KR102502648B1 - Method and devices for detecting anomaly in a time series using rnn - Google Patents

Abstract

A method and apparatus for detecting an anomaly in a time series are disclosed. An abnormal situation detection method performed by a detection system according to an embodiment includes training a recurrent neural network composed of an encoder and a decoder for determining an abnormal situation using time-series data; discriminating a normal section, an attention section, and a singular section for time series data based on a score calculated through a recurrent neural network composed of the encoder and decoder; inputting new time-series data generated in real time to the recurrent neural network composed of the trained encoder and decoder; and determining whether an abnormal situation has occurred from the new time-series data generated in real time using a recurrent neural network composed of the trained encoder and decoder.

Description

Method and device for detecting anomalies in time series using RNN encoder-decoder {METHOD AND DEVICES FOR DETECTING ANOMALY IN A TIME SERIES USING RNN}

The following description relates to a technique for detecting anomalies in time series data, using an encoder-decoder method using an RNN of an artificial neural network to perform supervised or unsupervised learning according to the type of data to determine the type of data. It relates to a method and apparatus for classifying and detecting in real time whether a peculiar situation occurs in a time series through this.

Recurrent Neural Network (RNN), one of the rapidly developing artificial neural network models, is widely used to deal with natural language or to analyze and predict time series. LSTM (Long Short Term Memory) was developed to compensate for the disadvantage that general RNNs do not utilize information of past data well, and an encoder-decoder model in the form of combining two LSTMs inputs one sentence and It has a structure that outputs a corresponding new sentence, and especially shows high performance in translating sentences.

In addition, as the industry develops, countless amounts of information and data are generated and transmitted, and a technology capable of distinguishing whether such data is normal or unusual data including an abnormal situation is becoming increasingly important. In particular, real-time anomaly detection technology in real-time incoming time-series data is not yet well established and its accuracy is not high.

Research related to the detection of such anomalies in time series data goes beyond the existing statistical models and methods using LSTM or encoder-decoder models of deep learning are being developed. These studies are mainly focused on predicting the future using RNN-based methods and when the indicators extracted from the predictions exceed a certain threshold, an abnormal situation has occurred or an alarm that an abnormal situation may occur. It is more accurate than the statistical method of

However, although the future prediction of general time series using the above method is more accurate than the existing statistical method, it is still inaccurate in many cases. Artificial intelligence algorithms that detect abnormal situations in real time through

In addition, most of the existing studies are not specific or reasonable about how to set the threshold. In particular, in the case of many time series data, it is unknown whether or not an anomaly is included, that is, in most cases there is no label. It is difficult to detect unusual situations by applying the method.

A method of predicting an anomaly in real time from time series data given in real time is not yet widely used.

In modern society, countless amounts of data are being created every moment. Countless amounts of information, such as operation sounds of various machines, human brainwaves, stock prices and exchange rates, and cctv information, are being collected as data in real time in time series.

However, in this time series, unusual phenomena that are far from normal situations such as machine malfunctions, health problems, stock price manipulation, and outsider invasion often occur. Since there are many cases where people cannot monitor such unusual situations in real time, a technology is needed to respond quickly by automatically detecting and notifying people.

The present invention may include an operation of quickly capturing and notifying whether an anomaly occurs in real-time given time series data using deep learning. In particular, it is possible to provide a method and apparatus for detecting an unusual situation not only when it is known whether or not existing data includes an abnormal situation, but also when it is not known whether or not an abnormal situation is included.

An abnormal situation detection method performed by a detection system includes training a recurrent neural network composed of an encoder and a decoder for determining an abnormal situation using time-series data; discriminating a normal section, an attention section, and a singular section for time series data based on a score calculated through a recurrent neural network composed of the encoder and decoder; inputting new time-series data generated in real time to the recurrent neural network composed of the trained encoder and decoder; and determining whether an abnormal situation has occurred from the new time-series data generated in real time using a recurrent neural network composed of the trained encoder and decoder.

The training step may include a process of determining whether a label exists in the time series data, and if a label does not exist in the time series data, distinguishing normal data from unusual data in the time series data (identification process) , calculating a singular score for each data in the time series data, and distinguishing normal data from unusual data once or sequentially using the calculated singular score.

