KR102271740B1 - Method and apparatus for anomaly detection - Google Patents

Abstract

The present disclosure relates to an anomaly detection method and an apparatus therefor. In accordance with one embodiment of the present disclosure, the anomaly detection method includes the following steps of: performing restoration learning with respect to at least one piece of data through an autoencoder including an encoder network and a decoder network; acquiring first output data by inputting first input data into the autoencoder, wherein the first output data includes a latent vector outputted through the encoder network and restoration data outputted through the decoder network; inputting the first input data and the first output data as second input data of a preset anomaly detection learning model; calculating an anomaly score based on the second output data outputted by the anomaly detection learning model; and determining whether the first input data is an anomaly by threshold-processing the calculated anomaly score. Therefore, the present disclosure is capable of creating a more robust learning model and increasing the stability of the learning model.

Description

Anomaly detection method and device therefor

The technical idea of the present disclosure relates to an anomaly detection method and an apparatus thereof, and more particularly, to an autoencoder-based anomaly detection method and an apparatus thereof.

Machine Learning is a field of AI that develops algorithms and technologies that allow computers to learn based on data. It is a core technology in various fields such as image processing, image recognition, voice recognition, and Internet search. shows excellent performance in prediction and anomaly detection.

Anomaly detection refers to finding objects or data that show a pattern different from expected in data. Conventional machine learning-based anomaly detection models calculate the difference between actual data and predicted data, and when the difference is greater than a threshold, anomaly judge that there is

Conventional anomaly detection methods based on machine learning have been disclosed, but in the case of an existing supervised learning-based anomaly detection model, it is not easy to label data individually when collecting data.

In addition, in learning abnormal data with a very small amount of data, it is difficult to improve classification performance with only a small amount of abnormal data, so that it is difficult to train enough to distinguish normal data from abnormal data.

An object of an anomaly detection method and an apparatus therefor according to the technical spirit of the present disclosure is to provide an anomaly detection method and apparatus capable of increasing the stability of anomaly detection by generating a robust learning model.

The technical problem to be achieved by the abnormal detection method and the apparatus therefor according to the technical spirit of the present disclosure is not limited to the above-mentioned problems, and another problem not mentioned will be clearly understood by those skilled in the art from the following description .

According to an aspect according to the technical spirit of the present disclosure, an anomaly detection method includes: performing reconstruction learning on at least one data through an autoencoder including an encoder network and a decoder network; inputting first input data to the autoencoder to obtain first output data - the first output data is a latent vector output through the encoder network and reconstructed data outputted through the decoder network Included - ; inputting the first input data and the first output data as second input data of a preset anomaly detection learning model; calculating an anomaly score based on second output data output by the anomaly detection learning model; and determining whether the first input data is abnormal by thresholding the calculated abnormality score.

According to an exemplary embodiment, in the performing of the reconstruction learning, reconstruction learning may be additionally performed on data to which noise is added through a noise mixer.

According to an exemplary embodiment, according to a user input, any one of a learning model including a convolutional neural network (CNN) model, a Gaussian mixture model, a clustering model, and a generative adversarial neural network (GAN) model is detected as the anomaly It can be set as a learning model.

According to an aspect according to the technical idea of the present disclosure, an abnormality detection apparatus includes a memory for storing a program for abnormality detection; and by executing the program, performing reconstruction learning on at least one data through an autoencoder including an encoder network and a decoder network, and inputting first input data into the autoencoder to obtain first output data, inputting the first input data and the first output data as second input data of a preset anomaly detection learning model, and calculating an anomaly score based on the second output data output by the anomaly detection learning model; a processor for controlling to determine whether the first input data is abnormal by thresholding the calculated anomaly score, wherein the first output data includes a latent vector output through the encoder network and the decoder network It may include the restored data output through the.

According to an exemplary embodiment, the processor may control the autoencoder to additionally perform reconstruction learning on data to which noise is added through a noise mixer.

According to an exemplary embodiment, the processor is configured to, according to a user input, any one of a learning model including a convolutional neural network (CNN) model, a Gaussian mixture model, a clustering model, and a generative adversarial neural network (GAN) model. can be controlled to be set as the anomaly detection learning model.

According to an anomaly detection method and an apparatus therefor according to embodiments according to the technical spirit of the present disclosure, by extracting a latent variable through a plurality of layers, it is possible to generate a more robust learning model and increase stability.

