KR102190578B1 - System and method for detecting and predicting anomalies based on analysis of text data - Google Patents

Abstract

Disclosed are a system and method for detecting and predicting anomalies through analysis of text data. An abnormality detection and prediction system according to an embodiment of the present invention includes a case database storing case data related to abnormality or normality of a monitoring target; A data collection unit collecting text data generated by the monitoring target; An abnormality detector configured to detect whether an abnormality has occurred in the monitored object from the text data; And a prediction unit that, when the occurrence of an abnormality in the monitored object is detected, compares the text data and past case data to predict whether the detected abnormality spreads or disappears.

Description

Anomaly detection and prediction system and method through text data analysis {SYSTEM AND METHOD FOR DETECTING AND PREDICTING ANOMALIES BASED ON ANALYSIS OF TEXT DATA}

Embodiments of the present invention relate to a technology for detecting an abnormality through analysis of text data and predicting the spread or disappearance of a detected abnormality.

As most of the work of companies or government agencies has been computerized, it has become common for companies to build and manage large-scale enterprise service infrastructure. In the case of such an enterprise service infrastructure, a number of web servers, web application servers (WAS), databases, firewalls, switches, routers, etc. are included, and any one abnormality affects other equipment and even the entire system. In many cases, continuous condition monitoring is required.

To this end, monitoring has been performed by collecting status information such as log data from each device, and notifying an administrator of a notification when the collected information exceeds a preset threshold. However, since this conventional method is a method of simply determining whether the acquired data exceeds a threshold value, there is a limitation in predicting how the generated abnormality will develop.

Republic of Korea Patent Publication No. 10-2013-0123007 (November 12, 2013)

Embodiments of the present invention are to provide a means for quickly detecting an abnormality of a monitoring target through fusion between text data collected in real time and past case data, and effectively predicting whether the detected abnormality spread or disappears.

According to an exemplary embodiment, there is provided a case database for storing case data related to abnormality or normality of a monitored object; A data collection unit collecting text data generated by the monitoring target; An abnormality detector configured to detect whether an abnormality has occurred in the monitored object from the text data; And a prediction unit for predicting whether the detected abnormality spreads or disappears by comparing the text data and past case data when the occurrence of an abnormality in the monitoring object is detected.

The data collection unit may extract visual information and a state keyword related to normal or abnormality of the monitored object from each of the collected text data, and group the extracted visual information and the state keyword according to a preset time period.

When the text data includes a measurement value expressed in a number form, the data collection unit calculates an average or median value of the measurement values collected in the same time period, and a specific character string set in correspondence with the average value or median value Can be set as the status keyword.

When the status keyword matches any one of preset abnormality detection reference keywords, the abnormality detection unit may determine that an abnormality has occurred in the monitoring target.

The abnormality detector may output a warning message when it is determined that an abnormality has occurred in the monitoring target.

The case data may include an abnormal case keyword related to the abnormality of the monitored object; A related keyword of the abnormal case keyword; An improvement degree reference value by analyzing an increase in the frequent pattern between the abnormal case keyword and the related keyword; And information on whether the abnormal case has spread or disappeared.

The prediction unit extracts a correlation candidate keyword with the highest frequency among keywords collected from text data at the same time as the abnormal keyword obtained from the text data, and analyzes an increase in the frequent pattern between the abnormal keyword and the relevant candidate keyword. Calculate the degree of improvement, search for the abnormal keyword, the associated candidate keyword, and case data corresponding to the degree of improvement in the case database, and predict the spread or disappearance of the detected abnormality according to the spread or disappearance of the searched case data. I can.

The prediction unit may predict whether the detected abnormality spreads or disappears when the occurrence of the same abnormality is detected more than a preset number of times in consecutive time periods.

The system, when there is no case data corresponding to the anomaly keyword and the association candidate keyword, or whether the actual abnormality spread or disappearance detected by the monitoring target does not match the prediction of the prediction unit, the association candidate It may further include a case update unit for updating the case data stored in the case database by using the keyword and the degree of improvement.

