KR102383675B1 - Anomaly detection system of time-series data - Google Patents

Abstract

A time series data anomaly diagnosis system is disclosed. a time series data input module for receiving time series data; a second domain transformation module for performing domain transformation on the time series data received from the time series data input module; an abnormality diagnosis model storage module in which an abnormality diagnosis model for the time series data is stored in advance; An abnormality diagnosis operation module for outputting abnormality by performing an abnormality diagnosis operation on the transformed domain data generated in the second domain transformation module by using the abnormality diagnosis model previously stored in the abnormality diagnosis model storage module is configured. According to the time series data anomaly diagnosis system described above, by configuring time series data to diagnose abnormalities in the manufacturing process after domain transformation and feature extraction, the data characteristic analysis process in the time domain is more easily performed in the transformation domain, so that various It is effective in facilitating abnormal diagnosis and increasing the accuracy of abnormal diagnosis.

Description

Time-series data anomaly diagnosis system {ANOMALY DETECTION SYSTEM OF TIME-SERIES DATA}

the present invention It relates to a time series data anomaly diagnosis system, and specifically, a system for diagnosing anomalies of time series data having values according to time flow, such as temperature, humidity, pressure, speed, flow rate, brightness, network packet amount, and number of connected users , and more specifically, to a system for diagnosing abnormal states of time series data by generating unsupervised learning models based on univariate and multivariate time series data and supervised learning models based on multivariate data.

The technology to analyze time series data with values according to time is used to diagnose process defects or product abnormalities due to processes through sensor data such as temperature, humidity, pressure, speed, flow rate, etc. in the manufacturing process including the semiconductor process, or In the field, intrusion diagnosis or system overload can be diagnosed through the amount of network packets and the number of connected users. In addition, it can be applied as a method of diagnosing an abnormal state compared to normal in daily life such as weather forecasting. That is, the technology for diagnosing and analyzing time series data can be applied to various fields.

As a general method of diagnosing abnormal state data, as shown in FIG. 1, statistical process control (Statistical Process Control) that sets upper and lower control limits (Upper, Lower Control Limit) of time series data and determines a state that exceeds it as an abnormal state is being used

Statistical quality control is a method commonly used in manufacturing sites, but as the process is advanced, it is becoming insufficient to determine normality and abnormality of process data using upper/lower limit control lines.

Therefore, there is an attempt to narrow the upper/lower limit range by setting multiple upper/lower limit management lines according to conditions as shown in FIG. 2 and apply them adaptively, but there is a disadvantage in that the system becomes complicated due to too many condition settings.

The method of FIG. 2 inevitably has limitations in a process in which quality control is difficult, such as a semiconductor process.

Registered Patent Publication No. 10-0980603 Laid-open Patent Publication 10-2009-0006437

An object of the present invention is to provide a time series data anomaly diagnosis system.

A time series data abnormality diagnosis system according to the above object of the present invention includes: a time series data input module for receiving time series data; a second domain transformation module for performing domain transformation on the time series data received from the time series data input module; an abnormality diagnosis model storage module in which an abnormality diagnosis model for the time series data is stored in advance; It may be configured to include an abnormality diagnosis operation module for outputting abnormality by performing an abnormality diagnosis operation on the transformation domain data generated by the second domain transformation module using the abnormality diagnosis model stored in advance in the abnormality diagnosis model storage module there is.

Here, the second domain transform module may be configured to domain transform by performing a Fourier transform or a wavelet transform on the time series data input from the time series data input module.

In addition, the abnormal diagnosis model storage module may be configured to store an abnormality diagnosis model using supervised learning or unsupervised learning.

According to the time series data anomaly diagnosis system described above, by configuring time series data to diagnose abnormalities in the manufacturing process after domain transformation and feature extraction, the data characteristic analysis process in the time domain is more easily performed in the transformation domain, so that various It is effective in facilitating abnormal diagnosis and increasing the accuracy of abnormal diagnosis.

In particular, by using both univariate analysis and multivariate analysis in diagnosing anomalies, there is an effect of improving the diagnostic accuracy associated with the process.

In addition, since it is configured to generate an abnormal diagnosis model using unsupervised learning and supervised learning alone or in parallel, there is an effect that an abnormal diagnosis model can be generated even if there is no failure or abnormal state data during learning.

