same situation, The monitoring efficiency can be improved. That is, according to embodiments of the present invention, an analytical aspect (for example, derived relevance, reliability, meaning of an association rule obtained from the degree of improvement) derived by performing the association degree and association rule search method described above and (Or filtering) logic in the case of a false alarm, a feedback (or filtering) logic in case of a false alarm, and a feedback May provide the user with information regarding the associated anomaly type.

FIG. 7 is a block diagram illustrating and illustrating a computing environment 10 including a computing device suitable for use in the exemplary embodiments. In the illustrated embodiment, each of the components may have different functions and capabilities than those described below, and may include additional components in addition to those not described below.

The illustrated computing environment 10 includes a computing device 12. In one embodiment, the computing device 12 may be one or more components included in the alarm information analysis system 100, or the alarm information analysis system 100.

The computing device 12 includes at least one processor 14, a computer readable storage medium 16, The processor 14 may cause the computing device 12 to operate in accordance with the exemplary embodiment discussed above. For example, processor 14 may execute one or more programs stored on computer readable storage medium 16. The one or more programs may include one or more computer-executable instructions, which when executed by the processor 14 cause the computing device 12 to perform operations in accordance with the illustrative embodiment .

The computer-readable storage medium 16 is configured to store computer-executable instructions or program code, program data, and / or other suitable forms of information. The program 20 stored in the computer-readable storage medium 16 includes a set of instructions executable by the processor 14. In one embodiment, the computer-readable storage medium 16 may be any type of storage medium such as a memory (volatile memory such as random access memory, non-volatile memory, or any suitable combination thereof), one or more magnetic disk storage devices, Memory devices, or any other form of storage medium that can be accessed by the computing device 12 and store the desired information, or any suitable combination thereof.

Communication bus 18 interconnects various other components of computing device 12, including processor 14, computer readable storage medium 16.

The computing device 12 may also include one or more input / output interfaces 22 and one or more network communication interfaces 26 that provide an interface for one or more input / output devices 24. The input / output interface 22 and the network communication interface 26 are connected to the communication bus 18. The input / output device 24 may be connected to other components of the computing device 12 via the input / output interface 22. The exemplary input and output device 24 may be any type of device, such as a pointing device (such as a mouse or trackpad), a keyboard, a touch input device (such as a touch pad or touch screen), a voice or sound input device, An input device, and / or an output device such as a display device, a printer, a speaker, and / or a network card. The exemplary input and output device 24 may be included within the computing device 12 as a component of the computing device 12 and may be coupled to the computing device 102 as a separate device distinct from the computing device 12 It is possible.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, I will understand. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be determined by equivalents to the appended claims, as well as the appended claims.

10: Computing environment
12: computing device
14: Processor
16: Computer readable storage medium
18: Communication bus
20: Program
22: I / O interface
24: input / output device
26: Network communication interface
100: Alarm information analysis system
102: Data collecting unit
104: Data analysis section
106: Data classification unit
108: Data provider
200: Database
300: Data monitoring system
400: weighting system

Claims (18)

A data collecting unit collecting first binary data indicating whether an alarm is generated for each alarm type and second binary data indicating whether an abnormality is generated for each abnormal type;
A data analyzer for searching at least one association rule indicating a degree of association between an alarm included in the first binary data and an abnormality included in the second binary data; And
And a data classifier for determining an abnormal type associated with at least one of the alarm types from the searched association rule.
The method according to claim 1,
The data analyzing unit derives an evaluation criterion including at least one of support, confidence, and lift of the rules between the alarm and the abnormality by using an association analysis technique And searching for one or more of the association rules using the evaluation criterion.
The method of claim 2,
Wherein the data analysis unit searches the association rule for a rule having the evaluation criterion equal to or higher than a predetermined value among the rules.
The method of claim 2,
Wherein the data classification unit searches the association rule having the highest reliability among the association rules for each alarm type or for each group including two or more alarm types, and the abnormality type included in the association rule having the highest reliability, The alarm information analysis system determines the alarm type included in the highest association rule or the anomaly type associated with the group.
The method of claim 2,
Wherein the data classifier searches the association rule having the highest degree of improvement among the association rules for each alarm type or for each group including two or more alarm types, An alarm type included in the association rule having the highest degree of improvement, or an abnormal type associated with the group.
The method according to claim 1,
Further comprising a data providing unit for providing the user with an abnormal type and an abnormal occurrence probability associated with the type of the alarm generated when an alarm is generated in monitoring the target object.
The method of claim 6,
Wherein the data providing unit is configured to determine that the alarm generated when the probability of occurrence of an anomaly related to the type of the generated alarm is less than a predetermined value as a false alarm and to update information on the false alarm to the database, Information analysis system.
The method according to claim 1,
Further comprising a data providing unit for visualizing and displaying one or more of the association rules in a combination of two or more nodes and links between the nodes.
The method of claim 8,
Wherein the data provider displays at least one of color, size and shape of the node or link differently according to the degree of association.
Collecting first binary data indicating whether an alarm has been generated for each alarm type and second binary data indicating whether an abnormality has occurred for each abnormal type in the data collecting unit;
Searching at least one association rule indicating a degree of association between an alarm included in the first binary data and an abnormality included in the second binary data in the data analysis unit; And
And in the data classifier, determining an abnormal type associated with at least one of the alarm types from the searched association rule.
The method of claim 10,
The searching of the association rule may include an evaluation including at least one of Support, Confidence and Lift of the rules between the alarm and the abnormality by using Association Analysis Deriving a criterion, and using the evaluation criterion to search for one or more of the association rules.
The method of claim 11,
Wherein the searching for the association rule searches the association rule for a rule having the evaluation criterion equal to or higher than a set value among the rules.
The method of claim 11,
Wherein the step of determining an anomaly type associated with each alarm type from the association rule comprises: searching the association rule having the highest reliability among the association rules by each alarm type or each group including two or more alarm types, Determining an abnormal type included in the highest association rule as an alarm type included in the association rule having the highest reliability or an abnormal type associated with the group.
The method of claim 11,
Wherein the step of determining an anomaly type associated with each alarm type from the association rule comprises: searching an association rule having the highest degree of improvement among the association rules by each alarm type or each group including two or more alarm types; The abnormality type included in the association rule having the highest degree is determined as the abnormality type associated with the alarm type or group included in the association rule having the highest degree of improvement.
The method of claim 10,
After determining the anomaly type associated with each alarm type from the association rule,
The method of claim 1, further comprising providing the user with an anomaly type and an anomaly probability associated with the type of the alarm that is generated when an alarm is generated in monitoring the target object in data providing.
16. The method of claim 15,
After searching the association rule,
Determining that the alarm generated when the anomaly occurrence probability associated with the type of the generated alarm is less than or equal to a predetermined value in the data providing unit is a false alarm and updating information about the false alarm in the database Further comprising the steps of:
The method of claim 10,
After determining the anomaly type associated with each alarm type from the association rule,
Further comprising visualizing and displaying one or more of the association rules in a combination of two or more nodes and a link in the data providing.
18. The method of claim 17,
Wherein displaying one or more of the association rules displays one or more of the color, size and shape of the node or link differently according to the association.

Images