KR102267458B1 - Method for determinating optimal anomaly detection model for processing input data - Google Patents

Abstract

A computer program stored in a computer-readable storage medium is disclosed according to an embodiment of the present disclosure. The computer program, when executed on one or more processors of a computing device, causes the following operations to be performed for managing the model, wherein the operations are performed on a network pre-trained using a plurality of training data subsets included in the training data set. generating an anomaly sensing model including a plurality of anomaly sensing submodels including a function; determining one or more anomaly sensing submodels for calculating input data from among the generated plurality of anomaly sensing submodels; and determining whether an anomaly exists in the input data using the determined one or more anomaly detection submodels.

Description

METHOD FOR DETERMINATING OPTIMAL ANOMALY DETECTION MODEL FOR PROCESSING INPUT DATA

The present disclosure relates to the field of artificial intelligence technology, and more particularly, to anomalous detection using artificial intelligence technology.

As sensor data that can be temporarily or permanently stored in a database is accumulated, research on automated processing of monitoring data of numerous industrial equipment is in progress. In order to implement a method for determining the state of data, research on artificial intelligence technology using an artificial neural network is in progress.

A deep learning model using an artificial neural network provides a method to effectively learn complex nonlinear or dynamic patterns, but there was a technical challenge for updating the model when the data to be processed changes.

Korean Patent Publication No. KR1020180055708 discloses an image processing method using artificial intelligence.

The present disclosure has been devised in response to the above-described background technology, and is intended to provide a data processing method utilizing artificial intelligence.

Disclosed is a computer program stored in a computer-readable storage medium according to an embodiment of the present disclosure for realizing the above-described problems. The computer program, when executed on one or more processors of a computing device, causes the following operations to be performed for managing the model, wherein the operations are performed on a network pre-trained using a plurality of training data subsets included in the training data set. generating an anomaly sensing model including a plurality of anomaly sensing submodels including a function; determining one or more anomaly sensing submodels for calculating input data from among the generated plurality of anomaly sensing submodels; and determining whether an anomaly exists in the input data using the determined one or more anomaly detection submodels.

In an alternative embodiment, the determining of one or more anomaly sensing submodels for calculating input data among the generated plurality of anomaly sensing submodels comprises: processing other input data for the plurality of anomaly sensing submodels. and determining one or more anomaly sensing submodels for calculating the input data based on at least one of a tendency, context information of the input data, or cluster information of the input data.

In an alternative embodiment, the determining of one or more anomaly sensing submodels for calculating input data from among the generated plurality of anomaly sensing submodels comprises calculating other input data having a predetermined relationship with the input data. and determining one anomaly sensing submodel as an anomaly sensing submodel for calculating the input data.

In an alternative embodiment, the other input data may include input data generated prior to generation of the input data, and may include data generated within a predetermined time interval with the input data.

In an alternative embodiment, the operation of determining an anomaly sensing submodel obtained by calculating other input data having a predetermined relationship with the input data as an anomaly sensing submodel for calculating the input data may include: and determining an anomaly sensing sub-model in which other input data having a determined relationship is determined as normal data as an anomaly sensing sub-model for calculating the input data.

In an alternative embodiment, the determining of one or more anomaly detection submodels for calculating input data from among the plurality of generated anomaly detection submodels includes: based on context information of the input data, the context information and and determining a matching anomaly detection submodel as one or more anomaly detection submodels for calculating the input data.

In an alternative embodiment, the context information includes information associating input data with a normal pattern, a context indicator associating the input data with at least one of a manufacturing recipe or manufacturing equipment, a manufacturing recipe characteristic of the input data, or It may include at least one of a context characteristic indicator associated with at least one of the manufacturing equipment characteristics, or a missing characteristic indicator including information on the missing characteristic of the input data.

In an alternative embodiment, the context information may match at least one of the input data or the training data, and the anomaly sensing submodel may match context information matched to the training data subset.

In an alternative embodiment, the determining of one or more anomaly detection submodels for calculating input data among the generated plurality of anomaly detection submodels may include: clustering one or more other input data based on similarity; and determining an anomaly sensing submodel obtained by calculating other input data included in the cluster to which the input data belongs as an anomaly sensing submodel for calculating the input data.

In an alternative embodiment, clustering the plurality of anomaly sensing submodels; and generating an integrated anomalous sensing submodel by integrating one or more anomalous sensing submodels included in one cluster.

In an alternative embodiment, the clustering of the plurality of anomaly sensing submodels is based on at least one of context information matched to each of the anomalous sensing submodels, or an input data processing characteristic of each of the anomaly sensing submodels. The method may include clustering one or more anomaly detection submodels included in the plurality of anomaly detection submodels.

In an alternative embodiment, the clustering of the plurality of anomaly sensing submodels may include clustering the anomalous sensing submodels based on a determination result of input data of each of the anomalous sensing submodels. can

In an alternative embodiment, the clustering of the anomaly detection submodel based on the determination result for the input data of each of the anomaly detection submodels may include an input different from the anomalous detection submodel determined as normal data. The method may include clustering other anomaly detection submodels in which data is determined as normal data into one cluster when the input data and the other input data are related.

In an alternative embodiment, the clustering of the anomalous detection submodels based on a determination result of the input data of each of the anomaly detection submodels may include one or more anomaly detection submodels that determine the input data as normal data. It may include the operation of classifying the model into one cluster.

In an alternative embodiment, the operation of generating an integrated anomaly detection submodel by integrating one or more anomaly detection submodels included in one cluster includes: ensemble to create a unified anomaly sensing submodel.

In an alternative embodiment, the operation of generating a unified anomaly detection submodel by integrating one or more anomaly detection submodels included in one cluster may include: removing at least a portion to generate a unified anomaly sensing submodel.

In an alternative embodiment, the operation of generating a unified anomaly detection submodel by integrating one or more anomaly detection submodels included in one cluster may include: and generating an integrated anomaly sensing submodel based on the performance test.

In an alternative embodiment, the operation of generating an integrated anomaly detection submodel by integrating one or more anomaly detection submodels included in one cluster includes: It may include the operation of generating an integrated anomaly sensing submodel by retraining.

According to another embodiment of the present disclosure, a method for anomaly detection of data using a network function performed in one or more processors is disclosed. The method includes a network pre-trained using a plurality of training data subsets included in a training data set. generating an anomaly sensing model comprising a plurality of anomaly sensing submodels comprising a function; determining one or more anomaly sensing submodels for calculating input data from among the generated plurality of anomaly sensing submodels; and determining whether an anomaly exists in the input data using the determined one or more anomaly detection submodels.

A computing device is disclosed according to another embodiment of the present disclosure. The computing device may include one or more processors; and a memory storing instructions executable by the processor, the processor configured to generate a plurality of anomalous sensing submodels including network functions pre-trained using a plurality of training data subsets included in the training data set. generate an anomaly sensing model comprising; determining one or more anomaly detection submodels for calculating input data from among the generated plurality of anomaly detection submodels; In addition, it may be determined whether an anomaly exists in the input data using the determined one or more anomaly detection submodels.

The present disclosure may provide a data processing method utilizing artificial intelligence.

Various aspects are now described with reference to the drawings, in which like reference numbers are used to refer to like elements collectively. In the following examples, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of one or more aspects. It will be evident, however, that such aspect(s) may be practiced without these specific details.
1 is a block diagram of a computing device for detecting anomaly of data according to an embodiment of the present disclosure.
2 is a schematic diagram illustrating a network function according to an embodiment of the present disclosure;
3 is a schematic diagram illustrating a process of generating an anomalous sensing model according to an embodiment of the present disclosure.
4 is a schematic diagram illustrating an anomaly detection process of data using an anomaly detection model according to an embodiment of the present disclosure.
5 shows an exemplary flowchart of a method for anomaly sensing of data according to an embodiment of the present disclosure.
6 illustrates logic for implementing a method for anomaly sensing of data according to an embodiment of the present disclosure.
7 depicts a simplified, general schematic diagram of an exemplary computing environment in which embodiments of the present disclosure may be implemented.

Various embodiments are now described with reference to the drawings. In this specification, various descriptions are presented to provide an understanding of the present disclosure. However, it is apparent that these embodiments may be practiced without these specific descriptions.

The terms “component,” “module,” “system,” and the like, as used herein, refer to a computer-related entity, hardware, firmware, software, a combination of software and hardware, or execution of software. For example, a component can be, but is not limited to being, a process running on a processor, a processor, an object, a thread of execution, a program, and/or a computer. For example, both an application running on a computing device and the computing device may be a component. One or more components may reside within a processor and/or thread of execution. A component may be localized within one computer. A component may be distributed between two or more computers. In addition, these components can execute from various computer readable media having various data structures stored therein. Components may communicate via a network such as the Internet with another system, for example via a signal having one or more data packets (eg, data and/or signals from one component interacting with another component in a local system, distributed system, etc.) may communicate via local and/or remote processes depending on the data being transmitted).

In addition, the term “or” is intended to mean an inclusive “or” rather than an exclusive “or.” That is, unless otherwise specified or clear from context, "X employs A or B" is intended to mean one of the natural implicit substitutions. That is, X employs A; X employs B; or when X employs both A and B, "X employs A or B" may apply to either of these cases. It should also be understood that the term “and/or” as used herein refers to and includes all possible combinations of one or more of the listed related items.

Also, the terms "comprises" and/or "comprising" should be understood to mean that the feature and/or element in question is present. However, it should be understood that the terms "comprises" and/or "comprising" do not exclude the presence or addition of one or more other features, elements and/or groups thereof. Also, unless otherwise specified or unless the context is clear as to designating a singular form, the singular in the specification and claims should generally be construed to mean "one or more."

Those skilled in the art will further appreciate that the various illustrative logical blocks, configurations, modules, circuits, means, logics, and algorithm steps described in connection with the embodiments disclosed herein may be implemented in electronic hardware, computer software, or combinations of both. It should be recognized that they can be implemented with To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, configurations, means, logics, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application. However, such implementation decisions should not be interpreted as causing a departure from the scope of the present disclosure.

In the present disclosure, a network function and an artificial neural network and a neural network may be used interchangeably.

1 is a diagram illustrating a block diagram of a computing device performing a method of determining anomaly of data according to an embodiment of the present disclosure. The configuration of the computing device 100 shown in FIG. 1 is only a simplified example. In an embodiment of the present disclosure, the computing device 100 may include other components for performing the computing environment of the computing device 100 , and only some of the disclosed components may configure the computing device 100 .

The computing device 100 may include a processor 110 , a memory 130 , and a network unit 150 .

The processor 110 may include one or more cores, and a central processing unit (CPU) of a computing device, a general purpose graphics processing unit (GPGPU), and a tensor processing unit (TPU). unit) and the like, and may include a processor for data analysis and deep learning. The processor 110 may read a computer program stored in the memory 130 to perform the anomaly sensing method according to an embodiment of the present disclosure. According to an embodiment of the present disclosure, the processor 110 may perform an operation for learning the neural network. The processor 110 is a neural network such as processing input data for learning in deep learning (DN), extracting features from input data, calculating an error, updating the weight of the neural network using backpropagation calculations can be performed for the learning of At least one of a CPU, a GPGPU, and a TPU of the processor 110 may process learning of a network function. For example, the CPU and the GPGPU can process learning of a network function and data classification using the network function together. In addition, in an embodiment of the present disclosure, learning of a network function and data classification using the network function may be processed by using the processors of a plurality of computing devices together. In addition, the computer program executed in the computing device according to an embodiment of the present disclosure may be a CPU, GPGPU or TPU executable program.

In an embodiment of the present disclosure, the computing device 100 may distribute and process a network function using at least one of a CPU, a GPGPU, and a TPU. Also, in an embodiment of the present disclosure, the computing device 100 may distribute and process a network function together with other computing devices. Descriptions of specific details regarding network function distributed processing of the computing device 100 are in US patent applications US15/161080 (filed on May 20, 2016) and US15/217475 (filed on July 22, 2016), which are incorporated herein by reference in their entireties. specifically discussed.

