KR102276801B1 - Method and apparatus for processing time series data based on machine learning - Google Patents

Abstract

Provided are a method and a device for identifying at least one data set of a second section unit having a first section as an interval in first time series data, training a sub-model corresponding to each of training data using each of the identified data sets as training data, comparing an output value of the sub-model corresponding to each training data with a first threshold value, and detecting whether there is an abnormality in second time series data received after the training by using the selected sub-model based on a comparison result of the output value of the sub-model and the first threshold value.

Description

Method and apparatus for processing time series data based on machine learning {METHOD AND APPARATUS FOR PROCESSING TIME SERIES DATA BASED ON MACHINE LEARNING}

The present disclosure relates to a machine learning-based time series data processing method and apparatus.

Time series data may be defined as a set of sequentially determined data collected over a certain period of time. Time series data are ordered with respect to time, and there is a correlation between successive data sets. Accordingly, abnormal data included in the time series data may be detected based on the autocorrelation of the time series data or the correlation between a plurality of time series data. For example, anomalous data may be detected using recurrent neural network (RNN) and long short-term mempry (LSTM) deep learning techniques, or future time series data may be predicted based on past time series data.

Prior literature: Korean Patent Registration Publication 10-1940029

On the other hand, in recent high-tech processes, the amount of time-series data generated by the sensor is huge, so it is difficult to manage the sensor data. In addition, when performing in-process anomaly detection based on machine learning, if the model is trained using all time series data due to the bias in the number of data, performance may be deteriorated.

Accordingly, a need exists for a method and apparatus for screening training data and models used to perform anomaly detection.

An object to be solved by this embodiment is to provide a machine learning-based time series data processing method and apparatus for detecting abnormalities in time series data using selected training data and sub-models.

The technical problem to be achieved by the present embodiment is not limited to the technical problems as described above, and other technical problems may be inferred from the following embodiments.

According to a first embodiment, a method for processing machine learning-based time series data includes: identifying at least one data set in units of a second section having a first section as an interval in the first time series data, the identified data Training a sub-model corresponding to each of the training data using each of the sets as training data, comparing an output value of the sub-model corresponding to the respective training data with a first threshold value, and an output value of the sub-model and detecting whether the second time series data received after the learning is abnormal by using a sub-model selected based on the comparison result of the first threshold value.

According to a second embodiment, an apparatus for processing machine learning-based time series data executes a memory storing at least one instruction and the at least one instruction, and in the first time series data, the first section Identifies at least one data set of a second interval unit with an interval of , trains a sub-model corresponding to each of the training data using each of the identified data sets as training data, Comparing the output value of the corresponding sub-model with the first threshold, and using the sub-model selected based on the comparison result of the output value of the sub-model and the first threshold, the second time-series data received after the learning It may include a processor (processor) for detecting whether there is an abnormality.

According to the third embodiment, the computer-readable recording medium is a computer-readable non-transitory recording medium in which a program for executing a method for processing machine learning-based time series data in a computer is recorded, and the machine learning-based time series data The method of processing includes the steps of: identifying at least one data set of a second interval unit having a first interval as an interval in the first time series data, and using each of the identified data sets as training data for each training Learning a submodel corresponding to the data, comparing the output value of the submodel corresponding to the respective training data with a first threshold value, and selecting the submodel based on the comparison result of the output value of the submodel and the first threshold value It may include the step of detecting whether the second time series data received after the learning is abnormal by using the sub-model.

The details of other embodiments are included in the detailed description and drawings.

The machine learning-based time series data processing method and apparatus according to the present disclosure has the effect of reducing the resource usage and time required for anomaly detection by detecting whether there is an abnormality in the time series data using the selected training data and sub-model. .

In addition, since the machine learning-based time series data processing method and apparatus according to the present disclosure selects training data based on a threshold, there is an effect of reducing resource usage while maintaining anomaly detection accuracy.

Effects of the invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description of the claims.

1 is a diagram for explaining time series data according to an embodiment of the present invention.
2 is a diagram for explaining time series data and sub-model output values according to an embodiment of the present invention.
3 is a diagram for explaining an anomaly detection model according to an embodiment of the present invention.
4 is a diagram for explaining a method of performing machine learning-based anomaly detection according to an embodiment of the present invention.
5 and 6 are diagrams for explaining a method of identifying a type of time series data and a data set according to an embodiment of the present invention.
7 is a diagram for explaining an anomaly detection result using training data selected according to a time series data processing method according to an embodiment of the present invention.
8 is a flowchart illustrating a machine learning-based time series data processing method according to an embodiment.
9 is a block diagram illustrating an apparatus for processing time series data based on machine learning according to an embodiment.