In addition, according to an anomaly detection method and an apparatus therefor according to embodiments according to the technical spirit of the present disclosure, restoration restored to be as close to the original as possible including restoration data restored to remove defects from original data and defects Since restoration data that meets needs among data can be utilized, the possibility of using this anomaly detection method can be broadened.

The effects that can be obtained by the method for detecting anomalies and the apparatus therefor according to the technical spirit of the present disclosure are not limited to the above-mentioned effects, and other effects not mentioned are common in the art to which the present disclosure belongs from the description below It can be clearly understood by those with knowledge.

In order to more fully understand the drawings cited in this disclosure, a brief description of each drawing is provided.
1 is a diagram for explaining the concept and structure of an autoencoder.
2 is a flowchart illustrating an autoencoder-based anomaly detection method according to an embodiment according to the technical spirit of the present disclosure.
3 is a diagram schematically illustrating the structure of an autoencoder according to an embodiment according to the technical spirit of the present disclosure.
4 is a diagram comparing input and output images of an autoencoder according to an embodiment according to the technical idea of the present disclosure.
5 is a diagram illustrating the structure of an autoencoder-based anomaly detection learning model according to an embodiment according to the technical idea of the present disclosure.
6A to 6C are diagrams for explaining a method of classifying a normal image and an abnormal image according to an autoencoder-based anomaly detection learning model according to an embodiment according to the technical spirit of the present disclosure.
7 is a block diagram schematically illustrating a configuration of an apparatus for detecting anomaly based on an autoencoder according to an embodiment according to the technical spirit of the present disclosure.

Since the technical spirit of the present disclosure may have various changes and may have various embodiments, specific embodiments will be illustrated in the drawings and described in detail. However, this is not intended to limit the technical spirit of the present disclosure to specific embodiments, and should be understood to include all changes, equivalents, or substitutes included in the scope of the technical spirit of the present disclosure.

In describing the technical spirit of the present disclosure, if it is determined that a detailed description of a related known technology may unnecessarily obscure the subject matter of the present disclosure, the detailed description thereof will be omitted. In addition, numbers (eg, first, second, etc.) used in the description process of the present disclosure are only identification symbols for distinguishing one component from other components.

In addition, in the present disclosure, when a component is referred to as "connected" or "connected" with another component, the component may be directly connected or directly connected to the other component, but in particular It should be understood that, unless there is a description to the contrary, it may be connected or connected through another element in the middle.

In addition, terms such as "~ unit", "~ group", "~ character", and "~ module" described in the present disclosure mean a unit that processes at least one function or operation, which is a processor, a micro Processor (Micro Processor), Micro Controller (Micro Controller), CPU (Central Processing Unit), GPU (Graphics Processing Unit), APU (Accelerate Processor Unit), DSP (Digital Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA (Field Programmable Gate Array) may be implemented as hardware or software, or a combination of hardware and software.

In addition, it is intended to clarify that the classification of the constituent parts in the present disclosure is merely a division for each main function in charge of each constituent unit. That is, two or more components to be described below may be combined into one component, or one component may be divided into two or more for each more subdivided function. In addition, each of the constituent units to be described below may additionally perform some or all of the functions of the other constituent units in addition to the main function it is responsible for, and may additionally perform some or all of the functions of the other constituent units. Of course, it may be carried out by being dedicated to it.

Hereinafter, embodiments of the present disclosure will be described in detail in turn.

1 is a diagram for explaining the concept and structure of an autoencoder.

A neural network (neural network) may generally be composed of a set of interconnected computational units, which may be referred to as nodes, and these nodes may be referred to as neurons. A neural network is generally configured to include a plurality of nodes. Nodes constituting the neural network may be interconnected by one or more links.

Some of the nodes constituting the neural network may configure one layer based on distances from the initial input node. For example, a set of nodes having a distance of n from the initial input node may constitute n layers.

The neural network described herein may include a deep neural network (DNN) including a plurality of hidden layers in addition to an input layer and an output layer. Deep neural networks may include convolutional neural networks (CNNs), recurrent neural networks (RNNs), autoencoders, generative adversarial networks (GANs), etc. can

As shown in FIG. 1 , the autoencoder 100 may include one input layer 110 , an output layer 130 , and at least one hidden layer 120 . The number of nodes constituting the input layer 110 of the autoencoder 100 and the number of nodes constituting the output layer 130 of the autoencoder 100 may be the same. The autoencoder 100 may be a network function that can be used in an unsupervised learning model while meeting the definition of a neural network described above. That is, the autoencoder does not learn with input data and labels, but compresses and restores the characteristics of the data itself using only the input data.