According to another exemplary embodiment, an abnormality detection and prediction method performed by an abnormality detection and prediction system, comprising: collecting text data generated from a monitoring target; Detecting whether an abnormality occurs in the monitoring target from the text data; And predicting the spread or disappearance of the detected abnormality in comparison with the text data and past case data related to the abnormality or normality of the monitoring object when the occurrence of an abnormality in the monitoring object is detected. A method is provided.

The collecting of the text data may include extracting visual information and a status keyword related to normal or abnormality of the monitored object from each of the collected text data; And grouping the extracted time information and the status keyword for each preset time period.

The extracting of the status keyword includes calculating an average or median value of the measured values collected in the same time period, and corresponding to the average or median value, when the text data includes a measurement value expressed in a numeric form. As a result, a preset specific character string can be set as the status keyword.

In the detecting whether the abnormality has occurred, when the status keyword matches any one of preset abnormality detection reference keywords, it may be determined that the abnormality has occurred in the monitoring target.

The detecting whether the abnormality has occurred may further include outputting a warning message when it is determined that the abnormality has occurred in the monitoring target.

The case data may include an abnormal case keyword related to the abnormality of the monitored object; A related keyword of the abnormal case keyword; An improvement degree reference value by analyzing an increase in the frequent pattern between the abnormal case keyword and the related keyword; And information on whether the abnormal case has spread or disappeared.

The predicting may include: extracting an association candidate keyword having the highest frequency among keywords collected from text data at the same time as the abnormal keyword acquired from the text data; Calculating an improvement degree by analyzing an increase in the frequent pattern between the abnormal keyword and the association candidate keyword; Searching the case database for case data corresponding to the abnormal keyword, the association candidate keyword, and the degree of improvement; And determining whether the detected abnormality spread or disappears according to whether the searched case data spreads or disappears.

In the predicting step, when the occurrence of the same abnormality is detected more than a preset number of times in a continuous time period, it is possible to predict whether the detected abnormality spread or disappears.

The method comprises the step of determining whether case data corresponding to the abnormal keyword and the associated candidate keyword does not exist, or whether the actual abnormality detected by the monitoring target is spread or disappeared as a result of the search of the searching step. If it does not match the determination result, the step of updating the case data using the associated candidate keyword and the degree of improvement may be further included.

According to another exemplary embodiment, the method comprising: collecting text data generated from a monitoring target by being combined with hardware; Detecting whether an abnormality occurs in the monitoring target from the text data; And predicting the spread or disappearance of the detected abnormality by comparing the text data and past case data related to the abnormality or normality of the monitoring object when the occurrence of an abnormality in the monitoring object is detected. For this purpose, a computer program stored on a recording medium is provided.

According to embodiments of the present invention, it is possible to quickly detect an abnormality in a monitored object through the fusion between text data collected in real time and past case data, and effectively predict whether the detected abnormality spreads or disappears.

In addition, according to embodiments of the present invention, it is possible to more effectively detect an abnormality of a monitored object by dynamically updating case data according to a prediction result of a detected abnormality spread or disappearance and whether or not the actual spread/disappear.

1 is a block diagram illustrating the configuration of an abnormality detection and prediction system according to an embodiment of the present invention.
2 is a flow chart for explaining an abnormality detection and prediction method 500 according to an embodiment of the present invention

Hereinafter, a specific embodiment of the present invention will be described with reference to the drawings. The following detailed description is provided to aid in a comprehensive understanding of the methods, devices, and/or systems described herein. However, this is only an example and the present invention is not limited thereto.

In describing the embodiments of the present invention, when it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted. In addition, terms to be described later are terms defined in consideration of functions in the present invention and may vary according to the intention or custom of users or operators. Therefore, the definition should be made based on the contents throughout this specification. The terms used in the detailed description are only for describing embodiments of the present invention, and should not be limiting. Unless explicitly used otherwise, expressions in the singular form include the meaning of the plural form. In this description, expressions such as "comprising" or "feature" are intended to refer to certain features, numbers, steps, actions, elements, some or combination thereof, and one or more other than those described. It should not be construed to exclude the presence or possibility of other features, numbers, steps, actions, elements, any part or combination thereof.