In the training step, a data set (HD) having a singular score equal to or higher than a preset criterion is constructed from among the time series data, and a data set (LD) obtained by removing data having a singular score equal to or higher than the preset criterion and a loss function The recurrent neural network composed of the encoder-decoder is trained using , and the singular score for the data set (LD) from which data having a singular score equal to or higher than the predetermined criterion is removed through the training and a singular score having a singular score equal to or greater than the predetermined criterion An N-score, which is the maximum value of the singular score for the data set (LD) from which data is removed, is calculated, and the singular score for the data set (HD) having a singular score equal to or higher than the preset standard through the training, and the preset Calculating an A-score, which is the minimum value of the singularity score, for a data set having a singularity score equal to or greater than a reference point, wherein the distinguishing step is performed when the calculated N-score is smaller than the calculated A-score. The calculated N-score or less is determined as a normal zone, and if the calculated N-score or more and the calculated A-score is less than the calculated A-score, it is classified as a caution zone, and if the calculated A-score or more is classified as a special zone, If the N-score is greater than the calculated A-score, less than the calculated A-score is determined as a normal zone, and if the calculated A-score or more is less than the calculated N-score, the caution zone, the calculated If it is N-score or higher, it is classified as a singular region, and in the distribution of singular scores, based on a boundary point showing a difference of more than a predetermined standard in the tail part, distinguishing normal data and singular data from the time series data Searching for boundary data, and detecting an abnormal situation including a normal state, a state of caution, and an unusual state of the time series data using the searched boundary data.

In the training step, if a label exists in the time series data, classify normal data and outlier data from the time series data, calculate an N-score for the classified normal data through the training, and calculate the classified outlier data. In the step of calculating an A-score using data and discriminating, if the calculated N-score is smaller than the calculated A-score, it is determined that less than the calculated A-score is a normal zone, and the calculation If the calculated N-score or more is less than the calculated A-score, dividing into a caution zone, if the calculated A-score or more, into a special zone, if the calculated N-score is greater than the calculated A-score, Determining that less than the calculated A-score is a normal area, and classifying into a caution area if the calculated A-score or more and less than the calculated N-score, and a special area if the calculated N-score or more can do.

The determining step may include calculating a singular score for the new time series data using a recurrent neural network composed of the trained encoder-decoder, and including normal data, attention data, or singular data using the calculated singular score. A step of determining whether an abnormal situation has occurred may be included.

A program stored in a computer readable storage medium to execute the abnormal situation detection method performed by the detection system includes training a recurrent neural network composed of an encoder and a decoder for determining an abnormal situation using time-series data; discriminating a normal section, an attention section, and a singular section for time series data based on a score calculated through a recurrent neural network composed of the encoder and decoder; inputting new time-series data generated in real time to the recurrent neural network composed of the trained encoder and decoder; and determining whether an abnormal situation has occurred from the new time-series data generated in real time using a recurrent neural network composed of the trained encoder and decoder.

The training step may include a process of determining whether a label exists in the time series data, and if a label does not exist in the time series data, distinguishing normal data from unusual data in the time series data (identification process) and constructing a data set (HD) having a singular score equal to or greater than a predetermined criterion from among the time series data, and using a data set (LD) from which data having a singular score equal to or greater than the predetermined criterion is removed and a loss function to train the recurrent neural network composed of the encoder-decoder, and through the training, singular scores for the data set (LD) from which data having singular scores equal to or higher than the predetermined criterion are removed and data having singular scores equal to or greater than the predetermined criterion N-score, which is the maximum value of the singular score for the removed data set (LD), is calculated, and through the training, the singular score for the data set (HD) having a singular score equal to or higher than the preset standard and the singular score equal to or higher than the preset standard are calculated. Calculate an A-score, which is the minimum value of the singular score, for a data set having a singular score, and if a label exists in the time series data, classify normal data and singular data from the time series data through the training, and classify the classified normal data. In the step of calculating an N-score for the data, calculating an A-score using the classified specific data, and discriminating, if the calculated N-score is smaller than the calculated A-score, the The calculated N-score or less is determined as a normal zone, and if the calculated N-score or more and the calculated A-score is less than the calculated A-score, it is classified as a caution zone, and if the calculated A-score or more is classified as a special zone, If the N-score is greater than the calculated A-score, less than the calculated A-score is determined as a normal zone, and if the calculated A-score or more is less than the calculated N-score, the caution zone, the calculated If it is N-score or higher, it will include a step of classifying it into a specific area. can

The discriminating step may include searching for boundary data for distinguishing normal data from singular data in the time series data based on a boundary point showing a difference greater than or equal to a preset standard in a tail part of the distribution of singular scores; and detecting an abnormal situation including a normal state, a caution state, and a peculiar state of the time series data using the searched boundary data.