The terms used in the embodiments are selected as currently widely used general terms as possible while considering the functions in the present disclosure, but may vary depending on the intention or precedent of a person skilled in the art, the emergence of new technology, and the like. In addition, in a specific case, there is a term arbitrarily selected by the applicant, and in this case, the meaning will be described in detail in the corresponding description. Therefore, the terms used in the present disclosure should be defined based on the meaning of the term and the contents of the present disclosure, rather than the simple name of the term.

When a part "includes" a certain element throughout the specification, this means that other elements may be further included, rather than excluding other elements, unless otherwise stated.

The expression "at least one of a, b, and c" described throughout the specification means 'a alone', 'b alone', 'c alone', 'a and b', 'a and c', 'b and c ', or 'all of a, b, and c'.

The time series data described throughout the specification may be defined as a sequence of data arranged at regular time intervals. Accordingly, a set of values observed sequentially in time may also be defined as time series data. On the other hand, time series data is time-dependent data, and data generated at time t may be affected by data at time t-1. For example, the time series data may include sensor data that may be received from various sensors, including temperature, stock price, exchange rate, and sea level observation data. On the other hand, the sensor data may be specifically received from a thickness sensor, a speed sensor, an acceleration sensor, a vibration sensor, a force sensor, a pressure sensor, a position sensor, a plasma intensity sensor, a temperature sensor, a pH sensor, a chemical composition sensor, and a chemical concentration sensor. data, but is not limited thereto.

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art to which the present disclosure pertains can easily implement them. However, the present disclosure may be implemented in several different forms and is not limited to the embodiments described herein.

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings.

1 is a diagram for explaining time series data according to an embodiment of the present invention.

The time series data 100 according to an embodiment of the present invention may be time series data obtained in a semiconductor process. For example, the time series data 100 may be time series data indicating the strength of a pump for controlling pressure in the cleaning process over time. Since a vacuum state must be maintained in order to effectively use plasma in a semiconductor process, the intensity of the pump for pressure control can be continuously sensed. In this case, the pressure leakage may be defined as an abnormal state in the process, and the method of the present disclosure collects the time series data 100 shown in FIG. 1 every time the corresponding process is performed at different times, and the collected time series Based on the data, it is possible to detect if there is a pressure leak in the process.

On the other hand, when the time series data 100 is data indicating the strength of the pump for controlling the pressure in the cleaning process over time, the time series data 100 is the process preparation step (A) for creating a vacuum state, the cleaning operation taking place Data for the main process step (B) and the process finishing step (C) of releasing the vacuum may be included.

Machine learning can be utilized to detect process anomalies based on such time series data. However, when machine learning is performed using all sections of time series data as training data, the probability of generating a model biased by learning may increase because there is too much data on the main process step (B). When a biased model is used, anomaly detection rate may be reduced. In addition, when machine learning is performed using all data as training data, since there are too many attributes included in the data, it may be difficult to perform learning on all attributes, and thus anomaly detection performance is lowered can be Therefore, a method of selecting a data set capable of improving anomaly detection rate among time series data and a method of using only the selected data set as training data are required.

2 is a diagram for explaining time series data and sub-model output values according to an embodiment of the present invention.

(a) of FIG. 2 is a graph listing output values of sub-models learned by using the identified data set as training data after identifying a plurality of data sets from the time series data 100 of FIG. ) is displayed by overlapping the graph of FIG. 1 after increasing the time scale of the graph of FIG. 2 (a) to match the graph of FIG. 1 . For example, in FIG. 1 , in an example of outputting one data at a time of “1”, there are a total of 1000 data. Here, after dividing the time series data 100 of FIG. 1 into a total of 200, each is trained If 200 sub-models are trained as data, 200 output values can be obtained from 200 sub-models, and the graph shown in FIG. 2 (a) can be calculated by listing 200 output values. Meanwhile, since the time series data 100 of FIG. 1 includes 1000 pieces of data, dividing the time series data 100 of FIG. 1 into a total of 200 has the same meaning as dividing the time series data 100 into 5 pieces.

On the other hand, a large output value of the sub-model shown in FIG. 2A means that a large amount of information for detecting anomalies is included in the data set corresponding to the output value. In other words, if the output value of the sub-model shown in FIG. 2A is large, an anomaly detection rate using a data set corresponding to the training data used to learn the sub-model may also be improved.