More specifically, a feature that reflects the waveform characteristics of time series data before and after domain transformation of time series data is extracted, and based on this, a univariate diagnostic model of an unsupervised learning method and a diagnostic model of a multivariate-based unsupervised learning method are generated. It has the effect of improving accuracy by comprehensively diagnosing failures or abnormalities by creating a multivariate correlation model of a supervised learning method by adding dependent variables.

Therefore, when only independent variables such as bearing failure diagnosis exist, univariate and multivariate diagnostic models can be used. can have an effect.

1 and 2 are exemplary diagrams of an abnormality diagnosis graph of time series data using upper/lower limit management lines.
3 is an exemplary diagram of an abnormality diagnosis graph using domain transformation of time series data.
4 is a block diagram illustrating a process of generating/updating an abnormality diagnosis model, storing it, and performing an abnormality diagnosis operation using the stored model according to an embodiment of the present invention.
5 is a block diagram for performing discrete diagnosis using unsupervised learning and supervised learning on univariate and multivariate variables according to an embodiment of the present invention.
6 is a schematic diagram of a wavelet transform according to an embodiment of the present invention.
7 is a table showing a data generation process for generating a feature vector of a univariate variable and clustering in an unsupervised learning method according to an embodiment of the present invention.
8 is a schematic diagram illustrating a process of finding abnormal data in an unsupervised learning-based cluster according to an embodiment of the present invention.
9 is a schematic diagram for determining whether an abnormal state exists by comparing variable characteristics versus cluster characteristics based on unsupervised learning according to an embodiment of the present invention.
10 is a table showing a data generation process for multivariate clustering in an unsupervised learning method according to an embodiment of the present invention.
11 is a table showing a data generation process of a supervised learning method according to an embodiment of the present invention.
12 is a schematic diagram illustrating the modeling and abnormality diagnosis process according to an embodiment of the present invention from a data dimension point of view.
13 is a schematic diagram illustrating a process of learning and evaluating a diagnostic model, and a process of updating the diagnostic model according to an embodiment of the present invention.
14 is a schematic diagram illustrating a process of generating a normal cluster by generating similar data when the number of normal data is small according to an embodiment of the present invention.
15 is a schematic diagram illustrating a result of generating similar data of a small number of normal data according to an embodiment of the present invention.
16 is a schematic diagram illustrating a learning process of normal data and a classification process and results when normal and abnormal data are mixed according to an embodiment of the present invention.

Since the present invention can have various changes and can have various embodiments, specific embodiments are illustrated in the drawings and will be described in detail in the detailed content for carrying out the invention. However, this is not intended to limit the present invention to specific embodiments, and it should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention. In describing each figure, like reference numerals have been used for like elements.

Terms such as first, second, A, and B may be used to describe various elements, but the elements should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, a first component may be referred to as a second component, and similarly, a second component may also be referred to as a first component. and/or includes a combination of a plurality of related listed items or any of a plurality of related listed items.

When an element is referred to as being “connected” or “connected” to another element, it is understood that it may be directly connected or connected to the other element, but other elements may exist in between. it should be On the other hand, when it is said that a certain element is "directly connected" or "directly connected" to another element, it should be understood that the other element does not exist in the middle.

The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present application, terms such as “comprise” or “have” are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, but one or more other features It should be understood that this does not preclude the existence or addition of numbers, steps, operations, components, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical and scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related art, and should not be interpreted in an ideal or excessively formal meaning unless explicitly defined in the present application. does not

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

3 is an exemplary diagram of an abnormality diagnosis graph using domain transformation of time-series data, and FIG. 4 is an abnormality diagnosis operation generated/updated and stored, and an abnormality diagnosis operation is performed using the stored model according to an embodiment of the present invention. It is a block diagram showing the process to be performed. 5 is a block diagram for performing discrete diagnosis using unsupervised learning and supervised learning on univariate and multivariate variables according to an embodiment of the present invention, and FIG. 6 is a wavelet according to an embodiment of the present invention. 7 is a table showing a data generation process for generating feature vectors of univariate variables and clustering in an unsupervised learning method according to an embodiment of the present invention, and FIG. 8 is an embodiment of the present invention. It is a schematic diagram showing the process of finding abnormal data in an unsupervised learning-based cluster according to , FIG. 10 is a table illustrating a data generation process for multivariate clustering in an unsupervised learning method according to an embodiment of the present invention, and FIG. 11 is a table illustrating a data generation process in a supervised learning method according to an embodiment of the present invention. and FIG. 12 is a schematic diagram expressing the modeling and abnormality diagnosis process according to an embodiment of the present invention from a data dimension point of view. 13 is a schematic diagram illustrating a process for learning a diagnostic model, a process for evaluating a diagnostic model, and a process for updating a diagnostic model according to an embodiment of the present invention, and FIG. Fig. 15 is a schematic diagram showing a process of generating a normal cluster by generating similar data at the time of writing, Fig. 15 is a schematic diagram showing the result of generating similar data of normal data with a small number according to an embodiment of the present invention, Fig. 16 is the present invention It is a schematic diagram showing the learning process of normal data and the classification process and results when normal and abnormal data are mixed according to an embodiment of