In an embodiment of the present disclosure, data processed using a network function may include all types of data obtained in an industrial field. For example, it may include operation parameters of a device for production of a product in a production process of a product, sensor data obtained by operation of the device, and the like. For example, a temperature setting of equipment in a specific process, a wavelength of a laser in the case of a process using a laser, etc. may be included in the type of data processed in the present disclosure. For example, the data to be processed may include lot equipment history data from a management execution system (MES), data from an equipment interface data source, processing tool recipes, processing tool test data, probe test data, electrical It may include test data, combined measurement data, diagnostic data, remote diagnostic data, post-processing data, and the like, but the present disclosure is not limited thereto. As a more specific example, work-in-progress information including 120,000 items per lot obtained from a semiconductor fab, raw processing tool data, equipment interface information, process metrology information information) (e.g., including 1000 items per lot), defect information accessible to yield-related engineers, operational test information, sort information (including datalog and bitmap), etc. The present disclosure is not limited thereto. Description of the types of data described above is merely an example, and the present disclosure is not limited thereto. In an embodiment of the present disclosure, the computing device 100 may pre-process the collected data. The computing device 100 may compensate for a missing value among the collected data. The computing device 100 may compensate, for example, a missing value with a median value or an average value, or delete a column in which a plurality of missing values exist. Also, for example, the computing device 100 may utilize the subject matter expertise of an administrator for data preprocessing by the matrix completion computing device 100 . For example, the computing device 100 may remove values (eg, values estimated due to a malfunction of a sensor, etc.) that are completely out of bounds and limits from the collected data. In addition, the computing device 100 may adjust the value of the data so that the data has a similar scale while maintaining characteristics. The computing device 100 may apply column-wise standardization of data, for example. Computing device 100 may simplify processing by removing heat irrelevant to anomaly sensing from data. In an embodiment of the present disclosure, the computing device 100 may perform an appropriate input data preprocessing method for learning a network function for generating an anomaly detection model and for facilitating anomaly detection. Descriptions of specific examples regarding types, examples, preprocessing, transformations, etc. of input data are specifically discussed in US patent application US10/194920 (filed on July 12, 2002), which is incorporated herein by reference in its entirety.

In addition, data processed in an embodiment of the present disclosure may include image data, data stored in a storage medium of the computing device 100 , an image captured by a camera (not shown) of the computing device 100 , and It may be an image transmitted from another computing device, such as an image database, by the network unit 150 . Also, in an embodiment of the present disclosure, an image processed using a network function may be an image stored in a computer-readable storage medium (eg, a flash memory, but the present disclosure is not limited thereto). The computing device 100 may receive an image file stored in a computer-readable storage medium through an input/output interface (not shown).

The processor 110 may generate an anomalous sensing model including a network function. The processor 110 may generate an anomaly detection model for detecting anomaly of data by learning a network function using the training data set. The training data set may include a plurality of training data subsets. The plurality of training data subsets may include different training data grouped by a predetermined criterion. In an embodiment of the present disclosure, the predetermined criterion for grouping the plurality of training data subsets may include at least one of a generation time interval of the training data and a domain of the training data. The domain of the training data may include information serving as a criterion for distinguishing a group of training data from other groups. For example, the learning data of the present disclosure may be sensor data acquired in a semiconductor production process, operation parameters of production equipment, and the like. In this case, when the setting of production equipment (for example, change of the wavelength of laser irradiated in a specific process, etc.) is changed in the semiconductor production process (that is, when there is a change in the recipe), the sensor acquired after the setting change The data may be included in a different subset of learning data from the sensor data obtained before the setting change. In a general production process, the types of normal data may be plural due to a change in a manufacturing method over time or the like. In an embodiment of the present disclosure, each of the training data subsets may include training data grouped according to a change in a manufacturing method, or the like.

In an embodiment of the present disclosure, in the case of a semiconductor production process, different normal data may be obtained for each recipe. That is, although data obtained in a production process produced by different recipes are different from each other, all data may be normal data. In an embodiment of the present disclosure, the plurality of training data subsets may include different types of training data. The plurality of training data subsets may be grouped by predetermined criteria (eg, creation time interval, domain, recipe in process, etc.). In addition, a plurality of training data subsets may be grouped using the generated anomaly sensing submodel. For example, if the input data includes a new pattern as a result of processing the input data by the pre-trained anomaly sensing submodel, the input data including the new pattern may constitute a different subset of training data. A plurality of training data subsets may be grouped by an anomaly sensing submodel. In an embodiment of the present disclosure, each training data subset may be grouped by an anomaly sensing submodel. For example, there was a change in the recipe in the process, but input data generated after the recipe change (that is, sensor data acquired in the process generated after the recipe change) is determined as a new pattern by the existing anomaly detection submodel If not (that is, if it does not have novelty above a threshold), input data generated before and after the recipe change may be grouped into one training data subset. Also, for example, when input data generated after the recipe change in the process is determined as a new pattern by the anomaly detection submodel, the input data generated before the recipe change and the input data generated after the recipe change are separate They may be grouped into training data subsets. That is, the input data having a new pattern may be data including an anomaly, but when a plurality of input data having a new pattern exist, it may be new normal data. When at least one input data having a new pattern exists, the input data having a new pattern may be data including an anomaly or new normal data. Accordingly, when the input data having a new pattern is new normal data, the processor 110 may classify it as a separate training data subset. The description of the above-described learning data is only an example, and the present disclosure is not limited thereto.

The processor 110 may generate an anomalous sensing model including a plurality of anomaly sensing submodels including a pre-trained network function by using a plurality of training data subsets included in the training data set. In an embodiment of the present disclosure, the learning data subset may be composed of normal data, and the learning in an embodiment of the present disclosure may be semi-supervised learning. In an embodiment of the present disclosure, the anomalous sensing model may include a plurality of anomaly sensing submodels, and each of the plurality of anomaly sensing submodels may be a submodel trained using a subset of training data. Each anomaly sensing submodel may include one or more network functions. The anomaly detection model according to an embodiment of the present disclosure includes an anomaly detection submodel trained using each subset of training data, so that the anomaly of various types of data can be detected.

The plurality of anomaly detection submodels comprises: a first anomaly detection submodel including a first network function pre-trained with a first training data subset consisting of training data generated during a first time interval; and a first time interval; and a second anomaly sensing submodel including a second network function pre-trained with a second training data subset consisting of training data generated during a different second time interval. For example, the training data subsets of the present disclosure may be grouped according to a generation time interval of the training data. For example, when a recipe is changed every 6 months in a semiconductor process, training data generated for 6 months may constitute one training data subset. The foregoing description of the semiconductor process is merely an example, and the present disclosure is not limited thereto. The processor 110 may generate an anomalous sensing submodel by learning a network function of each anomaly sensing submodel using each training data subset. The processor 110 generates the first anomaly detection submodel including the first network function trained with the first training data subset, and then, if there is a change in the recipe, the second training data subset trained with the second training data subset. A second anomaly sensing submodel including 2 network functions may be generated. The first training data subset and the second data subset may include data obtained in a production process produced by different recipes. Here, the initial weight of the second network function may share at least a part of the weight of the pre-trained first network function. Here, the first time interval may be a time interval preceding the second time interval. Accordingly, the first anomaly detection submodel may be a model generated before the second anomaly detection submodel. After generating the first anomaly detection submodel, when the processor 110 intends to generate the second anomaly detection submodel based on the recipe change, a part of the first anomaly detection submodel is detected as the second anomaly By utilizing a part of the submodel, a part of the knowledge acquired in the first anomaly detection submodel may be reused to update the model.

In an embodiment of the present disclosure, when generating the next sub-model, by reusing a part of the previous model, the knowledge learned in the previous model is not forgotten and continues to the next model, so that the performance of the next model can be increased and the overall It can reduce the learning time. The processor 110 may generate each anomaly sensing submodel by using each subset of training data, and then store the anomalous sensing submodels to generate the anomalous sensing model.

A predetermined number of layers among the layers of the second network function may use a weight of a corresponding layer of the pre-trained first network function as an initial weight.

Among the layers of the dimensionality reduction network of the second network function, a predetermined number of layers from a layer adjacent to the input layer may use a weight of a corresponding layer of the pre-trained first network function as an initial weight. A predetermined number of layers from the input layer of the second network function may be learned using the weight of the latest network function as an initial weight. The processor 110 may learn the second network function by using initial weights of some layers close to the input layer of the newly learned second network function as the weights of the already learned first network function. Through such weight sharing, it is possible to reduce the amount of computation required for learning the second network function. That is, in feature extraction (dimension reduction) of input data, by making the initial weight of a predetermined number of layers close to the input layer of the second network function as the weight of the pre-trained network function rather than random, the value of the pre-trained network function is Knowledge can be utilized, and since learning can be completed only when the second network function learns only about restoration (dimensional restoration) of input data by features, it is possible to reduce the amount of time and computation required for overall learning.

Among the layers of the dimensionality reduction network of the second network function, a predetermined number of layers from a layer adjacent to an output layer may use a weight of a corresponding layer of the pre-trained first network function as an initial weight. A predetermined number of layers from the output layer of the second network function may be learned using the weight of the latest network function as an initial weight. The processor 110 may learn the second network function by using initial weights of some layers close to the output layer of the newly learned second network function as the weights of the already learned first network function. Through such weight sharing, it is possible to reduce the amount of computation required for learning the second network function. That is, by making the initial weight of a predetermined number of layers close to the output layer of the second network function as the weight of the pre-trained network function rather than random, the knowledge of the pre-trained network function can be utilized in dimensional restoration of input data. In the second network function, learning can be completed only by learning about the dimensionality reduction of the input data by the feature, so that the time and amount of computation required for overall learning can be reduced.

A predetermined number of layers of the second network function may be initialized with weights of corresponding layers of the pre-trained first network function for each training epoch.

A predetermined number of layers from the output layer among the dimension reconstruction layers of the second network function may be initialized with weights of the corresponding layers of the pre-trained first network function for each learning epoch. The processor 110 may initialize the weights of a predetermined number of layers close to the output layer during learning of the second network function to the weights of the corresponding layers of the pre-trained network function for every learning epoch. In this case, in one learning epoch, the weight of the dimension reconstruction layer of the second network function may be changed, thereby affecting learning of the dimension reduction layer. Through this operation, the processor 110 fixes the weight of the dimension restoration network of the second network function, and reduces the time and amount of computation for learning the second network function by learning only the dimension reduction network (feature extraction network), You can use your knowledge from previous lessons.

A predetermined number of layers from the input layer among the dimensionality reduction layers of the second network function may be initialized with weights of the corresponding layers of the pre-trained first network function for each learning epoch. The processor 110 may initialize the weights of a predetermined number of layers close to the input layer during learning of the second network function to the weights of the corresponding layers of the pre-trained network function for every learning epoch. In this case, in one learning epoch, the weight of the dimensionality reduction layer of the second network function may be changed, thereby affecting learning of the dimension restoration layer. Through this operation, the processor 110 fixes the weight of the dimension reduction network of the second network function, and reduces the time and amount of computation for learning the second network function by learning only the dimension restoration network, and knowledge from previous learning. can utilize

The predetermined number of layers of the second network function may be fixed as weights of the corresponding layers of the pre-trained first network function.

A predetermined number of layers from the output layer among the dimension reconstruction layers of the second network function may be fixed as weights of the corresponding layers of the pre-trained first network function. A predetermined number of layers from the input layer among the dimension reduction layers of the second network function may be fixed as weights of the corresponding layers of the pre-trained first network function. By fixing the weights, the processor 110 learns only some layers of the second network function, thereby reducing the time and amount of computation for learning the second network function and utilizing knowledge from previous learning.