1 is a block diagram illustrating the configuration of an abnormality detection and prediction system 100 according to an embodiment of the present invention. The abnormality detection and prediction system 100 according to an embodiment of the present invention is connected to a monitoring object through a wired or wireless network, collects status information from the monitoring object, and uses the collected status information to It is a device that detects the occurrence of occurrence and predicts whether the detected abnormality will spread or disappear. In one embodiment, the monitoring target may be an enterprise service equipment such as a global site selector (GSS), a web server, a web application server (WAS), a database server, a firewall, a switch, and a router. , The present invention is not limited to a specific monitoring target, and all kinds of devices or facilities requiring detection of abnormalities may also be the monitoring target of the present invention. In addition, in embodiments of the present invention, the status information may be data in the form of text transmitted periodically from the monitoring target or when a specific condition is satisfied. For example, the status information may be a text type message (a ping message, a heartbeat message, or an error message) or text type log data.

As shown, the abnormality detection and prediction system 100 according to an embodiment of the present invention includes a data collection unit 102, a case database 104, an abnormality detection unit 106, and a prediction unit 108 do.

The data collection unit 102 collects text data generated from the monitoring target. In an embodiment, the data collection unit 102 may extract visual information and a status keyword related to normal or abnormality of the monitored object from each of the collected text data. This is described as an example as follows.

For example, the global site selector (GSS) located at the front end of a web site may send a log message in the following format.

GSS Log messages

normal:Sep 2 17:00:40: %KAL-4-TCPTRANS: [2000]STATE ONLINE [210.118.76.142:52171] [LID: 38]

Above: Sep 2 17:00:08 : %KAL-4-TCPTRANS: [2000] STATE OFFLINE [210.118.76.142:52158] [LID: 38]

Referring to the above two log messages, each log message includes transmission time information (Sep 2 17:00:40, Sep 2 17:00:08) in the first part, and information related to the GSS status ( ONLINE or OFFLINE) are included. That is, when ONLINE is included in the log message, it can be seen that it is a normal state, and when OFFLINE is included, it is known that it is an abnormal state. Accordingly, in this case, the data collection unit 102 may extract the following keywords from each message.

Sep 2 17:00:40, STATE ONLINE

Sep 2 17:00:08, STATE OFFLINE

As another example, the switch may transmit a log message in the following form.

Log messages from the switch

Normal: Mar 17 05:53:43.647 KST : %C6KENV-SP-4-PSFANOK: the fan in power supply 1 is OK

Above: Mar 10 02:37:09.631 KST : %C4K_IOSMODPORTMAN-4-POWERSUPPLYBAD: Power supply 1 has failed or been turned off

As in the example of the GSS, the two log messages also include transmission time information (Mar 17 05:53:43.647 KST, Mar 10 02:37:09.631) in the first part, and information related to the state of the switch (in the middle). OK or failed) is included. That is, when the log message includes OK, it can be seen that the log message is in a normal state, and when the log message includes failed, it is an abnormal state. Accordingly, in this case, the data collection unit 102 may extract the following keywords (time information and status values) from each message.

Mar 17 05:53:43, OK

Mar 10 02:37:09, failed

When a keyword is extracted from text data as described above, the data collection unit 102 may then group the extracted time information and the status keyword by preset time slot. For example, when the time zone is set to 10 seconds, the data collection unit 102 may group keywords obtained from text data collected for 10 seconds as shown in Table 1 below.

slot Keyword group One Sep 2 17:00:00 GSS STATE OFFLINE WEBSERVER GET 443… ROUTER 1 2 Sep 2 17:00:10 GSS STATE OFFLINE WEBSERVER HEAD… ROUTER 2 3 Sep 2 17:00:20 GSS STATE OFFLINE WEBSERVER GET 443… ROUTER 2 4 Sep 2 17:00:30 GSS STATE OFFLINE WEBSERVER GET 443… ROUTER 1 5 Sep 2 17:00:40 GSS STATE ONLINE SWITCH Module On… ROUTER 3