Referring to (a) of FIG. 2 , it can be confirmed that the output value of the sub-model initially showed a peak shape, and then steadily increased thereafter.

Meanwhile, referring to FIG. 2B , a data set in the time series data used to derive the output value of the submodel shown in FIG. 2A can be confirmed. For example, the x value of the first point 210 having the largest value among the output values of the sub-model shown in FIG. 2A may be 4. If time series data composed of 1000 data is divided into 200 pieces of 5 each without overlapping and these are used as training data, the output value of the first point 210 is composed of the 16th to 20th data of the time series data composed of 1000 data. It may be an output value of a sub-model using five data as training data.

In this case, the first graph 220 shown in FIG. 2B may be the same as the graph shown in FIG. 2A is stretched 5 times on the x-axis. This is because the 1000 time series data shown in FIG. 1 was divided into 5 pieces and used as training data.

Referring to FIG. 2 ( b ), when performing machine learning using the last part of the process preparation step (A in FIG. 1 ) and the main process step (B in FIG. 1 ), process abnormalities (eg, It can be seen that the detection rate for pressure leakage) can be high. Accordingly, the method of the present disclosure trains a sub-model using the corresponding data set as training data among a plurality of data sets in time series data, and detects anomalies using only sub-models in which the output value of the learned model is greater than or equal to a predetermined threshold. can In this case, compared to the case where all data of time series data is utilized, the amount of computation and data storage space can be reduced, and the anomaly detection rate can be improved.

Meanwhile, according to an embodiment, the graph shown in (a) of FIG. 2 may be defined as an output value of an individual ensemble model. Here, the ensemble model refers to a learning model capable of improving the prediction rate by generating several sub-models and calculating one prediction value in consideration of the output values of each sub-model. Specific details of the ensemble model will be described with reference to FIG. 3 .

3 is a diagram for explaining an anomaly detection model according to an embodiment of the present invention.

The method according to an embodiment of the present disclosure may train a submodel of the ensemble model by using different sections of time series data as training data, respectively. In this case, the ensemble model may be a decision tree ensemble model.

For example, when the time series data 100 shown in FIG. 1 is divided into 5 data units and each of the divided time series data is used as training data, the number of training data and the number of sub-models of FIG. 3 are each 200 can be a dog As the number of divisions increases, the number of data and the number of sub-models may increase, and the length of each divided training data may decrease. The length of the training data and the number of sub-models may vary depending on the implementation of the anomaly detection system.

The method of the present disclosure may perform anomaly detection using only a submodel having an output value greater than or equal to a threshold value among each submodel. In this case, the threshold value may vary depending on the implementation of the anomaly detection system, and may be determined by a user input.

On the other hand, specific details of decision tree ensemble learning among ensemble learning will be described with reference to FIG. 4 .

4 is a diagram for explaining a method of performing machine learning-based anomaly detection according to an embodiment of the present invention.

The method of performing machine learning-based anomaly detection according to an embodiment may output an anomaly detection result using decision tree ensemble learning.

Decision tree ensemble learning is an example of a machine learning technique, and it is possible to predict the correct answer after branching into a tree shape by classifying each feature as a condition. On the other hand, predicting the correct answer with only one tree may have low accuracy. Accordingly, an ensemble combining several trees may be applied.

Meanwhile, the decision tree ensemble learning method may be classified into bagging and boosting. Here, bagging creates several classifiers (sub-models) and collects the output values of the classifiers and selects the final result with the highest accuracy output value. Boosting can be viewed as a technique to continuously improve performance with one tree. A random forest algorithm is well known as a bagging algorithm, and a gradient boosting algorithm is well known as a boosting algorithm.

Meanwhile, in the method of the present disclosure, in order to shorten the algorithm execution time, decision tree ensemble learning such as eXtra Gradient Boost (XGBoost) and LightGBM may be performed.

5 and 6 are diagrams for explaining a method of identifying a type of time series data and a data set according to an embodiment of the present invention.

The time series data according to an embodiment may be univariate time series data or multivariate time series data. Here, the univariate time series data means data in which one variable is included in the time series data, and the multivariate time series data means data in which two or more variables are included in the time series data. The method of the present disclosure may perform machine learning using not only univariate time series data but also a data set identified from multivariate time series data as training data.

5 (a) and (b) are examples of univariate time series data, and FIGS. 6 (a) and (b) are examples of multivariate time series data.