The second anomaly detection submodel is a training data subset different from the training data subset on which the first anomaly detection submodel is trained (that is, learning generated in a process of a recipe different from the training data on which the first network function is trained). data) can be learned. In addition, the second anomaly detection submodel includes a training data subset from which the first anomaly detection submodel is trained and a training data subset corresponding to the second anomaly detection submodel (that is, the first anomaly detection submodel It may be learned by both the learned learning data and the learning data generated in the process of a different recipe). Since the second anomaly detection submodel is trained with training data including the training data submodel from which the previous anomaly detection submodel was trained, the second anomaly detection submodel is the knowledge learned from the first anomaly detection submodel. can be inherited. In this case, in the training data for training the second anomaly detection submodel, the sampling rate of the second training data subset and the first training data subset (that is, the training data subset from which the previous submodel was trained) is different can do. The first training data subset consisting of training data generated during the first time interval for generating the first anomaly detection submodel is the second training data subset such that only a part of the training data included in the first training data subset is used for training. It may be sampled at a lower sampling rate than the sampling rate of the second subset of training data for generating the mali sensing submodel. The first training data subset may be used for training the second anomaly detection submodel, but in this case, it may be sampled at a lower sampling rate than the second training data subset. That is, the training data subset used for training the previous anomaly detection submodel may be used for training the next anomaly detection submodel, but in this case, it is different from the training data subset for training the next anomaly detection submodel. It can be sampled at a rate and used for training. Since not only the current training data subset but also the past training data subset can be used for training the anomalous sensing submodel, the anomalous sensing submodel is based on historical data (e.g., before a change in process or recipe). It is possible to secure processing performance for the model, free from the problem of forgetting to update the model. Since the importance of the first training data subset in the training of the second anomaly detection submodel may be different than that of the second training data subset, the second anomaly detection submodel is the latest training data, the second training data. The subset may be trained with a higher weight than the first training data subset. For example, if each training data subset contains 100,000 pieces of data, then the second anomaly sensing sub-model would include all of the data in the second training data subset (i.e., 100,000 training data) and the first training data subset. It can be learned from some of the data in the data subset (eg, 10,000 pieces of training data). The difference between the number of learning data and the sampling rate described above is merely an example, and the present disclosure is not limited thereto. As described above, in order to generate the anomaly detection submodel, a subset of the training data used in the generation of the past anomaly detection submodel is used, but the sampling rate of the current training data and the past training data is different. By doing so, the anomalous sensing submodel is trained with a greater weight on the current learning data, and different data from the anomaly sensing submodel trained with past data (e.g., data after a change in process, recipe, domain is It is possible to increase the processing performance for different data, etc.) while minimizing the forgetting of knowledge learned from the past anomaly detection sub-model.

In the present disclosure, the pre-trained network function may be learned using only normal data (ie, normal data) not including an anomaly as training data. In the present disclosure, the pre-trained network function can be trained to reduce and restore the dimensions of the training data. The network function of the present disclosure may include an auto-encoder capable of dimensionality reduction and dimensionality restoration of input data. Further, the network function of the present disclosure may include any network function operable to produce input data as output. For example, the network function of the present disclosure includes an auto-encoder capable of reconstructing input data, a generative adversarial network (GAN) that generates an output similar to input data, a U-network, a convolutional network, and a deconvolutional network. It may include a network function composed of a combination of networks, and the like. That is, the network function of the present disclosure is learned to output output data close to the input data, and is learned only with normal data, so when the input data is normal data that does not include an anomaly, the output data may be similar to the input data. . When anomalous data is input to the network function of the present disclosure, since the network function of the present disclosure does not learn to restore the anomaly pattern, the output data is greater than the output when normal data is received as an input. It's likely not similar. That is, the pre-trained network function of the present disclosure can detect novelty with respect to an unlearned anomaly pattern in the input data, and this novelty will appear as a reconstruction error of the output data with respect to the input data. can When the reconstruction error exceeds a predetermined threshold, the processor 110 may detect that the input data includes an anomaly by determining that the input data includes an unlearned pattern (ie, a normal pattern).

The processor 110 may calculate the input data by using at least one of a plurality of generated anomaly sensing submodels. The processor 110 may calculate the input data by using the most recent anomaly detection submodel among the plurality of generated anomaly detection submodels. The processor 110 may calculate input data using the most recent anomaly detection submodel among the plurality of anomaly detection submodels, and gradually detect anomaly detection generated in the past from the most recent anomaly detection submodel. It is also possible to compute input data using submodels. The input data may include image data of a product obtained in the production process, operation parameters for operating devices in the production process, and sensor data obtained in the production process, but the present disclosure is not limited thereto. In the input data of this publication, in the production process, the production equipment and the processor 110 may perform an operation of transforming and restoring the input data into data different from the input data by using the anomaly detection submodel. The processor 110 may calculate to generate an output similar to the input data by reducing the dimension of the input data by using the anomaly sensing submodel and restoring the dimension. The processor 110 may extract a feature from the input data by using the anomaly detection submodel, and reconstruct the input data based thereon. As described above, since the network function included in the anomalous detection submodel of the present disclosure may include a network function capable of restoring input data, the processor 110 calculates the input data using the anomaly detection submodel to restore the input data. In another embodiment of the present disclosure, the anomalous sensing submodel may include a plurality of network functions. In this case, the processor 110 may perform an operation by inputting input data into the plurality of network functions.

The processor 110 may determine whether an anomaly exists in the input data based on output data and input data of at least one input data among the plurality of anomaly detection submodels. As described above, in an embodiment of the present disclosure, the anomaly sensing submodel may be trained to learn a pattern of normal data using normal data as training data, and to output output data similar to input data. Accordingly, in an embodiment of the present disclosure, the processor 110 may calculate a reconstruction error of the output data by comparing the output data of the anomaly sensing submodel with the input data. The processor 110 may detect that a new pattern not learned by the pre-trained anomaly detection sub-model is included in the input data based on the reconstruction error. When the degree of novelty (ie, the magnitude of the reconstruction error) is equal to or greater than a predetermined threshold, the processor 110 may determine that the input data includes a new unlearned pattern. Since the anomaly detection submodel was trained using normal data as training data, a new untrained pattern may be anomaly. When a new unlearned pattern is included in the input data, the processor 110 may determine that the input data is anomaly data including anomaly. In another embodiment of the present disclosure, the anomalous sensing submodel may include a plurality of network functions, and the processor 110 calculates a reconstruction error of the output data by comparing the input data with the output data of the plurality of network functions. By doing so, it can be determined whether a new pattern exists in the input data. In this case, the processor 110 may ensemble a plurality of network functions included in each anomaly detection submodel to determine whether there is a new pattern in the input data. For example, the processor 110 may derive a plurality of reconstruction errors by comparing the output and input data of a plurality of network functions included in each anomaly detection submodel and calculating a reconstruction error, and may derive a plurality of reconstruction errors. It is also possible to determine whether a new pattern exists in the input data by combining the errors.

When the processor 110 determines that a new pattern is included in the input data using the anomalous detection submodel, the new pattern is included in the input data using the anomaly detection submodel generated before the anomalous detection submodel. It can be determined whether or not The processor 110 may determine whether a new pattern exists in the input data using the second anomaly detection submodel. The processor 110 uses the second anomaly detection submodel to generate a new pattern (eg, anomaly detection submodel) that has not been learned in the input data based on the reconstruction error between the output data and the input data. or another normal pattern). When the processor 110 determines that a new pattern exists in the input data using the second anomaly detection submodel, the processor 110 additionally determines whether an anomaly is added to the input data using the first anomaly detection submodel. It can be determined whether it exists or not. That is, when it is determined that a new pattern exists in the input data using the latest anomaly detection submodel, the processor 110 determines whether a new pattern exists in the input data using the previous anomaly detection submodel. can judge For example, when there is a change in a recipe in the semiconductor process, it may be determined that a new pattern exists in the input data in judgment using the anomaly detection submodel learned with the latest learning data, but the input data is In judgment using the anomalous detection sub-model of The input data may be determined to be anomaly in the latest anomaly detection submodel. For example, if there is a change in the recipe in the process, if the input data is sensor data acquired in a process produced by the previous recipe, The corresponding input data may be normal in the previous recipe. In this case, the processor 110 may determine the corresponding input data as normal data. The processor 110 may determine that the anomaly exists in the input data when it is determined that the anomaly exists in the input data in all of the plurality of anomaly detection submodels included in the anomaly detection model. Accordingly, in an embodiment of the present disclosure, the processor 110 detects anomalies of input data using a plurality of anomaly detection sub-models learned using a plurality of training data subsets, thereby providing input corresponding to various recipes. It is possible to determine whether there is an anomaly in the data. For example, in the case of a manufacturing process in which there is a change in the process every 6 months, the plurality of anomaly sensing sub-models according to an embodiment of the present disclosure may be sub-models trained with learning data respectively corresponding to the change in the manufacturing process. In this case, the anomalous sensing model may determine whether an anomaly exists in the input data by using the anomalous sensing submodel corresponding to each manufacturing process. Even when it is determined that the anomaly exists by the anomaly detection submodel generated with the latest training data in the input data, when it is determined that the anomaly does not exist in the past anomaly detection submodel, the input data may be determined as normal sensor data generated by a previous process rather than the latest process. The processor 110 may determine that the anomaly exists in the input data when all of the plurality of anomaly detection submodels included in the anomaly detection model determine that the anomaly exists in the input data. In one embodiment of the present disclosure, it is possible to determine whether the produced product is a normal product of the current process or a previous process through this anomaly determination method. Accordingly, the anomalous judgment performance may be maintained in response to a change in the process.

An anomaly determination method according to an embodiment of the present disclosure determines whether an anomaly exists in data using an anomaly detection model including an anomaly detection submodel each learned using a plurality of training data subsets By doing so, it is possible to minimize the forgetting of information learned from the previous model, and it is possible to determine whether there is an anomaly in the input data generated in response to various processes in response to a change in the process in the industrial field. By learning the sub-model through the training data grouped by a predetermined criterion and storing the learned sub-model to construct the model, the model is trained through all the accumulated learning data in order not to forget the previously learned knowledge. It is possible to reduce the consumption of computing resources (eg, storage space problem, computational amount problem, learning difficulty problem such as overfitting, etc.).

According to an embodiment of the present disclosure, the processor 110 is an anomaly detection including a plurality of anomaly detection submodels including a network function pre-trained using a plurality of training data subsets included in the training data set. You can create a model. More specifically, the training data set may include a plurality of training data subsets. The plurality of training data subsets may include different training data grouped by a predetermined criterion. The predetermined criterion for grouping the plurality of training data subsets may include at least one of a generation time interval of the training data and a domain of the training data. For example, the learning data set may be composed of a plurality of learning data related to sensor data obtained in a semiconductor production process, operating parameters of production equipment, and the like. In this case, when the setting of production equipment (for example, change of the wavelength of laser irradiated in a specific process, etc.) is changed in the semiconductor production process (that is, when there is a change in the recipe), the sensor acquired after the setting change The data may be included in a different subset of learning data from sensor data obtained before the setting change. The specific description of the predetermined criteria for grouping the above-described training data subsets is merely an example, and the present disclosure is not limited thereto.

That is, the processor 110 may form a plurality of training data subsets by grouping a plurality of training data included in the training data set by a predetermined criterion, and one or more network functions using the plurality of training data subsets. By learning each included anomaly detection submodel, it is possible to generate an anomaly detection model including a plurality of anomaly detection submodels. Learning according to an embodiment of the present disclosure may be semi-supervised learning.