As can be seen in Table 1, the keyword group for each time period includes the start time of the corresponding time period, the type of the monitoring target to which text data is transmitted, and the status of the monitoring target. For example, in the case of time zone 1 above, as a value extracted from text data collected from 17:00:00 on September 2 to 17:00:10 seconds, the status of GSS is STATE OFFLINE, and the web server The status indicates GET 443 (omitted hereafter). That is, the data collection unit 102 may generate a keyword group for each time period by listing the type and state of the monitoring target in one character string in the same time period.

Meanwhile, when the text data includes a measurement value expressed in a number form, the data collection unit 102 calculates an average or median value of the measurement values collected in the same time period and corresponds to the average or median value. A set specific character string can be set as the status keyword. For example, assume that CPU utilization is received once per second from a specific monitored target. In this case, the data collection unit 102 collects the CPU usage rate received every second for each preset time period (for example, 10 seconds), and calculates a representative value (average or median value) of the CPU usage rate for each time period.

Thereafter, the data collection unit 102 replaces the calculated representative value with a character string. For example, suppose that the CPU usage rate exceeds 70% and is set to "normal", and when the CPU usage is below 70%, it is set to "normal". If the average value of the CPU usage rate in a specific time period is 68%, the data collection unit 102 may set a keyword corresponding to the CPU usage rate in the corresponding time period to "normal". In addition, if the average value of the CPU usage rate in a specific time period is 75%, the data collection unit 102 may set a keyword corresponding to the CPU usage rate in the corresponding time period as "above". In this way, when numeric data is changed to text corresponding to the value, numeric data can be treated in the same manner as keywords of other log data.

Next, the case database 104 is a database that stores and manages past case data related to the state of the monitoring target (whether abnormal or normal). In one embodiment of the present invention, the case database 104 stores and manages keyword information when a past anomaly of a monitoring target is detected and information on whether an abnormality has spread or disappeared in the case. At this time, a case in which an abnormality is "disappeared" (hereinafter, "extinction case") refers to a case in which an abnormality in the monitored object has been detected but returned to a normal state without taking any other measures, and a case in which the abnormality has been "proliferated" (hereinafter referred to as "spread case" ) Refers to cases in which the abnormality of the monitored object persisted or gradually expanded and separate measures were taken.

Specifically, the following data may be stored in the case database 104.

-Abnormal case keywords related to the abnormality to be monitored

-Related keywords of abnormal case keywords

-Reference value of lift by correlation analysis of Frequent Pattern Growth (FPG) between abnormal case keywords and related keywords

-Whether the abnormal case spreads or disappears

The abnormality detection unit 106 detects whether an abnormality has occurred in the monitoring target by using the text data collected by the data collection unit 102. In one embodiment, the abnormality detection unit 106 may determine that an abnormality has occurred in the monitoring object when the status keyword obtained from text data collected from the monitoring object matches any one of preset abnormality detection criteria keywords. have.

To this end, the abnormality detection unit 106 may store and manage a separate abnormality detection reference keyword. For example, the abnormality detection criterion keyword may include the following words, and may be appropriately set in consideration of a message generated from a monitoring target.

down, Down, DOWN, fail, Fail, FAIL, err, Err, Error, fatal, Fatal, FATAL, reject, Reject, REJECT, timeout, Timeout, TIMEOUT, off, Off, OFF, critical, Critical, CRITICAL

That is, the abnormality detection unit 106 may determine that an abnormality has occurred in the monitoring target when one or more of the above-described words are included in the status keyword. The abnormality detection unit 106 may output a warning message through visual or audio means, etc., when it is determined that an abnormality has occurred in the monitored object. For example, the abnormality detection unit 106 may be configured to display a warning message on the administrator's terminal or to emit an alarm sound.