The neural network structure of the autoencoder 100 may be defined by the number of nodes, a connection relationship between links connecting the nodes, and a weight assigned to each link.

Also, in the autoencoder 100 , the number of nodes constituting the hidden layer 120 may be less than the number of nodes constituting the input layer 110 or the output layer 130 .

The set of the input layer 110 and the hidden layer 120, which are subsets of the layers constituting the autoencoder 100, may be defined as the encoder network 100A as one neural network. Also, the set of the hidden layer 120 and the output layer 130 may be defined as the decoder network 100B as another neural network. The output layer of the encoder network 100A may be the input layer of the decoder network 100B.

The autoencoder 100 outputs a result of compressing data input to the input layer 110 of the encoder network 100A through the hidden layer 120 as a latent vector, and re-decoder the output latent variable. A function of restoring through the output layer 130 through the hidden layer 120 of the network 100B may be performed.

2 is a flowchart illustrating an autoencoder-based anomaly detection method according to an embodiment according to the technical spirit of the present disclosure.

An autoencoder-based anomaly detection method according to an embodiment according to the technical idea of the present disclosure is performed on a personal computer, a workstation, a server computer device, etc. with computing capability, or a separate device for the same can be performed in

In addition, the autoencoder-based anomaly detection method according to an embodiment according to the spirit of the present disclosure may be performed by one or more computing devices. For example, at least one or more steps of the anomaly detection method according to an embodiment of the present disclosure may be performed in a client device, and other steps may be performed in a server device. In this case, the client device and the server device may be connected to a network to transmit/receive an operation result. Alternatively, the anomaly detection method according to an embodiment of the present disclosure may be performed by distributed computing technology.

In addition, such an apparatus for detecting an abnormality may detect whether there is an abnormality in at least one data using a normal data set including normal data and reference data generated through the normal data.

First, restoration learning is performed on at least one data through the autoencoder (S210). In this case, reconstruction learning may be additionally performed on data to which noise is added through a noise mixer. Through this, the autoencoder can be trained as a robust model, and overfitting can be prevented.

Here, the noise may include Gaussian noise, salt and pepper noise, and the like.

In addition, since the autoencoder is implemented as a denoising autoencoder, it can be used as an input to the model by adding noise to the data. In general, in addition to directly adding Gaussian noise, a dropout layer is added to can also be used.

In addition, the autoencoder may further include a fully connected layer at the rear end of the encoder network and the front end of the decoder network, respectively. A fully connected layer refers to a layer in which all neurons in one layer and all neurons in neighboring layers are connected. The fully connected layer may be referred to as a dense layer. However, this is exemplary and not limited thereto, and according to embodiments, the encoder network and the decoder network may be configured to include only a convolutional layer.

Here, reconstruction learning is a process of extracting features for various input data, and the encoder network of the autoencoder must extract features by reducing the dimension of input data through a convolutional layer and a fully connected layer. That is, the autoencoder is to learn to extract significant features so that it can be restored as close to the original data as possible with only a small amount of low-dimensional information.

Thereafter, input data is input to the autoencoder to obtain first output data (S220). Here, the first output data may include a latent vector output through the encoder network and reconstructed data for the input data output through the decoder network.

Thereafter, the input data input to the autoencoder and the first output data may be input as input data of a preset anomaly detection learning model ( S230 ).

Here, the preset anomaly detection learning model is a general classification model such as a convolutional neural network (CNN), a probability distribution approximation model such as a Gaussian mixture model and a clustering model, and generation It can be implemented with any one of the adversarial adversarial neural network (GAN) models.

In this case, the anomaly detection learning model may be set according to a selection command by a user input.

Meanwhile, the latent variable may include at least one of a latent variable generated from the encoder network and a latent variable generated through a fully connected layer at the rear end of the encoder network.

Thereafter, based on the output data output by the anomaly detection learning model, an anomaly score may be calculated ( S240 ). Here, the anomaly score may be scored based on the distribution of the latent variable, or may be scored based on the difference between the original data and the data reconstructed through the autoencoder.