On the other hand, the method of the present disclosure may identify at least one data set in units of the second section in which the first section is the interval of the time series data. The highlighted first data set 510 of FIG. 5A is the data set of the second section unit, and the data set identified after the first data set 510 is the second data set shown in FIG. 5B. In the case of the data set 520 , the first interval may be two data intervals, and the second interval may be three data intervals. In this case, each of the identified data sets 510 and 520 may be used as training data.

When the total number of data is N and multivariate time series data with v variables are analyzed, and the number of identified data sets is three, three submodels can be generated. In this case, N data having a size of 3v corresponding to the first identified data set among the three identified data sets may be used as training data of the first sub-model, and N data corresponding to the next identified data set can be used as training data for the second sub-model. In addition, N data of the last identified data set can be used as training data of the last sub-model. On the other hand, the multivariate time series data shown in FIGS. 6A and 6B is multivariate time series data with 9 total data and 5 variables.

Referring to FIGS. 5A and 5B , the data sets 510 and 520 identified by the method of the present disclosure may overlap each other. Also, referring to FIGS. 6A and 6B , the data sets 610 and 620 identified by the method of the present disclosure may not overlap each other. Whether or not the identified data sets overlap may depend on the implementation of the anomaly detection system.

7 is a diagram for explaining an anomaly detection result using training data selected according to a time series data processing method according to an embodiment of the present invention.

The method of the present disclosure may perform anomaly detection based on one of decision tree ensemble learning, random forest ensemble learning, and XGBoost ensemble learning. 7 is a diagram illustrating prediction performance according to a threshold value when anomaly detection is performed based on decision tree ensemble learning, random forest ensemble learning, and XGBoost ensemble learning, respectively.

Referring to FIG. 7 , when an anomaly detection model composed of only sub-models having an output value of 0.7 or more performs machine learning based on decision tree ensemble learning, the prediction accuracy may be 92.35%. In addition, when the anomaly detection model composed of only sub-models having an output value of 0.8 or more performs machine learning based on random forest ensemble learning, the prediction accuracy may be 94.85%.

Meanwhile, referring to FIG. 7 , the performance of a model in which machine learning is performed using all time series data as training data may be lower than the performance of a model in which machine learning is performed using some time series data as training data. For example, when decision tree ensemble learning is performed, the prediction accuracy of the anomaly detection model is 93.6% when all time series data are used as training data, but the prediction accuracy of the anomaly detection model is 93.6% when only sub-models with an output value of 0.9 or higher are used. 95.78%, which is higher.

On the other hand, it may be difficult to perform learning on all the properties because using all the data of the time series data has too many properties compared to the number of data. On the other hand, if the number of data decreases, the properties of the data also decrease, so it may be relatively easy to learn the properties in the reduced data. Accordingly, when the identified data set among time series data is used as training data, prediction accuracy may be further improved.

Specifically, the performance shown in FIG. 7 was calculated using 1000-dimensional data, that is, time series data composed of 1000 pieces of data, and there were only three sub-models having a threshold value of 0.9 or higher. Since one training data input to one sub-model consists of five data, it can be seen that the anomaly detection model consisting only of sub-models with a threshold value of 0.9 or higher was trained using a total of 15 data. According to the experimental results, the method of the present disclosure has an effect of improving the performance of an anomaly detection model while reducing the number of training data used for learning.

8 is a flowchart illustrating a machine learning-based time series data processing method according to an embodiment.

In operation S810 , from the first time series data, at least one data set in units of a second section having the first section as an interval may be identified.

In step S820 , each of the identified data sets may be used as training data to train a sub-model corresponding to each training data.

In step S830, an output value of the sub-model corresponding to each training data may be compared with a first threshold value.

In operation S840, it is possible to detect whether the second time series data received after learning is abnormal by using the sub-model selected based on the comparison result of the output value of the sub-model and the first threshold value. In this case, selecting the sub-model based on the comparison result between the output value of the sub-model and the first threshold value may be selecting a sub-model having an output value equal to or greater than the first threshold value. Meanwhile, the first threshold value may be a preset value.

Meanwhile, detecting whether the second time series data is abnormal in step S840 may be detecting whether the second time series data is abnormal using a decision tree ensemble model.

On the other hand, in the method of the present disclosure, when selecting a sub model based on the comparison result of the output value of the sub model and the first threshold value is selecting a sub model having an output value equal to or higher than the first threshold value, the first threshold value or higher Detecting a partial region of the first time series data based on the submodel having an output value and training data corresponding to the output value, and storing information about the detected partial region of the first time series data as important information of the first time series data. may include more. Here, the important information of the first time series data may be prioritized according to an output value of a submodel corresponding to a partial region of the detected first time series data.