When the occurrence of an abnormality in the monitored object is detected by the abnormality detection unit 106, the prediction unit 108 predicts whether the detected abnormality spreads or disappears by comparing text data and past case data stored in the case database 104 . In one embodiment, the prediction unit 108 extracts the most frequent related candidate keyword among keywords collected from text data at the same time as the abnormal keyword obtained from the text data, and between the abnormal keyword and the related candidate keyword The degree of improvement is calculated by the Frequent Pattern Growth (FPG) association analysis (hereinafter, FPG association analysis), and case data corresponding to the abnormal keyword, the association candidate keyword, and the improvement degree are stored in the case database 104 Search in, and predict whether the detected abnormality will spread or disappear according to whether the searched case data spreads or disappears. This will be described in more detail as follows.

When the occurrence of an abnormality in the monitoring target is detected by the abnormality detection unit 106, the prediction unit 108 collects abnormal keywords and abnormal keywords from the keyword group for each time period generated by the data collection unit 102 at the same time Among the keywords, the most frequent related candidate keywords are extracted. For example, assume that the OFFLINE state of GSS is detected in the example of Table 1. In this case, the abnormality detection unit 106 uses "OFFLINE" as the abnormal keyword, and the keyword "GET 443" of WEBSERVER, which is the keyword that appears most in time zones 1, 2, 3, 4, which is the time zone in which the OFFLINE status of GSS is recorded, is a candidate for association. Set with keywords.

Next, the prediction unit 108 calculates an association relationship between the two keywords through FPG association analysis between the abnormal keyword and the association candidate keyword. FPG association analysis refers to an analysis method that analyzes the association relationship between keywords by calculating Support, Confidence, and Lift between factors. For example, in the above example, the degree of support, reliability, and degree of improvement between the abnormal keyword and the associated candidate keyword may be calculated as follows.

For convenience of explanation, the ideal keyword will be referred to as the keyword X and the related candidate keyword will be referred to as the keyword Y. First, the probability of each keyword appearing in the entire data set is calculated as shown in Equations 1 and 2 below. In the present embodiment, it is assumed that the last five time zones (transactions) are the entire data set, but the range of the entire data set may be appropriately set in consideration of a monitoring target or the like.

[Equation 1]

[Equation 2]

Further, Y's support, reliability, and improvement of Y for X are calculated from Equations 3 to 5 below.

[Equation 3]

[Equation 4]

[Equation 5]

The degree of improvement is a measure of whether two factors are independent of each other. If it is 1, it is independent, if it is greater than 1, it is in close relationship, and if it is less than 1, it is in opposite relationship. Therefore, in the case of the above example, since the degree of improvement between X and Y is 1.25, there is a close relationship between X and Y.

When the degree of improvement is calculated in this way, the prediction unit 108 then searches the case database 104 for whether or not a case with an improvement degree of 1 or more between X and Y exists, and whether the searched case spreads or disappears. Predicts whether the detected abnormality will spread or disappear according to For example, if a case with the same keyword and degree of improvement exists among cases stored in the case database 104, and the case is a case of spreading a failure, the prediction unit 108 predicts that the detected abnormality will spread, conversely, the failure disappears. In the case of a case, it is predicted that the detected abnormality will disappear.

In an embodiment of the present invention, when the occurrence of the same abnormality is detected more than a preset number of times in consecutive time periods, the prediction unit 108 may predict whether the detected abnormality spreads or disappears. For example, in the case of Table 1, assuming that the same anomaly appears repeatedly 3 or more times as a reference value, the prediction unit 108 spreads an anomaly detected in time zone 4 after the GSS STATE OFFLINE is detected 3 times. Or it predicts whether it will disappear.

Meanwhile, the abnormality detection and prediction system 100 according to an embodiment of the present invention may further include a case update unit 110. The case update unit 110 does not exist in the case database 104 as a result of the search result of the prediction unit 108 and the case data corresponding to the associated candidate keyword, or the actual abnormality detected by the monitoring target is spread. Alternatively, if the disappearance does not coincide with the prediction of the prediction unit, case data stored in the case database is updated using the associated candidate keyword and the degree of improvement.