Thereafter, it is possible to determine whether the input data input to the autoencoder is abnormal by thresholding the calculated abnormality score ( S250 ). Here, the threshold value for discriminating between normality and abnormality of input data through the calculated abnormality score allows the user to find an optimal threshold and detect abnormality data based on this. For example, the average and standard deviation of restoration errors for normal data may be obtained, and a threshold may be set using the values.

3 is a diagram schematically illustrating the structure of an autoencoder according to an embodiment according to the technical spirit of the present disclosure.

For convenience of explanation, an embodiment of an autoencoder that learns restoration by using an image as input data among various embodiments of the present disclosure will be described below.

Referring to FIG. 3 , the autoencoder 300 includes an encoder network 320 and a decoder network 340 . The autoencoder 300 may input the training data 310 as an input variable to the encoder network 320 .

In this case, the autoencoder 300 may further include a noise mixer 30 at the input end, and the learning data 310 to which noise is added by the noise mixer 30 may be input to the encoder network 320 .

The latent variable 330 corresponding to the characteristic of the original data is extracted through the encoder network 320, and the latent variable 330 extracted by the encoder network 320 through the decoder network 340 based on the extracted latent variable 330 is extracted. Based on the variable 330, it is possible to learn to recover the original data.

In addition, as shown in FIG. 3 , fully connected layers 31 and 32 may be further included at the rear end of the encoder network 320 and the front end of the decoder network 340 , respectively. At this time, the latent variable 330 is the latent variable 330A generated by passing the convolutional layer in the encoder network 320 through the fully connected layer 31 or does not pass through the fully connected layer 31 . It may be a latent variable 330B that has passed only the convolutional layer of the encoder network 320 without

Such an autoencoder 300 may be learned through a large amount of images. At this time, data including large-scale images are reinforced and learned through ImageNet so that the autoencoder can extract various features.

4 is a diagram comparing input and output images of an autoencoder according to an embodiment according to the technical idea of the present disclosure.

4A illustrates that a plurality of noises 41-1 to 41-4 are included in the original image. In general, the autoencoder has the effect of compressing the input data because the number of nodes in the middle hidden layer is smaller than the number of nodes in the input layer. Accordingly, the autoencoder has a tendency to reconstruct the input image in the direction of removing noise included in the input image. Such a restored image is also referred to as a fake image.

FIG. 4B shows a restored image output close to a normal image after being restored in a direction in which noises 41-1 to 41-4 included in the original image are removed.

Therefore, anomaly detection can be effectively performed using the restored image output close to the normal image through the autoencoder, the original image, and the latent variables extracted from the original image. A specific method will be described with reference to FIG. 5 .

5 is a diagram illustrating the structure of an autoencoder-based anomaly detection learning model according to an embodiment according to the technical idea of the present disclosure.

In the embodiment shown in Fig. 5, an anomaly detection learning model using an autoencoder is proposed.

As shown in FIG. 5 , the autoencoder 300 is connected to the subnet 400 , and the final anomaly score 50 may be output from the subnet 400 .

Here, the subnet 400 is a model for determining whether there is an abnormality according to the noise of the original image, and may perform learning for image restoration and characteristic analysis. The subnet 400 may be implemented by selecting any one of a general classification model such as a convolutional neural network, a probability distribution approximation model such as a Gaussian mixture model and a clustering model, and a generative adversarial neural network model according to a user's desired purpose.

For example, a user who wants to focus on image restoration can choose a GAN model, a user who wants to focus on image inspection can choose a classification model, and a user who wants to focus on image feature analysis can choose a probability distribution approximation model. , a model according to the selection can be loaded and utilized.

The shape of the inference result by the subnet may vary depending on the selected subnet.

On the other hand, whether the input image is abnormal, the subnet input the input image 310 and output image 350 input through the autoencoder 300, and the latent variable 330 generated from the autoencoder 300 together can be accepted and judged.

At this time, the latent variable 330 input to the subnet is the latent variable 330A and the fully connected layer 31 generated by passing the value passing through the convolutional layer in the encoder network 320 through the fully connected layer 31 . ) may include all latent variables 330B that have passed only the convolutional layer of the encoder network 320 without passing through.

That is, since a significant latent variable is extracted as much as possible in multi-scale and utilized through a plurality of layers as described above, the utility of the latent variable can be very high.