For example, in the semiconductor process, as the recipe is changed every 6 months, the processor 110 groups the training data generated during the first time interval into a first training data subset, and obtains the training data obtained during the second time interval. Training data corresponding to the sensor data may be grouped into a second training data subset. The processor 110 trains a first anomaly sensing submodel comprising a first network function through a first training data subset grouped into training data generated during a first time interval, and generates during a second time interval. An anomaly including a first anomaly detection submodel and a second anomaly detection submodel by training a second anomaly detection submodel including a second network function through a second training data subset grouped with the trained training data A mali detection model can be created In this case, since the anomalous detection model includes the first anomaly detection submodel and the second anomaly detection submodel, it is possible to detect whether the data corresponding to the first time interval and the second time interval are anomaly. have. The detailed description of the above-described time interval and grouping of the training data subsets is only an example, and the present disclosure is not limited thereto.

Accordingly, the anomaly detection model generated by the processor 110 includes the anomaly detection submodel trained using each training data subset, so that the anomaly of various types of data can be detected.

According to an embodiment of the present disclosure, the processor 110 may determine one or more anomaly detection submodels for calculating input data from among a plurality of generated anomaly detection submodels. Specifically, the processor 110 may include one or more for calculating input data based on at least one of a processing tendency of other input data for a plurality of anomaly sensing submodels, context information of the input data, or cluster information of the input data An anomaly sensing submodel can be determined.

The processing tendency of the other input data for the plurality of anomaly detection submodels may include information regarding which other input data associated with the input data is determined to be normal by which anomaly detection submodel. The processor 110 may determine the anomalous detection submodel for calculating the input data and other input data having a predetermined relationship as the anomally sensing submodel for calculating the input data. Other input data includes input data generated prior to generation of the input data, and may include data generated within a predetermined time interval with the input data. The processor 110 may determine an anomaly sensing submodel that determines that other input data having a predetermined relationship with the input data as normal data as the anomalous sensing submodel for calculating the input data.

For example, the input data may be data generated at regular time intervals. When the input data within a predetermined number before the input data is determined to be normal data by a specific anomaly detection submodel, the probability that the input data is similar to the previous data is high. Therefore, since there is a high probability that the previous data is determined as normal data by the processed anomalous detection submodel, the processor 110 may select the anomaly detection submodel that determines the previous data as normal to determine the input data. . The detailed description of the above-described input data is only an example, and the present disclosure is not limited thereto.

That is, the processor 110 may determine an optimal anomaly detection submodel for processing input data from among a plurality of anomaly detection submodels based on the processing tendency of other input data.

Also, the processor 110 may determine, based on the context information of the input data, an anomaly detection submodel matching the context information as one or more anomaly detection submodels for calculating the input data. The context information includes information associating the input data with a normal pattern, the context indicator associating the input data with at least one of a manufacturing recipe or manufacturing equipment, a manufacturing recipe characteristic of the input data, or a manufacturing equipment characteristic of the input data. It may include at least one of a context characteristic indicator and a missing characteristic indicator including information on a missing characteristic of the input data.

The context information may be matched to at least one of input data or training data, and the anomalous sensing submodel may be matched to context information matched to a subset of the training data. Description of context information is specifically discussed in Korean Patent Application 10-2019-0050477 (filed on April 30, 2019), which is incorporated herein by reference in its entirety.

For example, when the first context information of the first input data includes a first context characteristic indicator indicating a normal operating parameter range in a specific manufacturing equipment, the processor 110 is configured to add the first context information of the first input data to the first context information of the first input data. Based on the included first context characteristic indicator, the first anomaly detection submodel to which the first context information matches may be identified. Also, the processor 110 may determine the identified first anomaly detection submodel as the anomaly detection submodel for processing the first input data. A detailed description of the information included in the above-described context information is only an example, and the present disclosure is not limited thereto.

That is, the processor 110 may determine an optimal anomaly detection submodel for processing input data from among a plurality of anomaly detection submodels based on context information of the input data.

Also, the processor 110 may determine one or more anomaly sensing submodels for calculating the input data based on cluster information of the input data. Specifically, the processor 110 may determine the anomalous sensing submodel for calculating the input data included in the cluster to which the input data belongs as the anomalous sensing submodel for calculating the input data.

In more detail, the processor 110 may cluster one or more input data based on similarity. For example, when the first input data includes information about the angle sensor data of the first joint of the robot arm, and the second input data includes information about the angle sensor data of the first joint of the robot arm, the processor A reference numeral 110 determines that the similarity between the respective input data is high, so that the first input data and the second input data may be included in the same cluster. As another example, when the third input data includes information about the angle sensor data of the joint of the robot arm, and the fourth input data includes information about the temperature sensor data, the processor 110 may The third input data and the fourth input data may be respectively included in different clusters by determining that the similarity between them is low. The detailed description of information included in each of the above-described input data and clustering of each input data is merely an example, and the present disclosure is not limited thereto.

That is, each of one or more input data of an embodiment of the present disclosure may be clustered by the processor 110 .

The processor 110 may determine an anomaly detection submodel for processing the input data based on cluster information of the input data. As a specific example, the first input data and the second input data are pre-classified into the first cluster by the processor 110, and the processing of the first input data at a previous time point is performed through the first anomaly detection submodel. If this is performed, the processor 110 may determine the first anomaly detection submodel in which the operation of the first input data, which is another input data, in the same cluster is performed, as the anomaly detection submodel for operation of the second input data. The detailed description of each of the above-described input data and clusters is merely an example, and the present disclosure is not limited thereto.

That is, the processor 110 may determine an optimal anomaly detection submodel for processing input data from among a plurality of anomaly detection submodels based on cluster information of the input data.

As described above, the processor 110 may determine one or more anomaly sensing submodels for calculating the input data based on at least one of a processing tendency of the input data, context information of the input data, or cluster information of the input data. have.

In other words, the processor 110 may minimize unnecessary inference by predicting an anomaly sensing submodel suitable for processing each of various input data. Accordingly, the processing performance of the anomaly detection submodel may be improved.

According to an embodiment of the present disclosure, the processor 110 may integrate one or more anomaly sensing sub-models to generate an integrated anomaly sensing sub-model. Specifically, the processor 110 may generate an integrated anomaly detection submodel by clustering a plurality of anomaly detection submodels and integrating one or more anomaly detection submodels included in one cluster as a result of clustering.

In more detail, the processor 110 is configured to include one included in the plurality of anomalous sensing submodels based on at least one of context information matched to each of the anomalous sensing submodels, or input data processing characteristics of each of the anomalous sensing submodels. The above anomaly sensing submodels can be clustered.

The processor 110 may identify context information matched to each of the anomalous sensing submodels, and cluster the anomally sensing submodels based on the comparison of the identified context information. For example, when the first context information is matched to the first anomaly detection submodel and the first context information is matched to the second anomaly detection submodel, the processor 110 is configured to match each anomaly detection submodel with the same By identifying that the first context information is matched, the first anomaly detection submodel and the second anomaly detection submodel may be included in the same cluster. As another example, when the first context information is matched to the second anomaly detection submodel and the second context information is matched to the third anomaly detection submodel, the processor 110 is configured for each anomaly detection submodel. The second anomaly sensing submodel and the third anomaly sensing submodel may be included in different clusters by identifying that different context information is matched. Specific description of context information matched to each of the anomalous sub-models described above is merely an example, and the present disclosure is not limited thereto.

Also, the processor 110 may cluster the anomalous sensing submodels based on input data processing characteristics of each of the anomalous sensing submodels. Specifically, the processor 110 may cluster the anomalous sensing submodels having similar processing tendencies for input data in the same cluster.

In addition, the processor 110 may cluster the anomaly detection submodels based on a result of determination on input data of each of the anomalous detection submodels. Specifically, the processor 110 sets the anomalous detection submodel in which the input data is determined as normal data and the other anomaly detection submodel in which the input data is determined as normal data, and when the input data and other input data are related, one cluster can be clustered.

In more detail, the processor 110 may classify one or more anomaly detection submodels that determine input data as normal data into one cluster. The processor 110 may determine in which anomaly detection submodel the input data is determined to be normal for the anomalous detection of the input data. For example, the processor 110 may process input data as each anomaly detection submodel, and identify a plurality of anomaly detection submodels that determine the input data as normal data. Such a plurality of anomaly sensing submodels may be clustered into the same cluster. Also, with respect to the plurality of input data, the processor 110 may identify a plurality of anomaly sensing submodels that determine each input data as normal data. The processor 110 may generate a plurality of anomaly detection submodels having similar judgment results on input data as an integrated anomaly detection submodel.

In addition, the processor 110 may generate an integrated anomaly detection submodel by integrating one or more anomalous detection submodels included in one cluster. Specifically, the processor 110 may generate an integrated anomaly detection submodel by ensembles one or more anomaly detection submodels included in one cluster. The ensemble between the models may be, for example, setting the learning weight of the integrated anomaly detection submodel based on an average value of the weights of each network function constituting each of the one or more anomaly detection submodels. The foregoing description is merely an example, and the present disclosure is not limited thereto.

The processor 110 may generate an integrated anomalous detection submodel by integrating the connection weights of one or more anomaly detection submodels included in one cluster. For example, the processor 110 may generate an integrated anomaly detection submodel by integrating the weights of the plurality of anomaly detection submodels so as to maintain knowledge of other neural networks without forgetting them.

In addition, the processor 110 may generate an integrated anomaly detection submodel by removing at least a portion of one or more anomaly detection submodels included in one cluster. Specifically, the processor 110 determines a recent processing trend of input data processing based on the input data processing time of each of one or more anomaly sensing submodels included in one cluster (ie, a probability selected for processing of the latest input data). This relatively low anomaly sensing submodel can be removed to generate a unified anomaly sensing submodel. That is, the integrated anomaly detection submodel generated by removing at least a portion of one or more anomaly detection submodels included in one cluster may reflect a recent processing trend of input data.

In addition, the processor 110 may generate an integrated anomaly detection submodel based on a performance test for one or more anomalous detection submodels included in one cluster. Specifically, through the test data set, one An integrated anomaly detection submodel may be generated by performing a performance test of each of one or more anomaly detection submodels included in the cluster, and selecting only the anomalous detection submodels that exceed a predetermined output accuracy as a result of the performance test .

In addition, the processor 110 may generate an integrated anomaly detection submodel by re-learning one or more anomaly detection submodels included in one cluster. Specifically, the processor 110 generates an integrated network function through an ensemble of network functions of each of the one or more anomalous sensing sub-models included in one cluster, and recalculates the integrated network function through an additional training data set. By performing the learning, it is also possible to generate an integrated anomaly sensing submodel.

That is, the processor 110 generates an integrated anomaly detection submodel by integrating one or more anomalous detection submodels included in one cluster, thereby reducing the amount of computation of the model and increasing the performance of the model.

2 is a schematic diagram illustrating a network function 200 according to an embodiment of the present disclosure.

Throughout this specification, computational model, neural network, network function, and neural network may be used interchangeably. A neural network may be composed of a set of interconnected computational units, which may generally be referred to as “nodes”. These “nodes” may also be referred to as “neurons”. A neural network is configured by including at least one or more nodes. Nodes (or neurons) constituting the neural networks may be interconnected by one or more “links”.

In the neural network, one or more nodes connected through a link may relatively form a relationship between an input node and an output node. The concepts of an input node and an output node are relative, and any node in an output node relationship with respect to one node may be in an input node relationship in a relationship with another node, and vice versa. As described above, an input node-to-output node relationship may be created around a link. One or more output nodes may be connected to one input node through a link, and vice versa.

In the relationship between the input node and the output node connected through one link, the value of the output node may be determined based on data input to the input node. Here, a node interconnecting the input node and the output node may have a weight. The weights may be variable, and may be varied by the user or algorithm in order for the neural network to perform a desired function. For example, when one or more input nodes are interconnected to one output node by respective links, the output node sets values input to input nodes connected to the output node and links corresponding to the respective input nodes. An output node value may be determined based on the weight.