First, referring to FIG. 3 , the time-series data anomaly diagnosis system according to the present invention is configured to perform an abnormality diagnosis by domain-converting time-series data and extracting features. As the domain transform, a Fourier transform or a wavelet transform may be mainly used.

The domain conversion technique can be mainly used for diagnosing an abnormality in a system having a specific frequency, such as diagnosing a bearing abnormality. When a vibration that is not in a steady state occurs, the basis coefficient value in the converted domain changes, which can be detected and diagnosed.

For example, a new vibration in the Fourier domain causes a new frequency as shown in FIG. 3 , and an abnormal vibration can be identified by sensing it.

The abnormality diagnosis method through feature extraction in this transformation domain has the advantage of being able to better reflect the shape of the original signal than the abnormality diagnosis method based on the multiple upper/lower limit management lines of FIG. 2 .

4 , the time series data abnormality diagnosis system according to an embodiment of the present invention includes a time series data input module 100 , a data storage module for learning 200 , a first domain transformation module 300 , and a first feature extraction module 400 , abnormal diagnosis model generation/update module 500 , abnormal diagnosis model storage module 600 , second domain conversion module 700 , second feature extraction module 800 , abnormal diagnosis operation module 900 , It may be configured to include a dependent variable data input module 1000 .

Hereinafter, a detailed configuration will be described.

The time series data input module 100 may be configured to receive time series data. The time series data input module 100 may be configured to collect real-time time series data of a manufacturing process or IT field through a sensor or a network device, or to receive a file stored in advance in a file system.

The learning data storage module 200 may be configured to store time series data input from the time series data input module 100 and time series data used for generation or update in the abnormal diagnosis model generation/update module 500 .

The learning data storage module 200 is a configuration in which a data set for unsupervised learning or supervised learning is stored, and the learning data may be stored by dividing the number of data based on time or event, and unsupervised learning Alternatively, during supervised learning, the divided data may be combined and used as learning data.

Here, the learning data storage module 200 may be configured to include a new data storage unit 201 and an existing data storage unit 202 .

The new data storage unit 201 may be configured to store the time series data input from the time series data input module 100 as new learning data.

The existing data storage unit 202 may be configured such that time series data used in the abnormal diagnosis model generation/update module 500 is stored as data for next learning.

For example, during training, a new learning model can be continuously created and updated using a ratio of 70% of new training data that has not been used in the previous training model and 30% of the existing training data used in the previous training model. Reusing the existing training data at a certain rate is to prevent the training model from changing rapidly.

The ratio of new data to existing data may be variable. When the accuracy of abnormal diagnosis is sharply lowered, feedback control can be performed to further increase the ratio of new learning data, and when the accuracy of abnormal diagnosis is gradually decreased, It is also possible to control the feedback to slowly increase the ratio of the existing training data. That is, it may be configured to optimize the accuracy of the abnormal diagnosis model in real time according to the process.

The first domain transformation module 300 may be configured to domain-transform time series data input from the learning data storage module to generate domain-transformed data.

The first domain transform module 300 may be configured to transform time series data into corresponding domain data using a domain transform technique such as a Fourier transform or a wavelet transform.

6 shows a wavelet transform. As shown in FIG. 6 , the time series data after the transformation process is composed of an Approximation coefficient and a Detail coefficient. These coefficient values include not only the average trend and shape of the original signal but also detailed change information. This conversion has the same effect as passing the original signal through a low pass filter and a high pass filter, respectively.

The first feature extraction module 400 extracts features from the raw time series data stored in the learning data storage module 200 or reduces the dimension of the domain-transformed data generated by the first domain transformation module 300, and the dimension-reduced data can be configured to generate a feature vector from Since the number of domain-transformed data as well as raw data is still large and has a negative effect on learning, a method to reduce the number of data is required. should be

In some research papers, time series data itself or domain-converted coefficients are abbreviated and converted into statistical summary values or indicators expressing signal shapes such as Kurtosis, Skewness, RMS, Crest Factor, Clearance Indicator, Shape Indicator, and Impulse Indicator, and then convert them to feature values. It is started to learn machine learning. However, the criteria for determining the number of these indicators are ambiguous and the signal resilience is also low. That is, it means that the characteristics of the raw signal are not well reflected.