On the other hand, the user can obtain the restored image 350 in which the original image including noise is converted to be close to the normal image from which the noise has been removed through the autoencoder 300 , and also to the original image through the subnet 400 . Since it is possible to obtain information that can confirm the restored performance as closely as possible, there is an advantage that it can be utilized simultaneously.

6A to 6C are diagrams for explaining a method of classifying a normal image and an abnormal image according to an autoencoder-based anomaly detection learning model according to an embodiment according to the technical spirit of the present disclosure.

Classification is a method of predicting the probability of belonging to each class with respect to a new entity using the learned model after learning a classifier from data labeled which class each entity belongs to. A classification-based anomaly detection technique goes through a similar process. When applying this technique, it is assumed that the classifier can be trained in a given feature space. According to the number of labels in the data, it can be divided into multi-class and one-class.

When a traditional classification model is used as a subnet, as shown in FIG. 6A , a latent variable of a normal image and a latent variable of an abnormal image can be classified through a boundary surface 61 through a discriminant function.

However, if the traditional classification model is to find a boundary that can distinguish two categories, a clustering model that clusters data based on a distribution considers multiple categories and distinguishes sectors of data that are not outliers. can

6B shows that latent variable data of normal images that are not labeled by the probability distribution approximation model are individually clustered (71, 72) based on similarity.

Figure 6c also shows that the latent variable data of the normal image is clustered (81, 82) by the Gaussian mixture model. When a Gaussian mixture model is used, statistical inference about clusters may be possible by assuming multiple distributions, unlike a model that assumes one distribution.

7 is a block diagram schematically illustrating the configuration of an apparatus for detecting anomaly based on an autoencoder according to an embodiment according to the technical spirit of the present disclosure.

The communication unit 710 may receive input data for determining whether there is an abnormality. The communication unit 710 may include a wired/wireless communication unit. When the communication unit 710 includes a wired communication unit, the communication unit 710 is a local area network (LAN), a wide area network (WAN), a value added network (VAN), a mobile communication network ( mobile radio communication network), a satellite communication network, and one or more components that allow communication through a combination thereof. In addition, when the communication unit 710 includes a wireless communication unit, the communication unit 710 wirelessly transmits and receives data or signals using cellular communication, wireless LAN (eg, Wi-Fi), etc. can In an embodiment, the communication unit may transmit/receive data (eg, input data for determining whether an abnormality is present) or a signal with an external device or an external server under the control of the processor 810 .

The input unit 720 may receive various user commands through external manipulation. To this end, the input unit 720 may include or connect one or more input devices. For example, the input unit 720 may be connected to an interface for various inputs, such as a keypad and a mouse, to receive a user command. To this end, the input unit 720 may include an interface such as a Thunderbolt as well as a USB port. Also, the input unit 720 may include or combine various input devices such as a touch screen and a button to receive an external user command.

The memory 730 may store a program for the operation of the processor 740 and may temporarily or permanently store input/output data. The memory 730 may include a flash memory type, a hard disk type, a multimedia card micro type, a card type memory (eg, SD or XD memory, etc.), and a RAM (RAM). , SRAM, ROM, EEPROM, PROM, magnetic memory, a magnetic disk, and an optical disk may include at least one type of storage medium.

In addition, the memory 730 may store various network functions and algorithms, and may store various data, programs (one or more instructions), applications, software, commands, codes, etc. for driving and controlling the device 700 . have.

The processor 740 may control the overall operation of the device 700 . The processor 740 may execute one or more programs stored in the memory 730 . The processor 740 may refer to a central processing unit (CPU), a graphics processing unit (GPU), or a dedicated processor on which methods according to the technical spirit of the present disclosure are performed.

In an embodiment, the processor 740 may control to perform restoration learning on at least one data through an autoencoder in order to detect anomalies.

In an embodiment, the processor 740 may control the autoencoder to additionally perform reconstruction learning on data to which noise is added through a noise mixer.

In one embodiment, the processor 740 inputs the original data to the learned autoencoder, obtains the reconstructed data output therefrom, and the latent variable generated through the encoder network, the original data input to the autoencoder, and the reconstructed data It is possible to control to generate new output data by inputting new input data of a preset anomaly detection learning model to the anomaly detection learning model.

In one embodiment, the processor 740 may calculate an anomaly score based on the output data output by the anomaly detection learning model, and may control the calculated anomaly score to threshold to determine whether the original data is abnormal. have.