As described above, in a neural network, one or more nodes are interconnected through one or more links to form an input node and an output node relationship within the neural network. The characteristics of the neural network may be determined according to the number of nodes and links in the neural network, correlations between nodes and links, and a weight value assigned to each of the links. For example, when the same number of nodes and links exist and there are two neural networks having different weight values between the links, the two neural networks may be recognized as different from each other.

A neural network may include one or more nodes. Some of the nodes constituting the neural network may configure one layer based on distances from the initial input node. For example, a set of nodes with a distance of n from the initial input node is You can configure n layers. The distance from the initial input node may be defined by the minimum number of links that must be passed to reach the corresponding node from the initial input node. However, the definition of such a layer is arbitrary for description, and the order of the layer in the neural network may be defined in a different way from the above. For example, a layer of nodes may be defined by a distance from the final output node.

The initial input node may mean one or more nodes to which data is directly input without going through a link in a relationship with other nodes among nodes in the neural network. Alternatively, in a relationship between nodes based on a link in a neural network, it may mean nodes that do not have other input nodes connected by a link. Similarly, the final output node may refer to one or more nodes that do not have an output node in relation to other nodes among nodes in the neural network. Also, the hidden node may refer to nodes constituting the neural network other than the first input node and the last output node. The neural network according to an embodiment of the present disclosure may be a neural network in which the number of nodes in the input layer may be the same as the number of nodes in the output layer, and the number of nodes decreases and then increases again as the input layer progresses to the hidden layer. can In addition, the neural network according to another embodiment of the present disclosure may be a neural network in which the number of nodes in the input layer may be less than the number of nodes in the output layer, and the number of nodes decreases as the number of nodes progresses from the input layer to the hidden layer. have. In addition, the neural network according to another embodiment of the present disclosure may be a neural network in which the number of nodes in the input layer may be greater than the number of nodes in the output layer, and the number of nodes increases as the number of nodes progresses from the input layer to the hidden layer. can The neural network according to another embodiment of the present disclosure may be a neural network in a combined form of the aforementioned neural networks.

A deep neural network (DNN) may refer to a neural network including a plurality of hidden layers in addition to an input layer and an output layer. Deep neural networks can be used to identify the latent structures of data. In other words, it can identify the potential structure of photos, texts, videos, voices, and music (e.g., what objects are in the photos, what the text and emotions are, what the texts and emotions are, etc.) . Deep neural networks include convolutional neural networks (CNN), recurrent neural networks (RNNs), auto encoders, generative adversarial networks (GANs), and restricted boltzmann machines (RBMs). machine), a deep trust network (DBN), a Q network, a U network, a Siamese network, and the like. The description of the deep neural network described above is only an example and the present disclosure is not limited thereto.

In an embodiment of the present disclosure, the network function 200 may include an autoencoder. The auto-encoder may be a kind of artificial neural network for outputting output data similar to input data. The auto encoder may include at least one hidden layer, and an odd number of hidden layers may be disposed between the input/output layers. The number of nodes in each layer may be reduced from the number of nodes in the input layer to an intermediate layer called the bottleneck layer (encoding), and then expanded symmetrically with reduction from the bottleneck layer to the output layer (symmetrical to the input layer). In this case, although the dimensionality reduction layer and the dimension reconstruction layer are illustrated as being symmetrical in the example of FIG. 2 , the present disclosure is not limited thereto, and the nodes of the dimension reduction layer and the dimension reconstruction layer may or may not be symmetrical. The auto-encoder can perform non-linear dimensionality reduction. The number of input layers and output layers may correspond to the number of sensors remaining after pre-processing of input data. In the auto-encoder structure, the number of nodes of the hidden layer included in the encoder may have a structure that decreases as the distance from the input layer increases. If the number of nodes in the bottleneck layer (the layer with the fewest nodes located between the encoder and decoder) is too small, a sufficient amount of information may not be conveyed, so a certain number or more (e.g., more than half of the input layer, etc.) ) may be maintained.

The neural network may be trained by at least one of supervised learning, unsupervised learning, and semi-supervised learning. The training of the neural network is to minimize the output error. In the training of a neural network, iteratively input the training data into the neural network, calculate the output of the neural network and the target error for the training data, and calculate the error of the neural network from the output layer of the neural network to the input layer in the direction to reduce the error. It is a process of updating the weights of each node of the neural network by backpropagation in the direction. In the case of teacher learning, learning data in which the correct answer is labeled in each learning data is used (ie, labeled learning data), and in the case of comparative learning, the correct answer may not be labeled in each learning data. That is, for example, learning data in the case of teacher learning related to data classification may be data in which categories are labeled in each of the learning data. Labeled training data is input to the neural network, and an error can be calculated by comparing the output (category) of the neural network with the label of the training data. As another example, in the case of comparison learning about data classification, an error may be calculated by comparing the input training data with the neural network output. The calculated error is back propagated in the reverse direction (ie, from the output layer to the input layer) in the neural network, and the connection weight of each node of each layer of the neural network may be updated according to the back propagation. The change amount of the connection weight of each node to be updated may be determined according to a learning rate. The computation of the neural network on the input data and the backpropagation of errors can constitute a learning cycle (epoch). The learning rate may be applied differently according to the number of repetitions of the learning cycle of the neural network. For example, a high learning rate can be used at the early stage of training of a neural network to increase efficiency by allowing the neural network to quickly acquire a certain level of performance, and a low learning rate can be used to increase accuracy at a later stage of learning.

In the training of neural networks, in general, the training data may be a subset of the actual data (that is, the data to be processed using the trained neural network), so the error on the training data is reduced but the error on the real data There may be increasing learning cycles. Overfitting is a phenomenon in which errors on actual data increase by over-learning on training data as described above. For example, a phenomenon in which a neural network that has learned a cat by showing a yellow cat does not recognize that it is a cat when it sees a cat other than yellow may be a type of overfitting. Overfitting can act as a cause of increasing errors in machine learning algorithms. In order to prevent such overfitting, various optimization methods can be used. In order to prevent overfitting, methods such as increasing the training data, regulation, or dropout in which a part of the nodes of the network are omitted in the learning process may be applied.

A computer-readable medium storing a data structure is disclosed according to an embodiment of the present disclosure.

The data structure may refer to the organization, management, and storage of data that enables efficient access and modification of data. A data structure may refer to an organization of data to solve a specific problem (eg, data retrieval, data storage, and data modification in the shortest time). A data structure may be defined as a physical or logical relationship between data elements designed to support a particular data processing function. The logical relationship between data elements may include a connection relationship between data elements that a user thinks. Physical relationships between data elements may include actual relationships between data elements physically stored on a computer-readable storage medium (eg, a hard disk). A data structure may specifically include a set of data, relationships between data, and functions or instructions applicable to data. Through an effectively designed data structure, a computing device can perform an operation while using the resource of the computing device to a minimum. Specifically, the computing device may increase the efficiency of operations, reads, insertions, deletions, comparisons, exchanges, and retrievals through effectively designed data structures.

A data structure may be classified into a linear data structure and a non-linear data structure according to the type of the data structure. The linear data structure may be a structure in which only one piece of data is connected after one piece of data. The linear data structure may include a list, a stack, a queue, and a deck. A list may mean a set of data in which an order exists internally. The list may include a linked list. The linked list may be a data structure in which data is linked in such a way that each data is linked in a line with a pointer. In a linked list, a pointer may contain information about a link with the next or previous data. A linked list may be expressed as a single linked list, a doubly linked list, or a circularly linked list according to a shape. A stack can be a data enumeration structure with limited access to data. A stack can be a linear data structure in which data can be processed (eg, inserted or deleted) at only one end of the data structure. The data stored in the stack may be a data structure LIFO-Last in First Out. A queue is a data listing structure that allows limited access to data, and unlike a stack, it may be a data structure that comes out later (FIFO-First in First Out) as data stored later. A deck can be a data structure that can process data at either end of the data structure.

The nonlinear data structure may be a structure in which a plurality of data is connected after one data. The nonlinear data structure may include a graph data structure. A graph data structure may be defined as a vertex and an edge, and the edge may include a line connecting two different vertices. A graph data structure may include a tree data structure. The tree data structure may be a data structure in which one path connects two different vertices among a plurality of vertices included in the tree. That is, it may be a data structure that does not form a loop in the graph data structure.

Throughout this specification, computational model, neural network, network function, and neural network may be used interchangeably. (Hereinafter, the neural network is unified and described.) The data structure may include a neural network. And the data structure including the neural network may be stored in a computer-readable medium. Data structures, including neural networks, may also include data input to the neural network, weights of the neural network, hyperparameters of the neural network, data obtained from the neural network, activation functions associated with each node or layer of the neural network, and loss functions for learning the neural network. have. A data structure comprising a neural network may include any of the components disclosed above. That is, the data structure including the neural network includes all or all of the data input to the neural network, the weights of the neural network, hyperparameters of the neural network, data obtained from the neural network, the activation function associated with each node or layer of the neural network, and the loss function for training the neural network. may be configured including any combination of In addition to the above-described configurations, a data structure including a neural network may include any other information that determines a characteristic of a neural network. In addition, the data structure may include all types of data used or generated in the operation process of the neural network, and is not limited to the above. Computer-readable media may include computer-readable recording media and/or computer-readable transmission media. A neural network may be composed of a set of interconnected computational units, which may generally be referred to as nodes. These nodes may also be referred to as neurons. A neural network is configured by including at least one or more nodes.

The data structure may include data input to the neural network. A data structure including data input to the neural network may be stored in a computer-readable medium. The data input to the neural network may include learning data input in a neural network learning process and/or input data input to the neural network in which learning is completed. Data input to the neural network may include pre-processing data and/or pre-processing target data. The preprocessing may include a data processing process for inputting data into the neural network. Accordingly, the data structure may include data to be pre-processed and data generated by pre-processing. The above-described data structure is merely an example, and the present disclosure is not limited thereto.

The data structure may include the weights of the neural network. (In this specification, a weight and a parameter may be used interchangeably.) And a data structure including a weight of a neural network may be stored in a computer-readable medium. The neural network may include a plurality of weights. The weight may be variable, and may be changed by the user or algorithm in order for the neural network to perform a desired function. For example, when one or more input nodes are interconnected to one output node by respective links, the output node sets values input to input nodes connected to the output node and links corresponding to the respective input nodes. An output node value may be determined based on the parameter. The above-described data structure is merely an example, and the present disclosure is not limited thereto.

By way of example and not limitation, the weight may include a weight variable in a neural network learning process and/or a weight in which neural network learning is completed. The variable weight in the neural network learning process may include a weight at a time point at which a learning cycle starts and/or a weight variable during the learning cycle. The weight for which neural network learning is completed may include a weight for which a learning cycle is completed. Accordingly, the data structure including the weights of the neural network may include a data structure including the weights that vary in the process of learning the neural network and/or the weights on which the learning of the neural network is completed. Therefore, it is assumed that the above-described weights and/or combinations of weights are included in the data structure including the weights of the neural network. The above-described data structure is merely an example, and the present disclosure is not limited thereto.

The data structure including the weights of the neural network may be stored in a computer-readable storage medium (eg, memory, hard disk) after being serialized. Serialization can be the process of converting a data structure into a form that can be reconstructed and used later by storing it on the same or a different computing device. The computing device may serialize the data structure to send and receive data over a network. A data structure including weights of the serialized neural network may be reconstructed in the same computing device or in another computing device through deserialization. The data structure including the weight of the neural network is not limited to serialization. Furthermore, the data structure including the weights of the neural network is a data structure to increase the efficiency of computation while using the resources of the computing device to a minimum (e.g., in the nonlinear data structure, B-Tree, Trie, m-way search tree, AVL tree, Red-Black Tree). The foregoing is merely an example, and the present disclosure is not limited thereto.