However, when the dimension of the raw data is reduced based on the explanatory power given in advance and the original data is restored, the raw time series data may be restored to the level of the explanatory power initially set.

Principal component analysis (PCA), linear discriminant analysis (LDA), non-negative matrix factorization (NMF), or the like may be used for dimensionality reduction of data.

7 is a schematic diagram illustrating a process of generating a feature vector from observations of a univariate variable after dimensionality reduction. An example of using the observed univariate variable after dimensionality reduction as a feature vector is to dimensionally reduce the domain-transformed observation data generated by the first domain transformation module 300 through PCA, and use the dimensionally-reduced PCA score vector for each observation as a feature vector. can be used as

The abnormality diagnosis model generation/update module 500 may be configured to generate or update an abnormality diagnosis model by using the feature vector generated by the first feature extraction module 400 .

The abnormal diagnosis model creation/update module 500 may be configured to generate an abnormality diagnosis model by unsupervised learning or supervised learning and to update a previous abnormal diagnosis model.

Here, the abnormal diagnosis model generation/update module 500 may be configured to include an unsupervised learning modeling unit 500a, a supervised learning modeling unit 500b, and an ensemble modeling unit 500c. Hereinafter, a detailed configuration will be described.

The unsupervised learning modeling unit 500a may be configured to generate or update an abnormality diagnosis model using unsupervised learning.

As shown in FIG. 5 , the unsupervised learning modeling unit 500a may be configured to include a first cluster modeling unit 501 , a multivariate feature extraction unit 502 , and a second cluster modeling unit 503 .

The supervised learning modeling unit 500b may be configured to generate or update an abnormality diagnosis model using supervised learning.

The supervised learning modeling unit 500b may be configured to include a main variable selection unit 504 and a correlation modeling unit 505 as shown in FIG. 5 .

The ensemble modeling unit 500c generates an abnormality diagnosis model by weighting and summing the abnormal diagnosis model generated or updated by the unsupervised learning modeling unit 500a and the abnormal diagnosis model generated or updated by the supervised learning modeling unit 500b, respectively. Or it may be configured to update.

The ensemble modeling unit 500c is configured to include a first weight application unit 506 , a second weight application unit 507 , a third weight application unit 508 , and a weighted sum modeling unit 509 as shown in FIG. 5 . can be

5, the abnormal diagnosis model generation/update module 500 includes a first cluster modeling unit 501, a multivariate feature extraction unit 502, a second cluster modeling unit 503, and a main variable selection unit. 504 , a correlation modeling unit 505 , a first weight application unit 506 , a second weight application unit 507 , a third weight application unit 508 , and a weighted sum modeling unit 509 . can be

Hereinafter, a detailed configuration will be described.

The first cluster modeling unit 501 may be configured to generate a cluster from the feature vectors for each observation of the univariate variable generated by the first feature extraction module 400, and FIG. 7 shows these feature vectors are used in the first cluster modeling unit. It is a schematic diagram showing an example of using it as an input value.

8 and 9 are schematic diagrams illustrating an example of discriminating abnormal data based on clusters of univariate variables learned based on unsupervised learning by the first cluster modeling unit 501 . As can be seen in FIG. 9 , the characteristics of the input data are calculated based on the statistical characteristics of the cluster, and when the calculated value deviates from the allowable value, it is determined as abnormal data. For example, each cluster has a centroid vector, and the mean and variance regarding the distance and similarity between each observation vector and the centroid vector in the cluster can be set as cluster properties. If the distance of is large, new observations can be regarded as data outside the cluster range. This first cluster model is an abnormality diagnosis model by unsupervised learning and may be utilized for abnormality diagnosis of univariate variables of the abnormality diagnosis operation module 900 .

Meanwhile, not only a univariate cluster model for diagnosing anomalies for each individual independent variable such as temperature, flow rate, and pressure, but also a multivariate cluster model for performing anomaly diagnosis by considering several independent variables together may be formed. The multivariate cluster model can perform anomaly diagnosis by extracting each univariate feature or multivariate feature from each univariate cluster model and using it as an input value.