A detection system for detecting an anomaly includes a training unit for training a recurrent neural network composed of an encoder and a decoder for determining an anomaly using time-series data; a distinguishing unit for discriminating a normal section, a caution section, and a singular section for the time-series data based on the score calculated through the recurrent neural network composed of the encoder and decoder; an input unit inputting new time-series data generated in real time to the recurrent neural network composed of the trained encoder and decoder; and a determination unit for determining whether an abnormal situation has occurred from the new time-series data generated in real time using a recurrent neural network composed of the trained encoder and decoder.

The training unit determines whether a label exists in the time series data, and if the label does not exist in the time series data, performs an identification process to distinguish normal data from unusual data in the time series data. and calculates a singular score for each data in the time series data, distinguishes normal data from singular data once or sequentially using the calculated singular score, and data having a singular score equal to or higher than a predetermined standard among the time series data. A set (HD) is formed, and the recurrent neural network composed of the encoder-decoder is trained using a data set (LD) and a loss function from which data having singular scores equal to or higher than the predetermined standard are removed, and through the training N-score, which is the maximum value of the singular score for the data set (LD) from which data having a singular score equal to or greater than the predetermined criterion is removed and the singular score for the data set (LD) from which data having a singular score greater than or equal to the predetermined criterion is removed Calculate , and through the training, a singular score for a data set (HD) having a singular score equal to or higher than the predetermined criterion and an A-score, which is the minimum value of the singular score for a data set having a singular score equal to or higher than the predetermined criterion, are calculated. and if a label exists in the time series data, it is possible to classify normal data and unusual data from the time series data through the training, calculate an N-score for the classified normal data, and calculate the classified unusual data In the step of calculating an A-score and discriminating, if the calculated N-score is smaller than the calculated A-score, it is determined that less than the calculated A-score is a normal zone, and the calculated N-score is determined as a normal area. -If the score is greater than or equal to the calculated A-score, it is classified as a caution zone, if it is greater than or equal to the calculated A-score, as a special zone, and if the calculated N-score is greater than the calculated A-score, the calculated N-score is greater than the calculated A-score. Below the A-score is judged as a normal area, and If the calculated A-score or more is less than the calculated N-score, it can be classified as a caution zone, and if it is more than the calculated N-score, it can be classified as a special zone.

The discrimination unit searches for boundary data for distinguishing normal data from singular data in the time series data based on a boundary point showing a difference greater than or equal to a preset standard in a tail portion of the distribution of singular scores, and the search Using the boundary data, it is possible to detect abnormal situations including the normal state, attention state, and unusual state of time series data.

In order to solve the problem that the existing methods for detecting outliers are ambiguous in the selection of the critical value defining the singularity and do not provide a methodology for applying them in real time, the encoder-decoder method is used to assign singular scores to each time series data. and by devising a method to apply it in real time, it is expected that a wider range of applications will be possible in many fields such as mechanical equipment, finance, and IoT that require real-time monitoring.

1 is a block diagram illustrating a configuration of time series data in a detection system according to an exemplary embodiment.
2 is a flowchart illustrating a method of detecting an abnormal situation of time series data in a detection system according to an embodiment.
3 is a diagram for explaining an operation of detecting an abnormal situation of time series data in a detection system.
4 is a diagram for explaining a recurrent neural network composed of an encoder-decoder in a detection system according to an embodiment.

Hereinafter, an embodiment will be described in detail with reference to the accompanying drawings.

In an embodiment, a technique for detecting the occurrence of an anomaly in time series data using an encoder-decoder using a recurrent neural network (RNN) of deep learning will be described. In detecting the occurrence of an anomaly, a threshold that reflects the characteristics of the data is set not only in the case of labeled supervised learning, but also in the case of unsupervised learning without a label, and through this, whether an anomaly occurs in time series data can detect whether In this case, it may be performed not only on already generated data but also on time-series data generated in real time.

1 is a block diagram illustrating a configuration of time-series data in a detection system according to an embodiment, and FIG. 2 is a flowchart illustrating a method of detecting an anomaly of time-series data in a detection system according to an embodiment.

The processor of the detection system 100 may include a training unit 110 , a discrimination unit 120 , an input unit 130 and a determination unit 140 . These components of the processor may represent different functions performed by the processor according to control instructions provided by program code stored in the detection system. The processor and components of the processor may control the detection system to perform steps 210 to 240 included in the method for detecting anomaly in time series data of FIG. 2 . In this case, the processor and components of the processor may be implemented to execute instructions according to the code of an operating system included in the memory and the code of at least one program.