Returning to the example of Table 1, in the case of Table 1, the GSS STATE was switched from OFFLINE to ONLINE in time zone 5, and this case corresponds to a case in which the failure disappeared. However, if the same case is recorded as a failure spread in the case database 104, or if the same case is not recorded in the case database 104, the case update unit 110 converts the currently found case into a case database. By updating to (104), it can be used for future failure prediction.

2 is a flowchart illustrating an abnormality detection and prediction method 500 according to an embodiment of the present invention. The abnormality detection and prediction method 500 according to an embodiment of the present invention may be performed by the above-described abnormality detection and prediction system 100.

In step 502, the data collection unit 102 collects text data generated in the monitoring target.

In step 504, the abnormality detector 106 detects whether an abnormality has occurred in the monitoring target from the text data.

In step 506, the prediction unit 108 predicts the spread or disappearance of the detected abnormality by comparing the text data and past case data related to the abnormality or normality of the monitored object.

In step 508, the case update unit 110 determines whether there is no case data corresponding to the abnormal keyword and the associated candidate keyword as a result of the execution of step 506, or whether the actual abnormality detected by the monitoring object is spread or disappeared. If it does not match the prediction result, the case data is updated according to whether the actual abnormality of the monitored object spreads or disappears.

Meanwhile, an embodiment of the present invention may include a program for performing the methods described in the present specification on a computer, and a computer-readable recording medium including the program. The computer-readable recording medium may include a program command, a local data file, a local data structure, or the like alone or in combination. The media may be specially designed and configured for the present invention, or may be commonly used in the field of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, and specially configured to store and execute program instructions such as ROM, RAM, and flash memory. Hardware devices are included. Examples of the program may include not only machine language codes created by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

Although the exemplary embodiments of the present invention have been described in detail above, those of ordinary skill in the art to which the present invention pertains will understand that various modifications may be made to the above-described embodiments without departing from the scope of the present invention. . Therefore, the scope of the present invention is limited to the described embodiments and should not be determined, and should not be determined by the claims to be described later, but also by those equivalents to the claims.

100: anomaly detection and prediction system
102: data collection unit
104: case database
106: abnormality detection unit
108: prediction unit
110: Case update section

Claims (19)