In one embodiment, the processor 740 selects, according to user input, any one of a learning model including a convolutional neural network (CNN) model, a Gaussian mixture model, a clustering model, and a generative adversarial neural network (GAN) model. It can be controlled to set as an anomaly detection learning model.

According to various embodiments of the present disclosure as described above, by extracting the latent variable through a plurality of layers, it is possible to generate a robust learning model and increase stability.

In addition, according to various embodiments according to the technical spirit of the present disclosure, among the restored data restored to be as close as possible to the original including the restored data and the defect restored so that the defect is removed from the original data, the restoration data that meets the needs is utilized. Therefore, the applicability of the present anomaly detection method may be broadened.

The anomaly detection method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the present disclosure, or may be known and available to those skilled in the art of computer software. Examples of the computer readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

In addition, the method for detecting anomalies according to the disclosed embodiments may be provided by being included in a computer program product. Computer program products may be traded between sellers and buyers as commodities.

The computer program product may include a S/W program and a computer-readable storage medium in which the S/W program is stored. For example, computer program products may include products (eg, downloadable apps) in the form of S/W programs distributed electronically through manufacturers of electronic devices or electronic markets (eg, Google Play Store, App Store). have. For electronic distribution, at least a portion of the S/W program may be stored in a storage medium or may be temporarily generated. In this case, the storage medium may be a server of a manufacturer, a server of an electronic market, or a storage medium of a relay server temporarily storing a SW program.

The computer program product, in a system consisting of a server and a client device, may include a storage medium of the server or a storage medium of the client device. Alternatively, if there is a third device (eg, a smartphone) that is communicatively connected to the server or client device, the computer program product may include a storage medium of the third device. Alternatively, the computer program product may include the S/W program itself transmitted from the server to the client device or the third device, or transmitted from the third device to the client device.

In this case, one of the server, the client device and the third device may execute the computer program product to perform the method according to the disclosed embodiments. Alternatively, two or more of a server, a client device, and a third device may execute a computer program product to distribute the method according to the disclosed embodiments.

For example, a server (eg, a cloud server or an artificial intelligence server) may execute a computer program product stored in the server to control a client device communicatively connected with the server to perform the method according to the disclosed embodiments.

Although the embodiments have been described in detail above, the scope of the present disclosure is not limited thereto, and various modifications and improvements by those skilled in the art using the basic concept of the present disclosure as defined in the following claims are also included in the scope of the present disclosure. belongs to

Claims (7)

In an anomaly detection method in which each step is performed by an anomaly detection device implemented by a computer,
performing reconstruction learning on at least one data through an autoencoder including an encoder network and a decoder network;
inputting first input data to the autoencoder to obtain first output data - The first output data is a latent vector output through the encoder network and reconstructed data outputted through the decoder network Included - ;
setting at least one of a convolutional neural network (CNN) model, a Gaussian mixture model, a clustering model, and a generative adversarial neural network (GAN) model as an anomaly detection learning model according to a selection command by a user input;
inputting the first input data and the first output data as second input data of the set anomaly detection learning model;
calculating an anomaly score based on second output data output by the anomaly detection learning model; and
Determining whether the first input data is abnormal by thresholding the calculated anomaly score. The method of claim 1,
The step of performing the restoration learning is,
An anomaly detection method that additionally performs reconstruction learning on data to which noise is added through a noise mixer. delete In the anomaly detection device,
a memory storing a program for anomaly detection; and
By executing the program, restoration learning is performed on at least one data through an autoencoder including an encoder network and a decoder network, and first input data is input to the autoencoder to obtain first output data, and a user At least one of a convolutional neural network (CNN) model, a Gaussian mixture model, a clustering model, and a generative adversarial neural network (GAN) model is set as an anomaly detection learning model according to a selection command by an input, and the first input data and the first output data are input as second input data of the anomaly detection learning model, an anomaly score is calculated based on the second output data output by the anomaly detection learning model, and the calculated anomaly score is calculated A processor that controls to determine whether the first input data is abnormal by performing threshold processing;
The first output data includes a latent vector output through the encoder network and reconstructed data output through the decoder network. 5. The method of claim 4,
The processor controls the autoencoder to additionally perform reconstruction learning on data to which noise is added through a noise mixer. delete A computer program stored in a computer-readable recording medium for executing the method of any one of claims 1 and 2 by a computer.

Images