The multivariate feature extractor 502 extracts multivariate feature data using each univariate feature generated by the first feature extraction module 400 or a first cluster model generated or updated by the first cluster modeling unit 501 to extract multivariate feature data. can be configured. The multivariate feature data may be generated through the relationship between the first cluster model generated or updated by the first cluster modeling unit 501 and the observation value for each variable, and the distance and similarity between the average vector for each cluster and the observation value for each variable can be an example of that. 10 shows the generation of multivariate feature data from a number of univariate variables, and shows that the multivariate feature data is formed as an input value for a multivariate cluster.

The second cluster modeling unit 503 may be configured to generate or update a second cluster model of an unsupervised learning method using the multivariate feature data extracted by the multivariate feature extraction unit 502 . Since the second cluster model is a multivariate cluster model by unsupervised learning, the abnormality diagnosis operation module 900 may perform abnormality diagnosis on multivariate using the second cluster model.

The main variable selector 504 may be configured to select a main variable for supervised learning from the multivariate feature data generated by the multivariate feature extractor 502 .

The correlation modeling unit 505 generates or updates a supervised learning-based correlation model using the independent variable data selected by the main variable selection unit 504 and the dependent variable data input from the dependent variable data input module 1000 . can be configured.

The dependent variable data input module 1000 may be configured to receive dependent variable data for independent variable data as a configuration for supervised learning. That is, it is a configuration for supervised learning by setting predetermined dependent variable data for each independent variable data.

11 shows that the dependent variable for each observation is matched and correlation analysis is performed thereon. As an example of the dependent variable, there may be a process result value of a manufacturing process. In the case of a semiconductor process, the independent variable may be the pressure, flow rate, temperature of the gas supplied, and the dependent variable is the thickness of the semiconductor deposition film, line width, etc. can be This correlation model is an abnormality diagnosis model based on supervised learning, and may be used for abnormal diagnosis of the abnormality diagnosis calculation model 900 .

The first weight application unit 506 may be configured to apply a first weight to the first cluster model generated or updated by the first cluster modeling unit 501 .

The second weight application unit 507 may be configured to apply a second weight to the second cluster model generated or updated by the second cluster modeling unit 503 .

The third weight application unit 508 may be configured to apply a third weight to the correlation model generated or updated by the correlation modeling unit 505 .

The weighted sum modeling unit 509 applies the first cluster model to which the first weight is applied in the first weight application unit 506 , the second cluster model to which the second weight is applied in the second weight application unit 507 , and the third weight is applied. The unit 508 may be configured to generate or update the ensemble model by summing the third cluster model to which the third weight is applied.

12 shows a process in which an unsupervised learning-based model and an ensemble model in which weights are applied based on a supervised learning-based model are applied, and is displayed in terms of a data dimension. Such an ensemble model may be used for abnormal diagnosis of the abnormality diagnosis operation module 900 .

13 is a schematic diagram illustrating a process of learning and evaluating a diagnostic model, and a process of updating the model. In the case of time series data obtained from a sensor, a phenomenon occurs in which the value of the input data changes due to deterioration of the sensor over time. Accordingly, cases in which normal data is determined to be an outlier compared to a normal cluster occur frequently over time, and in this case, an update of the diagnostic model is required. However, the number of newly generated normal outlier data is small, so learning is not performed well when the model is updated.

14 is a schematic diagram illustrating a process of increasing the number of similar data by generating outliers, that is, data determined to be in an abnormal state, although the state is normal, and in the present invention, after increasing the number of data determined in an abnormal state, model update By doing so, we improve the model performance. As a method of increasing the number of data, there are techniques such as SMOTE (Synthetic Minority Oversampling Technique) and ADASYN (Adaptive Synthetic Sampling).

15 shows a result of generating similar data of a small number of normal data, and FIG. 16 shows a learning process of normal data and a classification process and result when normal and abnormal data are mixed.

Although it has been described with reference to the above embodiments, those skilled in the art can understand that various modifications and changes can be made to the present invention without departing from the spirit and scope of the present invention as set forth in the following claims. There will be.