The data structure may include hyper-parameters of the neural network. And the data structure including the hyperparameters of the neural network may be stored in a computer-readable medium. The hyperparameter may be a variable variable by a user. Hyperparameters are, for example, learning rate, cost function, number of iterations of the learning cycle, weight initialization (e.g., setting the range of weight values to be initialized for weights), Hidden Unit The number (eg, the number of hidden layers, the number of nodes of the hidden layer) may be included. The above-described data structure is merely an example, and the present disclosure is not limited thereto.

3 is a schematic diagram illustrating a process of generating an anomalous sensing model according to an embodiment of the present disclosure.

The training data 321 , 331 , 341 , and 351 may include a plurality of subsets. The plurality of training data subsets may be grouped according to a predetermined criterion. The predetermined criterion may include any criterion capable of distinguishing training data included in a subset of training data from training data included in another subset of training data. For example, the predetermined criterion may include at least one of a generation time interval of the training data and a domain of the training data. In another embodiment of the present disclosure, when the training data is grouped by the generation time period of the training data, a plurality of normal patterns may be included in one training data subset. For example, when the training data generated for 6 months is configured as one subset, the training data (ie, a plurality of normal patterns) generated by two or more recipes may be included in one subset. In this case, one anomaly detection submodel may learn a plurality of normal patterns, and may be used for anomaly detection (eg, novelty detection) for a plurality of normal patterns. In addition, in another embodiment of the present disclosure, learning data and input data generated by one recipe may have a plurality of normal patterns. In this case, the training data generated by one recipe may be composed of one training data subset including a plurality of normal patterns based on one recipe, and the training data subset is configured for each normal pattern. You may. The learning data and input data generated by one recipe may have one normal pattern or a plurality of normal patterns. In addition, for example, a subset of the training data may be grouped based on whether a new pattern is included by the pre-trained anomaly detection submodel. For example, the generation time interval of the training data may be a time interval having a constant size or a time interval having different sizes. For example, when a change of a recipe in the production process occurs at a cycle of 6 months, the generation time interval of the training data that distinguishes a subset of the training data may be 6 months. Also, for example, the size of the time interval may be set so that the number of training data included in the subset of training data is similar to each other. For example, the number of learning data obtained when the operation rate of the production process is 50% may be half of the number of learning data obtained when the operation rate of the production process is 100%. In this case, when learning data is collected for 3 months in a process with an operating rate of 100% in the production process and one training data subset is configured, learning data is collected for 6 months in a process with an operating rate of 50% of the production process to create one may constitute a subset of the training data of The generation time interval for classifying the training data subsets may be set by the administrator. Further, in another embodiment of the present invention in which training data used for training a previous anomaly detection submodel is reused for training an anomaly detection submodel, the anomaly detection submodel is more fitted to the latest training data ), the size of the time interval for classifying the training data subsets may be longer as the newest training data subset is (that is, the number of the latest training data can be included in the training data set for training. has exist). For example, when the training data subset for training the previous submodel is sensor data accumulated for 3 months, the training data subset for training the current submodel may be sensor data accumulated for 6 months. The size of the generation time interval for classifying the training data subset may be constant or different, and even when the size of the time interval is set differently, when the recipe of the process is changed, learning data accumulated before and after the recipe change may be included in different subsets of training data.

In the example of FIG. 3 , the training data subset 1 351 may be the oldest training data generated. The training data subset n 321 may be the most recently generated training data. In one embodiment, the training data subsets may be grouped in response to recipe changes in the process.

The computing device 100 may train the anomaly detection submodel 1 350 by using the training data subset 1 351 . The anomaly detection submodel 1 350 for which training is completed may be included in the anomaly detection model 300 . The computing device 100 may train the next anomaly detection submodel by using the next training data subset. In this case, at least a part of the learned previous anomaly detection submodel is transferred to the next anomaly detection submodel. ) can be As described above, for example, the next anomaly detection submodel may share some of the weights of the previously learned anomaly detection submodel. Through this method, the anomalous sensing model 300 according to an embodiment of the present disclosure may be continuously learned.

The computing device 100 may train the anomaly sensing submodel n-2 (340) by using the training data subset n-2 (341). In this case, in the computing device 100 , a part of the anomaly detection submodel n-3 (not shown, the previous anomaly detection submodel of the anomalous detection submodel n-2 340 ) may be transferred 343 . The anomaly detection sub-model n-2 340 for which training has been completed may be included in the anomaly detection model 300 . The computing device 100 may store the learned anomaly detection submodel n-2 340 separately from other anomaly detection submodels.

The computing device 100 may train the anomaly sensing submodel n-1 (330) by using the training data subset n-1 (331). The training data subset n-1 331 may include training data generated in a later time interval than the time interval in which the training data subset n-2 341 is generated. The anomaly sensing submodel n-1 (330) may be a submodel generated later than the anomaly sensing submodel n-2 (340). The computing device 100 may use a part of the learned state of the anomaly detection submodel n-2 340 to learn the anomaly detection submodel n-1 330 . The computing device 100 may set at least a part of the initial weight of the anomaly detection submodel n-1 (330) as the weight of the learned anomaly detection submodel n-2 (340). The anomaly detection sub-model n-1 330 for which training is completed may be included in the anomaly detection model 300 . The computing device 100 may store the learned anomaly detection submodel n-1 (330) separately from other anomaly detection submodels.

The computing device 100 may train the anomaly sensing submodel n(320) by using the training data subset n(321). The training data subset n 321 may include training data generated in a later time interval than the time interval in which the training data subset n-1 331 is generated. The anomaly sensing submodel n 320 may be a submodel generated later than the anomaly sensing submodel n-1 330 . The computing device 100 may use a part of the learned state of the anomaly sensing submodel n-1 (330) for learning the anomaly sensing submodel n(320). The computing device 100 may set at least a portion of the initial weight of the anomaly detection submodel n 320 as the weight of the learned anomaly detection submodel n-1 330 . The anomaly detection sub-model n 320 for which training has been completed may be included in the anomaly detection model 300 . The computing device 100 may store the learned anomaly detection submodel n 320 separately from other anomaly detection submodels.

The computing device 100 trains each anomaly detection submodel by using each of the plurality of training data subsets to generate the anomaly detection model 300 , so that the anomaly detection model 300 is a different type of input data. can be processed. In addition, when learning each anomaly detection submodel, the computing device 100 utilizes the previous anomaly detection submodel for which training has been completed, so that the knowledge of the learned submodel is not forgotten by the update of the submodel. can When the process changes, the input data obtained correspondingly may change. However, input data before and after process change may share many parts. Therefore, by generating each anomaly detection submodel according to changes in input data such as process changes, input data can be processed regardless of input data changes, and the knowledge learned between the anomalous detection submodels is transferred to the next submodel In this way, the problem of performance degradation due to forgetting can be solved.

4 is a schematic diagram illustrating an anomaly detection process of data using an anomaly detection model according to an embodiment of the present disclosure.

The computing device 100 may determine whether an anomaly exists in the input data 310 using the anomaly detection model 300 . The anomaly sensing model 300 may include a plurality of anomaly sensing submodels 320 , 330 , 340 , and 350 . As described above, the anomalous sensing sub-models 320 , 330 , 340 , and 350 have been trained corresponding to each of the grouped training data, and may share knowledge learned from the previous sub-model.

The computing device 100 may process input data 310 that may be generated in the process while the process continues. The computing device 100 determines whether an anomaly exists in the input data 310 by at least a portion of the plurality of anomaly detection submodels 320 , 330 , 340 , 350 included in the anomaly detection model 300 . can be used to judge. The computing device 100 may first determine whether an anomaly exists in the input data 310 using the anomaly detection submodel n 320 , which is the latest anomaly detection submodel. When the computing device 100 determines that there is no new pattern in the input data 310 as a result of the determination using the anomaly detection submodel n 320 , the computing device 100 determines that the input data 310 is normal. It may be determined 325 that it is data. When the computing device 100 determines that a new pattern exists 327 in the input data 310 as a result of determination using the anomaly detection submodel n 320 , this new pattern may be an anomaly, or The mali detection submodel n 320 may be a normal pattern of a past process that has not been learned. In addition, this new pattern may be a part where the transfer of knowledge learned in the previous anomaly sensing submodel is insufficient. Accordingly, in this case, when it is determined that the new pattern is included in the input data, the computing device 100 determines whether the new pattern is included in the input data using the anomaly detection submodel n 320 , It may be determined whether a new pattern is included in the input data using the sensing submodel n-1 (330).

The computing device 100 determines whether a new pattern is included in the input data 310 using the anomaly detection submodel n-1 330. As a result, the new pattern (ie, the training data subset) is included in the input data 310. When it is determined that n-1 (a pattern not included in 331) is not included, the computing device 100 may determine (335) the input data 310 as normal data. That is, the input data 310 may be determined to be included as a new pattern in the anomaly detection submodel n 320 , but may be determined to include only the previously learned pattern in the anomaly detection submodel n-1 330 . In this case, the input data 310 may be input data obtained in a production process according to a previous recipe. That is, the input data 310 in this case may be an image of a normal product of a past process, data about a normal operating parameter of a past process, and sensor data of a past process. Because it was judged to contain, the past process may be different from the latest process.

As a result of determining whether the new pattern is included in the input data 310 using the anomalous detection submodel n-1 (330), the computing device 100 determines that the new pattern is included in the input data 310 (337) In this case, the computing device 100 may determine whether a new pattern is included in the input data 310 using the anomaly detection submodel n-2 340 .

The computing device 100 determines whether the new pattern is included in the input data 310 using the anomaly detection submodel n-2 340. As a result, the input data 310 contains a new pattern (ie, the training data subset n). When it is determined that -2 (pattern not included in 341) is not included, the computing device 100 may determine 345 that the input data 310 is normal data. That is, it was determined that the input data 310 was included as a new pattern in the anomaly detection submodel n 320 and the anomaly detection submodel n-1 (330), but in the anomaly detection submodel n-2 (340). It may be determined that only the previously learned pattern is included. In this case, the input data 310 may be input data obtained in a production process according to a past recipe. That is, in this case, the input data 310 may be sensor data obtained from a past process, and since it is determined that a new pattern is included in the latest anomaly detection submodel, the past process may be different from the latest process.

As a result of determining whether the new pattern is included in the input data 310 using the anomalous detection submodel n-2 (340), the computing device 100 determines that the new pattern is included in the input data 310 (347) In this case, the computing device 100 may determine whether a new pattern is included in the input data 310 using a previous anomaly detection submodel (not shown) of the anomaly detection submodel n-2 340 . have. In this way, when it is determined that the input data includes a new pattern, the computing device 100 may determine whether the new pattern is included in the input data using the previous anomaly detection submodel, and the input data is normal. , it is possible to stop calling the previous anomaly detection submodel and determine that the input data is normal. In another embodiment of the present disclosure, even when it is determined that the input data is normal, the previous anomaly detection submodel may be called, and when the input data is determined to be normal in the plurality of anomaly detection submodels, It is also possible to integrate multiple anomaly detection submodels. Also, when it is determined that the input data is included as a new pattern in the determination using all the anomaly detection submodels, the computing device 100 may determine that the input data 310 includes the anomaly.

In an embodiment of the present disclosure, the computing device 100 does not need to maintain all the past learning data by using the sub-model scaling and anomaly determination method as described above, and the effect of continuous learning only by accessing the previous sub-model can enjoy That is, when the model is updated, there is no need to re-train through all previous training data, but when the model is updated, the existing model is maintained, and the new model that inherits a part of the existing model is trained with new training data. A model update can be performed. In addition, by retaining both the models before and after the update when the model is updated, it is possible to process input data through all models without maintaining all training data, thereby solving other performance degradation problems due to changes in input data.