A case database for storing case data related to abnormality or normality of a monitored object;
A data collection unit that is generated in the monitoring target and collects text data including a status keyword related to normal or abnormality of the monitoring target;
An abnormality detector configured to detect whether an abnormality has occurred in the monitoring target from the text data; And
When the occurrence of an abnormality in the monitored object is detected, comprising a predictor for predicting whether the detected abnormality spread or disappears by comparing the text data and past case data,
The data collection unit,
Extracting time information and the status keyword from each of the collected text data, grouping the extracted time information and the status keyword by preset time period,
The abnormality detection unit,
An abnormality detection and prediction system that determines that an abnormality has occurred in the monitoring target when the status keyword matches any one of preset abnormality detection reference keywords.
delete The method according to claim 1,
When the text data includes a measurement value expressed in a numeric form,
Calculate the average or median value of the measured values collected in the same time period,
An abnormality detection and prediction system for setting a specific character string set in correspondence with the average value or the median value as the status keyword.
delete The method according to claim 1,
The abnormality detection and prediction system for outputting a warning message when it is determined that an abnormality has occurred in the monitoring target.
The method according to claim 1,
The above case data is:
Abnormal case keywords related to the abnormality of the monitored object;
A related keyword of the abnormal case keyword;
An improvement degree reference value by analyzing an increase in the frequent pattern between the abnormal case keyword and the related keyword; And
Anomaly detection and prediction system, including information on whether the anomaly has spread or disappears.
The method of claim 6,
The prediction unit,
Extracting a candidate keyword with the highest frequency among the keywords collected from text data at the same time as the abnormal keyword obtained from the text data,
Calculate the degree of improvement by analyzing the increase in the frequent pattern between the abnormal keyword and the associated candidate keyword,
Searching the case data corresponding to the abnormal keyword, the association candidate keyword, and the degree of improvement in the case database,
Anomaly detection and prediction system that predicts the spread or disappearance of a detected abnormality according to whether the searched case data spreads or disappears.
The method of claim 7,
The prediction unit, when the occurrence of the same abnormality is detected more than a preset number of times in consecutive time periods, predicts whether the detected abnormality spreads or disappears.
The method of claim 7,
Case data corresponding to the abnormal keyword and the associated candidate keyword does not exist, or
When the actual abnormal spread or disappearance of an abnormality detected by the monitoring target does not match the prediction of the prediction unit,
An abnormality detection and prediction system further comprising a case update unit for updating case data stored in the case database using the associated candidate keyword and the degree of improvement.
An abnormality detection and prediction method performed in an abnormality detection and prediction system,
Collecting text data generated in a monitoring target and including a status keyword related to normal or abnormality of the monitoring target;
Detecting whether an abnormality occurs in the monitoring target from the text data; And
When the occurrence of an abnormality in the monitored object is detected, predicting whether the detected abnormality spread or disappears against the text data and past case data related to the abnormality or normality of the monitoring object,
Collecting the text data,
Extracting visual information and the status keyword from each of the collected text data; And
Grouping the extracted time information and the status keyword according to a preset time zone,
The step of detecting whether the abnormality has occurred,
When the status keyword matches any one of preset abnormality detection reference keywords, it is determined that an abnormality has occurred in the monitoring target.
delete The method of claim 10,
The step of extracting the status keyword,
If the text data contains measurement values expressed in numeric form,
Calculate the average or median value of the measured values collected in the same time period,
An abnormality detection and prediction method for setting a predetermined character string corresponding to the average value or the median value as the status keyword.
delete The method of claim 10,
The step of detecting whether the abnormality has occurred,
The method of detecting and predicting an abnormality further comprising outputting a warning message when it is determined that an abnormality has occurred in the monitoring object.
The method of claim 10,
The above case data is:
Abnormal case keywords related to the abnormality of the monitored object;
A related keyword of the abnormal case keyword;
An improvement degree reference value by analyzing an increase in the frequent pattern between the abnormal case keyword and the related keyword; And
An anomaly detection and prediction method that includes information on whether the anomaly has spread or disappears.
The method of claim 15,
The predicting step,
Extracting an association candidate keyword with the highest frequency among keywords collected from text data at the same time as the abnormal keyword acquired from the text data;
Calculating an improvement degree by analyzing an increase in the frequent pattern between the abnormal keyword and the association candidate keyword;
Searching case data corresponding to the abnormal keyword, the association candidate keyword, and the degree of improvement in a case database; And,
An abnormality detection and prediction method further comprising the step of determining whether the detected abnormality spreads or disappears according to whether the searched case data spreads or disappears.
The method of claim 16,
The predicting step,
An abnormality detection and prediction method for predicting whether the detected abnormality spreads or disappears when the same abnormality occurs more than a preset number of times in a continuous time period.
The method of claim 16,
As a result of the search in the searching step, case data corresponding to the abnormal keyword and the associated candidate keyword does not exist, or
If the actual abnormality detected by the monitoring object does not spread or disappear with the determination result of the determining step,
The method further comprising the step of updating the case data using the associated candidate keyword and the degree of improvement.
Combined with hardware,
Collecting text data generated in a monitoring target and including a status keyword related to normal or abnormality of the monitoring target;
Detecting whether an abnormality occurs in the monitoring target from the text data; And
When the occurrence of an abnormality in the monitored object is detected, in order to execute the steps including the step of predicting whether the detected abnormality spreads or disappears against the text data and past case data related to the abnormality or normality of the monitoring object Stored in the recording medium,
Collecting the text data,
Extracting visual information and the status keyword from each of the collected text data; And
Grouping the extracted time information and the status keyword according to a preset time zone,
The step of detecting whether the abnormality has occurred,
When the status keyword matches any one of preset abnormality detection criteria keywords, it is determined that an abnormality has occurred in the monitoring target.

Images