100: time series data input module
200: data storage module for training
201: new data storage unit
202: existing data storage unit
300: first domain conversion module
400: first feature extraction module
500: Anomaly diagnosis model creation/update module
500a: Unsupervised Learning Modeling Unit
500b: Supervised Learning Modeling Unit
500c: Ensemble Modeling Department
501: first cluster modeling unit
502: multivariate feature extraction unit
503: second cluster modeling unit
504: key variable selection part
505: correlation modeling unit
506: first weight application unit
507: second weight application unit
508: third weight application unit
509: weighted summation modeling unit
600: error diagnosis model storage module
700: second domain conversion module
800: second feature extraction module
900: error diagnosis operation module
1000: dependent variable data entry module

Claims (3)

a time series data input module for receiving time series data;
a learning data storage module in which the time series data is stored as learning data for generating and updating an abnormality diagnosis model using unsupervised learning or supervised learning;
a first domain transformation module that performs domain transformation on the learning data stored in the learning data storage module;
a first feature extraction module for extracting a feature vector from the domain-transformed learning data in the first domain transformation module;
a second domain transformation module for performing domain transformation on the time series data received from the time series data input module;
a second feature extraction module for extracting a feature vector from the domain-transformed learning data in the second domain transformation module;
an abnormality diagnosis model generation and update module for generating or updating an abnormality diagnosis model by learning the feature vector extracted by the first feature extraction module;
an abnormality diagnosis model storage module for storing an abnormality diagnosis model generated or updated in the abnormal diagnosis model generation and update model;
an abnormality diagnosis operation module for outputting abnormality by performing an abnormality diagnosis operation on the feature data generated by the second feature extraction module using the abnormality diagnosis diagnosis model stored in the abnormality diagnosis model storage module;
A dependent variable data input module for receiving dependent variable data for the time series data, which is independent variable data, for supervised learning;
The first feature extraction module,
Among the training data transformed by the domain in the first domain transformation module, for the training data of the univariate variable, the training data is dimensionally reduced, and a univariate feature vector is generated using the score values of the dimensionally reduced principal axis vectors, and For the training data, the relationship between the generated feature vector of the univariate variable and the corresponding cluster is generated for each variable, and multivariate feature data is generated by collecting the generated results,
The second feature extraction module,
Among the training data domain-transformed in the second domain transformation module, for the training data of the univariate variable, the training data is dimensionally reduced, and a univariate feature vector is generated using the score values of the dimension-reduced principal axis vectors, and For the training data, the relationship between the generated feature vector of the univariate variable and the corresponding cluster is generated for each variable, and multivariate feature data is generated by collecting the generated results,
The learning data storage module,
a new data storage unit storing the time series data input from the time series data input module as new learning data;
The time series data stored in the abnormal diagnosis model storage module is configured to include an existing data storage unit that is stored as data for existing learning,
The abnormal diagnosis model creation/update module is
an unsupervised learning modeling unit for generating or updating an abnormal diagnosis model using unsupervised learning;
a supervised learning modeling unit for generating or updating an abnormal diagnosis model using supervised learning;
and an ensemble modeling unit for generating or updating an abnormality diagnosis model by weighted summing the abnormal diagnosis model generated or updated by the unsupervised learning modeling unit and the abnormal diagnosis model generated or updated by the supervised learning modeling unit, respectively Time series data anomaly diagnosis system. According to claim 1,
The unsupervised learning modeling unit,
a first cluster modeling unit for generating a first cluster from the feature vector of the univariate variable generated by the first feature extraction module;
a multivariate feature extracting unit for extracting multivariate feature data using a feature vector of each univariate variable generated by the first feature extracting module or a first cluster model generated or updated by the first cluster modeling unit;
and a second cluster modeling unit for generating or updating a second cluster model of an unsupervised learning method using the multivariate feature data extracted by the multivariate feature extraction unit;
The supervised learning modeling unit,
a main variable selection unit for selecting independent variable data for supervised learning from the multivariate feature data extracted by the multivariate feature extraction unit;
and a correlation modeling unit for generating or updating a supervised learning-based correlation model using the independent variable data selected by the main variable selection unit and the dependent variable data input from the dependent variable data input module,
The ensemble modeling unit,
a first weight application unit for applying a first weight to the first cluster model generated or updated by the first cluster modeling unit;
a second weight application unit for applying a second weight to the second cluster model generated or updated by the second cluster modeling unit;
a third weight application unit for applying a third weight to the correlation model generated or updated by the correlation modeling unit;
a first cluster model to which a first weight is applied by the first weight application unit, a second cluster model to which a second weight is applied by the second weight application unit, and a correlation model to which a third weight is applied by the third weight application unit Time-series data anomaly diagnosis system, characterized in that it comprises a weighted summation modeling unit for generating or updating the ensemble model by summing. delete

Images