5 shows an exemplary flowchart of a method for anomaly sensing of data according to an embodiment of the present disclosure.

According to an embodiment of the present disclosure, the computing device 100 includes a plurality of anomaly detection submodels including a network function pre-trained using a plurality of training data subsets included in the training data set. A sensing model may be generated (410).

According to an embodiment of the present disclosure, the computing device 100 may determine one or more anomaly detection submodels for calculating input data from among a plurality of generated anomaly detection submodels ( 420 ).

According to an embodiment of the present disclosure, the computing device 100 may determine whether an anomaly exists in the input data using one or more determined anomaly detection submodels ( 430 ).

The above-described steps illustrated in FIG. 5 may be changed in order if necessary, and at least one or more steps may be omitted or added. That is, the above-described steps are merely embodiments of the present disclosure, and the scope of the present disclosure is not limited thereto.

6 illustrates logic for implementing a method for anomaly sensing of data according to an embodiment of the present disclosure.

According to an embodiment of the present disclosure, the computing device 100 may be implemented by the following logic.

According to an embodiment of the present disclosure, the computing device 100 includes a plurality of anomaly detection submodels including a network function pre-trained using a plurality of training data subsets included in the training data set. Logic 510 for generating a sensing model, logic 520 for determining one or more anomaly sensing submodels for calculating input data among the generated plurality of anomaly sensing submodels, and the determined one or more anomaly sensing submodels Logic 530 for determining whether an anomaly exists in the input data using the model may be included.

In an alternative embodiment, the logic for determining one or more anomaly sensing submodels for computing input data among the generated plurality of anomaly sensing submodels may include: and logic for determining one or more anomaly sensing submodels for computing the input data based on at least one of a processing tendency, context information of the input data, or cluster information of the input data.

In an alternative embodiment, the logic for determining one or more anomaly sensing submodels from among the generated plurality of anomaly sensing submodels for computing input data may include: other input data having a predetermined relationship with the input data; Logic for determining the calculated anomalous sensing submodel as the anomalous sensing submodel for calculating the input data may be included.

In an alternative embodiment, the other input data may include input data generated prior to generation of the input data, and may include data generated within a predetermined time interval with the input data.

In an alternative embodiment, the logic for determining an anomaly sensing submodel for calculating other input data having a predetermined relationship with the input data as an anomaly sensing submodel for calculating the input data includes: Logic may be included for determining an anomaly sensing sub-model in which other input data having a predetermined relationship is determined as normal data as an anomaly sensing sub-model for calculating the input data.

In an alternative embodiment, the logic for determining one or more anomaly sensing submodels for calculating input data among the generated plurality of anomaly sensing submodels may include: based on context information of the input data, the context information and logic for determining an anomaly sensing submodel matching with the one or more anomaly sensing submodels for calculating the input data.

In an alternative embodiment, the context information includes information associating input data with a normal pattern, a context indicator associating the input data with at least one of a manufacturing recipe or manufacturing equipment, a manufacturing recipe characteristic of the input data, or It may include at least one of a context characteristic indicator associated with at least one of the manufacturing equipment characteristics, or a missing characteristic indicator including information on the missing characteristic of the input data.

In an alternative embodiment, the context information may match at least one of the input data or the training data, and the anomaly sensing submodel may match context information matched to the training data subset.

In an alternative embodiment, the logic for determining one or more anomaly sensing submodels for computing input data among the generated plurality of anomaly sensing submodels is configured to: cluster one or more other input data based on similarity; logic; and logic for determining, as an anomalous sensing submodel for calculating the input data, an anomaly sensing submodel obtained by calculating other input data included in the cluster to which the input data belongs.

In an alternative embodiment, logic for clustering the plurality of anomaly sensing submodels; and a logic for integrating one or more anomalous sensing submodels included in one cluster to generate an integrated anomalous sensing submodel.

In an alternative embodiment, the logic for clustering the plurality of anomaly sensing submodels is based on at least one of context information matched to each of the anomalous sensing submodels, or an input data processing characteristic of each of the anomaly sensing submodels. Thus, logic for clustering one or more anomaly detection submodels included in the plurality of anomaly detection submodels may be included.

In an alternative embodiment, the logic for clustering the plurality of anomaly detection submodels includes logic for clustering the anomaly detection submodels based on a determination result for input data of each of the anomaly detection submodels. may include

In an alternative embodiment, the logic for clustering the anomalous detection submodel based on the determination result of the input data of each of the anomalous detection submodels is different from the anomalous detection submodel in which the input data is determined as normal data. It may include logic for clustering other anomaly detection submodels in which the input data is determined as normal data into one cluster when the input data and the other input data are related.

In an alternative embodiment, the logic for clustering the anomaly detection submodels based on a determination result of the input data of each of the anomalous detection submodels may include: one or more anomaly detection that determines the input data as normal data Logic for classifying submodels into one cluster may be included.

In an alternative embodiment, the logic for merging one or more anomaly sensing submodels included in one cluster to generate a unified anomaly sensing submodel includes: one or more anomaly sensing submodels included in the one cluster. It may include logic to create an integrated anomaly sensing submodel by ensemble of .

In an alternative embodiment, the logic for merging one or more anomaly sensing submodels included in one cluster to generate a unified anomaly sensing submodel includes: one or more anomaly sensing submodels included in the one cluster. and logic for removing at least a portion of the to generate a unified anomaly sensing submodel.

In an alternative embodiment, the logic for merging one or more anomaly sensing submodels included in one cluster to generate a unified anomaly sensing submodel includes: one or more anomaly sensing submodels included in the one cluster. It may include logic for generating an integrated anomaly sensing submodel based on the performance test for .

In an alternative embodiment, the logic for merging one or more anomaly sensing submodels included in one cluster to generate a unified anomaly sensing submodel includes: one or more anomaly sensing submodels included in the one cluster. It can include logic to create an integrated anomaly sensing submodel by retraining .

According to an embodiment of the present disclosure, logic for implementing the computing device ( ) may be implemented by means, circuits or modules for implementing the computing device.

Those skilled in the art will further appreciate that the various illustrative logical blocks, configurations, modules, circuits, means, logics, and algorithm steps described in connection with the embodiments disclosed herein may be implemented in electronic hardware, computer software, or combinations of both. It should be recognized that they can be implemented with To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, configurations, means, logics, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present disclosure.

7 depicts a simplified, general schematic diagram of an exemplary computing environment in which embodiments of the present disclosure may be implemented.

Although the present disclosure has been described above generally in the context of computer-executable instructions that may be executed on one or more computers, those skilled in the art will appreciate that the present disclosure may be implemented in combination with other program modules and/or in a combination of hardware and software. will be.

Generally, program modules include routines, procedures, programs, components, data structures, etc. that perform particular tasks or implement particular abstract data types. In addition, those skilled in the art will appreciate that the methods of the present disclosure are suitable for single-processor or multiprocessor computer systems, minicomputers, mainframe computers as well as personal computers, handheld computing devices, microprocessor-based or programmable consumer electronics, etc. (each of which is It will be appreciated that other computer system configurations may be implemented, including those that may operate in connection with one or more associated devices.

The described embodiments of the present disclosure may also be practiced in distributed computing environments where certain tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

Computers typically include a variety of computer-readable media. Any medium accessible by a computer may be a computer-readable medium, and the computer-readable medium may include a computer-readable storage medium and a computer-readable transmission medium. Such computer-readable storage media includes volatile and nonvolatile media, removable and non-removable media. Computer readable storage media includes volatile and nonvolatile media, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. A computer-readable storage medium may be RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital video disk (DVD) or other optical disk storage device, magnetic cassette, magnetic tape, magnetic disk storage device, or other magnetic storage device. device, or any other medium that can be accessed by a computer and used to store the desired information.

Computer-readable transmission media typically embody computer-readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism. information delivery media. The term modulated data signal means a signal in which one or more of the characteristics of the signal is set or changed to encode information in the signal. By way of example, and not limitation, computer-readable transmission media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared, and other wireless media. Combinations of any of the above are also intended to be included within the scope of computer-readable transmission media.

An example environment 1100 implementing various aspects of the disclosure is shown including a computer 1102 , the computer 1102 including a processing unit 1104 , a system memory 1106 , and a system bus 1108 . do. The system bus 1108 couples system components, including but not limited to system memory 1106 , to the processing device 1104 . The processing device 1104 may be any of a variety of commercially available processors. Dual processor and other multiprocessor architectures may also be used as processing unit 1104 .

The system bus 1108 may be any of several types of bus structures that may further interconnect a memory bus, a peripheral bus, and a local bus using any of a variety of commercial bus architectures. System memory 1106 includes read only memory (ROM) 1110 and random access memory (RAM) 1112 . A basic input/output system (BIOS) is stored in non-volatile memory 1110, such as ROM, EPROM, EEPROM, etc., which is the basic input/output system (BIOS) that helps transfer information between components within computer 1102, such as during startup. contains routines. RAM 1112 may also include high-speed RAM, such as static RAM, for caching data.

이 내장형 하드 디스크 드라이브(1114)는 또한 적당한 섀시(도시 생략) 내에서 외장형 용도로 구성될 수 있음

, 자기 플로피 디스크 드라이브(FDD)(1116)(예를 들어, 이동식 디스켓(1118)으로부터 판독을 하거나 그에 기록을 하기 위한 것임), 및 광 디스크 드라이브(1120)(예를 들어, CD-ROM 디스크(1122)를 판독하거나 DVD 등의 기타 고용량 광 매체로부터 판독을 하거나 그에 기록을 하기 위한 것임)를 포함한다. 하드 디스크 드라이브(1114), 자기 디스크 드라이브(1116) 및 광 디스크 드라이브(1120)는 각각 하드 디스크 드라이브 인터페이스(1124), 자기 디스크 드라이브 인터페이스(1126) 및 광 드라이브 인터페이스(1128)에 의해 시스템 버스(1108)에 연결될 수 있다. 외장형 드라이브 구현을 위한 인터페이스(1124)는 USB(Universal Serial Bus) 및 IEEE 1394 인터페이스 기술 중 적어도 하나 또는 그 둘다를 포함한다.The computer 1102 also has an internal hard disk drive (HDD) 1114 (eg, EIDE, SATA).

This internal hard disk drive 1114 may also be configured for external use within a suitable chassis (not shown).

, a magnetic floppy disk drive (FDD) 1116 (e.g., for reading from or writing to removable diskette 1118), and an optical disk drive 1120 (e.g., a CD-ROM disk 1122) or for reading from or writing to other high capacity optical media such as DVD). The hard disk drive 1114 , the magnetic disk drive 1116 , and the optical disk drive 1120 are connected to the system bus 1108 by the hard disk drive interface 1124 , the magnetic disk drive interface 1126 , and the optical drive interface 1128 , respectively. ) can be connected to The interface 1124 for implementing an external drive includes at least one or both of Universal Serial Bus (USB) and IEEE 1394 interface technologies.

These drives and their associated computer-readable media provide non-volatile storage of data, data structures, computer-executable instructions, and the like. In the case of computer 1102, drives and media correspond to storing any data in a suitable digital format. Although the description of computer readable media above refers to HDDs, removable magnetic disks, and removable optical media such as CDs or DVDs, those skilled in the art will use zip drives, magnetic cassettes, flash memory cards, cartridges, etc. It will be appreciated that other tangible computer-readable media such as etc. may also be used in the exemplary operating environment and any such media may include computer-executable instructions for performing the methods of the present disclosure.

A number of program modules may be stored in the drive and RAM 1112 , including an operating system 1130 , one or more application programs 1132 , other program modules 1134 , and program data 1136 . All or portions of the operating system, applications, modules, and/or data may also be cached in RAM 1112 . It will be appreciated that the present disclosure may be implemented in various commercially available operating systems or combinations of operating systems.