Meanwhile, the length of the first section may be the same as or shorter than the length of the second section. In addition, at least one of the first threshold value, the length of the first section, and the length of the second section may be determined based on a user input.

Meanwhile, the first time series data may be multivariate time series data. In addition, the second time series data may be time series data including at least one of the variables included in the first time series data.

9 is a block diagram illustrating an apparatus for processing time series data based on machine learning according to an embodiment.

The machine learning-based time series data processing apparatus 900 may include a memory 910 and a processor 920 , according to an embodiment. In the machine learning-based time series data processing apparatus 900 shown in FIG. 9, only the components related to the present embodiment are shown. Accordingly, it can be understood by those of ordinary skill in the art related to the present embodiment that other general-purpose components may be further included in addition to the components shown in FIG. 9 .

The memory 910 is hardware for storing various data processed in the machine learning-based time series data processing apparatus 900 , and for example, the memory 910 is data processed by the machine learning-based time series data processing apparatus 900 . and data to be processed. The memory 910 may store at least one instruction for an operation of the processor 920 . Also, the memory 910 may store a program or an application to be driven by the machine learning-based time series data processing apparatus 900 . The memory 910 includes random access memory (RAM), such as dynamic random access memory (DRAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), CD- It may include ROM, Blu-ray or other optical disk storage, a hard disk drive (HDD), a solid state drive (SSD), or flash memory.

The processor 920 may control the overall operation of the machine learning-based time series data processing apparatus 900 and process data and signals. The processor 920 may generally control the machine learning-based time series data processing apparatus 900 by executing at least one instruction or at least one program stored in the memory 910 . The processor 920 may be implemented as a central processing unit (CPU), a graphics processing unit (GPU), an application processor (AP), or the like, but is not limited thereto.

In the first time series data, the processor 920 identifies at least one data set of a unit of a second section having the first section as an interval, and uses each of the identified data sets as training data corresponding to the respective training data. Train the sub-model, compare the output value of the sub-model corresponding to each training data with the first threshold, and learn by using the sub-model selected based on the comparison result between the output value of the sub-model and the first threshold Whether the second time series data received thereafter is abnormal may be detected. In this case, selecting the sub-model based on the comparison result between the output value of the sub-model and the first threshold value may be selecting a sub-model having an output value equal to or greater than the first threshold value.

In addition, when selecting a sub-model based on the comparison result between the output value of the sub-model and the first threshold value is to select a sub-model having an output value equal to or greater than the first threshold value, the processor 920 is configured to be equal to or greater than the first threshold A partial region of the first time series data may be detected based on the training data corresponding to the submodel having the output value, and information about the detected partial region of the first time series data may be stored as important information of the first time series data. Here, the important information of the first time series data may be prioritized according to an output value of a submodel corresponding to a partial region of the detected first time series data.

Meanwhile, the length of the first section may be the same as or shorter than the length of the second section. In addition, at least one of the first threshold value, the length of the first section, and the length of the second section may be determined based on a user input.

When the processor 920 detects whether the second time series data is abnormal, it may be to detect whether the second time series data is abnormal using a decision tree ensemble model.

Meanwhile, the first time series data may be multivariate time series data. In addition, the second time series data may be time series data including at least one of the variables included in the first time series data.

The processor according to the above-described embodiments includes a processor, a memory for storing and executing program data, a permanent storage such as a disk drive, a communication port for communicating with an external device, a touch panel, a key, a button, etc. It may include the same user interface device and the like. Methods implemented as software modules or algorithms may be stored on a computer-readable recording medium as computer-readable codes or program instructions executable on the processor. Here, the computer-readable recording medium includes a magnetic storage medium (eg, read-only memory (ROM), random-access memory (RAM), floppy disk, hard disk, etc.) and an optically readable medium (eg, CD-ROM). ), and DVD (Digital Versatile Disc)). The computer-readable recording medium is distributed among computer systems connected through a network, so that the computer-readable code can be stored and executed in a distributed manner. The medium may be readable by a computer, stored in a memory, and executed on a processor.

This embodiment may be represented by functional block configurations and various processing steps. These functional blocks may be implemented in any number of hardware and/or software configurations that perform specific functions. For example, an embodiment may be an integrated circuit configuration, such as memory, processing, logic, look-up table, etc., capable of executing various functions by means of control of one or more microprocessors or other control devices. can be hired Similar to how components may be implemented as software programming or software components, this embodiment includes various algorithms implemented in combination of data structures, processes, routines or other programming constructs, including Python, C , C++, Java, assembler, etc. may be implemented in a programming or scripting language. Functional aspects may be implemented in an algorithm running on one or more processors. In addition, the present embodiment may employ the prior art for electronic environment setting, signal processing, and/or data processing, and the like. Terms such as “mechanism”, “element”, “means” and “configuration” may be used broadly and are not limited to mechanical and physical configurations. The term may include the meaning of a series of routines of software in association with a processor or the like.

The above-described embodiments are merely examples, and other embodiments may be implemented within the scope of the claims to be described later.

Claims (11)

In the machine learning-based time series data processing method performed by the machine learning-based time series data processing device,
identifying at least one data set in units of a second section having the first section as an interval from the first time series data;
using each of the identified data sets as training data to train a sub-model corresponding to each of the training data;
comparing an output value of a sub-model corresponding to each of the training data with a first threshold value; and
Using a sub-model selected based on the comparison result of the output value of the sub-model and the first threshold, detecting whether the second time series data received after the learning is abnormal,
The length of the first section is equal to or shorter than the length of the second section, and the length of the first section is relatively in relation to the length of the second section in consideration of the performance of the machine learning-based time series data processing apparatus. is decided,
The length of the second section, which is determined in consideration of the performance of the machine learning-based time series data processing apparatus, decreases when the number of the identified data sets increases,
A method for processing time series data based on machine learning. According to claim 1,
The selection of the sub-model based on the comparison result of the output value of the sub-model and the first threshold value is a machine learning-based time series data processing method in which the sub-model having an output value equal to or greater than the first threshold value is selected. 3. The method of claim 2,
detecting a partial region of the first time series data based on training data corresponding to a submodel having an output value equal to or greater than the first threshold value; and
Further comprising the step of storing information on a partial region of the detected first time series data as important information of the first time series data, machine learning-based time series data processing method. 4. The method of claim 3,
Important information of the first time series data is
The priority is determined according to the output value of the sub-model corresponding to the partial region of the detected first time series data, a machine learning-based time series data processing method. delete According to claim 1,
At least one of the first threshold value, the length of the first section, and the length of the second section is determined based on a user input, a machine learning-based time series data processing method. According to claim 1,
The step of detecting whether the second time series data is abnormal
Detecting whether the second time series data is abnormal using a decision tree ensemble model, a machine learning-based time series data processing method. According to claim 1,
The first time series data is multivariate time series data, a machine learning-based time series data processing method. 9. The method of claim 8,
The second time series data is time series data including at least one of the variables included in the first time series data, a machine learning-based time series data processing method. a memory for storing at least one instruction; and
By executing the at least one command,
In the first time series data, at least one data set of a unit of a second section having the first section as an interval is identified,
Training a sub-model corresponding to each of the training data using each of the identified data sets as training data,
Comparing the output value of the sub-model corresponding to the respective training data with a first threshold,
Using a sub-model selected based on the comparison result of the output value of the sub-model and the first threshold, including a processor for detecting whether the second time-series data received after the learning is abnormal,
The length of the first section is equal to or shorter than the length of the second section, and the length of the first section is relatively determined in relation to the length of the second section in consideration of the performance of the machine learning-based time series data processing apparatus. become,
The length of the second section, which is determined in consideration of the performance of the machine learning-based time series data processing apparatus, decreases when the number of the identified data sets increases,
Machine learning-based time series data processing unit. A computer-readable non-transitory recording medium recording a program for executing a machine learning-based time series data processing method in a computer, the method comprising:
identifying at least one data set in units of a second section having the first section as an interval from the first time series data;
using each of the identified data sets as training data to train a sub-model corresponding to each of the training data;
comparing an output value of a sub-model corresponding to each of the training data with a first threshold value; and
Using a sub-model selected based on the comparison result of the output value of the sub-model and the first threshold, detecting whether the second time series data received after the learning is abnormal,
The length of the first section is equal to or shorter than the length of the second section, and the length of the first section is relatively in relation to the length of the second section in consideration of the performance of the machine learning-based time series data processing apparatus. is decided,
The length of the second section, which is determined in consideration of the performance of the machine learning-based time series data processing apparatus, decreases when the number of the identified data sets increases,
Non-transitory recording medium.

Images