A user may enter commands and information into the computer 1102 via one or more wired/wireless input devices, for example, a pointing device such as a keyboard 1138 and a mouse 1140 . Other input devices (not shown) may include a microphone, IR remote control, joystick, game pad, stylus pen, touch screen, and the like. Although these and other input devices are often connected to the processing unit 1104 through an input device interface 1142 that is connected to the system bus 1108, parallel ports, IEEE 1394 serial ports, game ports, USB ports, IR interfaces, It may be connected by other interfaces, etc.

A monitor 1144 or other type of display device is also coupled to the system bus 1108 via an interface, such as a video adapter 1146 . In addition to the monitor 1144, the computer typically includes other peripheral output devices (not shown), such as speakers, printers, and the like.

Computer 1102 may operate in a networked environment using logical connections to one or more remote computers, such as remote computer(s) 1148 via wired and/or wireless communications. Remote computer(s) 1148 may be workstations, server computers, routers, personal computers, portable computers, microprocessor-based entertainment devices, peer devices, or other common network nodes, and are generally Although including many or all of the components described, only memory storage device 1150 is shown for simplicity. The logical connections shown include wired/wireless connections to a local area network (LAN) 1152 and/or a larger network, eg, a wide area network (WAN) 1154 . Such LAN and WAN networking environments are common in offices and companies, and facilitate enterprise-wide computer networks, such as intranets, all of which can be connected to a worldwide computer network, for example, the Internet.

When used in a LAN networking environment, the computer 1102 is connected to the local network 1152 through a wired and/or wireless communication network interface or adapter 1156 . Adapter 1156 may facilitate wired or wireless communication to LAN 1152 , which also includes a wireless access point installed therein for communicating with wireless adapter 1156 . When used in a WAN networking environment, the computer 1102 may include a modem 1158 , connected to a communication server on the WAN 1154 , or otherwise establishing communications over the WAN 1154 , such as over the Internet. have the means A modem 1158 , which may be internal or external and a wired or wireless device, is coupled to the system bus 1108 via a serial port interface 1142 . In a networked environment, program modules described for computer 1102 , or portions thereof, may be stored in remote memory/storage device 1150 . It will be appreciated that the network connections shown are exemplary and other means of establishing a communication link between the computers may be used.

Computer 1102 may be associated with any wireless device or object that is deployed and operates in wireless communication, for example, printers, scanners, desktop and/or portable computers, portable data assistants (PDAs), communications satellites, wireless detectable tags. It operates to communicate with any device or place, and phone. This includes at least Wi-Fi and Bluetooth wireless technologies. Accordingly, the communication may be a predefined structure as in a conventional network or may simply be an ad hoc communication between at least two devices.

Wi-Fi (Wireless Fidelity) makes it possible to connect to the Internet, etc. without a wired connection. Wi-Fi is a wireless technology such as cell phones that allows these devices, eg, computers, to transmit and receive data indoors and outdoors, ie anywhere within range of a base station. Wi-Fi networks use a radio technology called IEEE 802.11 (a, b, g, etc.) to provide secure, reliable, and high-speed wireless connections. Wi-Fi can be used to connect computers to each other, to the Internet, and to wired networks (using IEEE 802.3 or Ethernet). Wi-Fi networks may operate in unlicensed 2.4 and 5 GHz radio bands, for example, at 11 Mbps (802.11a) or 54 Mbps (802.11b) data rates, or in products that include both bands (dual band). have.

Those of ordinary skill in the art of the present disclosure will recognize that the various illustrative logical blocks, modules, processors, means, circuits, and algorithm steps described in connection with the embodiments disclosed herein include electronic hardware, (convenience For this purpose, it will be understood that it may be implemented by various forms of program or design code (referred to herein as "software") or a combination of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. A person skilled in the art of the present disclosure may implement the described functionality in various ways for each specific application, but such implementation decisions should not be interpreted as a departure from the scope of the present disclosure.

The various embodiments presented herein may be implemented as methods, apparatus, or articles of manufacture using standard programming and/or engineering techniques. The term “article of manufacture” includes a computer program, carrier, or media accessible from any computer-readable device. For example, computer-readable media include magnetic storage devices (eg, hard disks, floppy disks, magnetic strips, etc.), optical disks (eg, CDs, DVDs, etc.), smart cards, and flash memory. devices (eg, EEPROMs, cards, sticks, key drives, etc.). Also, various storage media presented herein include one or more devices and/or other machine-readable media for storing information. The term “machine-readable medium” includes, but is not limited to, wireless channels and various other media capable of storing, holding, and/or carrying instruction(s) and/or data.

It is understood that the specific order or hierarchy of steps in the presented processes is an example of exemplary approaches. Based on design priorities, it is understood that the specific order or hierarchy of steps in the processes may be rearranged within the scope of the present disclosure. The appended method claims present elements of the various steps in a sample order, but are not meant to be limited to the specific order or hierarchy presented.

The description of the presented embodiments is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the scope of the present disclosure. Thus, the present disclosure is not intended to be limited to the embodiments presented herein, but is to be construed in the widest scope consistent with the principles and novel features presented herein.

Claims (20)

A computer program stored in a computer-readable storage medium, wherein the computer program, when executed on one or more processors of a computing device, causes the following operations to be performed for managing a model, the operations comprising:
generating an anomaly sensing model including a plurality of anomaly sensing submodels including a pre-trained network function by using a plurality of training data subsets included in the training data set;
clustering the plurality of anomaly sensing submodels;
generating an integrated anomaly sensing submodel by integrating one or more anomalous sensing submodels included in one cluster;
determining one or more anomaly sensing submodels for calculating input data from among the plurality of anomaly sensing submodels; and
determining whether an anomaly exists in the input data using the determined at least one anomaly detection submodel;
comprising,
A computer program stored on a computer-readable storage medium.
The method of claim 1,
The operation of determining one or more anomaly detection submodels for calculating input data among the generated plurality of anomaly detection submodels includes:
Determine one or more anomaly sensing submodels for calculating the input data based on at least one of processing tendencies of other input data for the plurality of anomaly sensing submodels, context information of the input data, or cluster information of the input data. action to do;
comprising,
A computer program stored on a computer-readable storage medium.
3. The method of claim 2,
The operation of determining one or more anomaly detection submodels for calculating input data among the generated plurality of anomaly detection submodels includes:
determining an anomaly sensing submodel obtained by calculating other input data having a predetermined relationship with the input data as an anomaly sensing submodel for calculating the input data;
comprising,
A computer program stored on a computer-readable storage medium.
4. The method of claim 3,
The other input data is
comprising input data generated prior to generation of the input data, comprising data generated within a predetermined time interval with the input data;
A computer program stored on a computer-readable storage medium.

4. The method of claim 3,
The operation of determining an anomaly sensing submodel obtained by calculating other input data having a predetermined relationship with the input data as an anomaly sensing submodel for calculating the input data comprises:
determining an anomaly detection submodel for calculating the input data as an anomaly detection submodel for calculating the input data as normal data other input data having a predetermined relationship with the input data;
comprising,
A computer program stored on a computer-readable storage medium.
3. The method of claim 2,
The operation of determining one or more anomaly detection submodels for calculating input data among the generated plurality of anomaly detection submodels includes:
determining, based on context information of the input data, an anomaly sensing submodel matching the context information as one or more anomaly sensing submodels for calculating the input data;
comprising,
A computer program stored on a computer-readable storage medium.
7. The method of claim 6,
The context information is
contains information associating the input data with a normal pattern;
a context indicator associating the input data with at least one of a manufacturing recipe or manufacturing equipment; a context characteristic indicator associating the input data with at least one of a manufacturing recipe characteristic or manufacturing equipment characteristic of the input data; or information about a missing characteristic of the input data. at least one of the missing characteristic indicators comprising
A computer program stored on a computer-readable storage medium.
7. The method of claim 6,
The context information is
matches at least one of the input data or training data, and the anomaly sensing submodel matches context information matched to the subset of training data;
A computer program stored on a computer-readable storage medium.
3. The method of claim 2,
The operation of determining one or more anomaly detection submodels for calculating input data among the generated plurality of anomaly detection submodels includes:
clustering one or more other input data based on similarity; and
determining an anomaly detection submodel for calculating other input data included in the cluster to which the input data belongs as an anomaly detection submodel for calculating the input data;
comprising,
A computer program stored on a computer-readable storage medium.
delete The method of claim 1,
The operation of clustering the plurality of anomaly detection submodels comprises:
Clustering one or more anomalous detection submodels included in a plurality of anomaly detection submodels based on at least one of context information matched to each anomaly detection submodel, or input data processing characteristics of each anomaly detection submodel action;
comprising,
A computer program stored on a computer-readable storage medium.
The method of claim 1,
The operation of clustering the plurality of anomaly detection submodels comprises:
clustering the anomalous sensing submodels based on a determination result of the input data of each of the anomalous sensing submodels;
comprising,
A computer program stored on a computer-readable storage medium.
13. The method of claim 12,
The clustering of the anomalous detection submodels based on the determination result of the input data of each of the anomaly detection submodels includes
clustering an anomaly sensing submodel in which input data is determined as normal data and another anomaly sensing submodel in which other input data is determined as normal data into one cluster when the input data and the other input data are related;
comprising,
A computer program stored on a computer-readable storage medium.
13. The method of claim 12,
The clustering of the anomalous detection submodels based on the determination result of the input data of each of the anomaly detection submodels includes
classifying one or more anomaly detection submodels that determine the input data as normal data into one cluster;
comprising,
A computer program stored on a computer-readable storage medium.
The method of claim 1,
The operation of generating an integrated anomaly detection submodel by integrating one or more anomaly detection submodels included in one cluster includes:
generating an integrated anomaly detection submodel by ensembles one or more anomaly detection submodels included in the one cluster;
comprising,
A computer program stored on a computer-readable storage medium.
The method of claim 1,
The operation of generating an integrated anomaly detection submodel by integrating one or more anomaly detection submodels included in one cluster includes:
generating an integrated anomaly sensing submodel by removing at least a portion of one or more anomalous sensing submodels included in the one cluster;
comprising,
A computer program stored on a computer-readable storage medium.
The method of claim 1,
The operation of generating an integrated anomaly detection submodel by integrating one or more anomaly detection submodels included in one cluster includes:
generating an integrated anomaly detection submodel based on a performance test for one or more anomaly detection submodels included in the one cluster;
comprising,
A computer program stored on a computer-readable storage medium.
The method of claim 1,
The operation of generating an integrated anomaly detection submodel by integrating one or more anomaly detection submodels included in one cluster includes:
generating an integrated anomaly detection submodel by re-learning one or more anomaly detection submodels included in the one cluster;
containing,
A computer program stored on a computer-readable storage medium.
As a method for anomaly detection of data using a network function performed in one or more processors,
generating an anomaly detection model including a plurality of anomaly detection submodels including a pre-trained network function by using a plurality of training data subsets included in the training data set;
clustering the plurality of anomaly sensing submodels;
generating an integrated anomalous sensing submodel by integrating one or more anomalous sensing submodels included in one cluster;
determining one or more anomaly sensing submodels for calculating input data from among the plurality of anomaly sensing submodels; and
determining whether an anomaly exists in the input data using the determined at least one anomaly detection submodel;
containing,
Anomaly detection method.
A computing device comprising:
one or more processors; and
a memory storing instructions executable by the processor;
including,
The processor is
generate an anomaly sensing model including a plurality of anomaly sensing submodels including a pre-trained network function by using a plurality of training data subsets included in the training data set;
cluster the plurality of anomaly sensing submodels;
integrating one or more anomaly sensing submodels included in one cluster to generate a unified anomaly sensing submodel;
determining one or more anomaly sensing submodels for calculating input data from among the plurality of anomaly sensing submodels; And
determining whether an anomaly exists in the input data using the determined one or more anomaly detection submodels;
computing device.

Images