The processor may load a program code stored in a file of a program for a method for detecting an abnormal situation of time series data into a memory. For example, when a program is executed in the detection system, the processor may control the detection system to load a program code from a file of the program into a memory under the control of an operating system. At this time, each of the processor and the training unit 110, the discrimination unit 120, the input unit 130, and the determination unit 140 included in the processor executes a command of a corresponding part of the program code loaded into the memory to perform subsequent steps ( 210 to 240) may be different functional representations of the processor.

In step 210, the training unit 110 may train a recurrent neural network composed of an encoder and a decoder for discriminating normal data or unusual data using time series data. The training unit 110 determines whether a label exists in the time series data, and if the label does not exist in the time series data, performs an identification process to distinguish normal data from unusual data in the time series data, An anomaly score for each data in the time series data is calculated, and normal data and anomaly data can be distinguished once or sequentially using the calculated singular score. In this case, the singular score for each data may mean a cost function when training of the recurrent neural network using the encoder-decoder is completed. The training unit 110 constructs a data set (HD) having a singular score equal to or higher than a predetermined criterion among time series data, and uses a data set (LD) from which data having a singular score equal to or greater than a predetermined criterion is removed and a loss function. A recurrent neural network composed of encoder-decoders is trained, and the singular scores for the data set (LD) from which data having singular scores equal to or higher than a predetermined criterion are removed through training and the data set (LD) from which data having singular scores greater than or equal to a predetermined criterion are removed ), calculates the N-score, which is the maximum value of the singular score for ), and calculates the singular score for the data set (HD) having a singular score greater than or equal to a predetermined standard through training and the data set having a singular score greater than or equal to a predetermined standard An A-score, which is the minimum singular score, can be calculated. When a label exists in the time series data, the training unit 110 may classify normal data and singular data from the time series data through training, calculate an N-score for the classified normal data, and use the classified singular data to A - Scores can be calculated.

In step 220, the distinguishing unit 120 may distinguish a normal section, a caution section, and a specific section for the time series data based on the score calculated through a recurrent neural network composed of an encoder and a decoder. If the calculated N-score is smaller than the calculated A-score, the discrimination unit 120 determines that less than the calculated N-score is a normal area, and if the calculated N-score or more is less than the calculated A-score, the caution area , if it is more than the calculated A-score, it is classified as a special area, and if the calculated N-score is greater than the calculated A-score, it is determined that the area below the calculated A-score is a normal area, and the calculated A-score or more If it is less than the calculated N-score, it can be classified as a caution zone, and if it is more than the calculated N-score, it can be classified as a special zone. The discrimination unit 120 searches for boundary data that distinguishes normal data from singular data in time series data based on a boundary point showing a difference greater than a predetermined standard in the tail part of the distribution of singular scores, It is possible to detect abnormal situations including the normal state, attention state, and unusual state of time series data using boundary data. Specifically, the discriminating unit 120 performs an operation of finding boundary data showing the largest difference or the largest percentage difference in the tail of the distribution of singular scores again using data from which data having singular scores equal to or greater than a predetermined criterion has been removed. The final boundary data can be explored by iterative calculation.

In step 230, the input unit 130 may input new time-series data generated in real time to a recurrent neural network composed of a trained encoder and decoder.

In step 240, the determination unit 140 may determine whether an abnormal situation has occurred from new time-series data generated in real time using a recurrent neural network composed of a trained encoder and decoder. The determination unit 140 calculates a singular score for new time-series data using a recurrent neural network composed of trained encoder-decoders, and generates an abnormal situation including normal data, caution data, or singular data using the calculated singular score. can determine whether

3 is a diagram for explaining an operation of detecting an abnormal situation of time series data in a detection system.

In order to find time series data representing a small number of anomalies from time series data, time series data may be input as input data. A circular neural network-based encoder-decoder that uses the same label as the time-series data used in the input can be configured and trained. Since the deep learning parameters are trained to restore the majority of normal data in this training process, the normal data has a small value of the cost function representing the error, and the specific data including the abnormal situation has a relatively large cost function.

과 디코더(410)에 출력되는 시계열 데이터

를 이용하여 훈련될 수 있다. 여기에서, 인코더(420)에 입력되는 시계열과 디코더(410)에 출력되는 시계열이 동일하게 되도록, 다시 말해서,

에

을 대입하여 훈련시키는 방법을 사용할 수 있다. 이러한 기술은 주어지는 시계열 데이터의 형태에 따라 다음과 같이 구별하여 적용시킬 수 있다. 또한, 데이터의 형태에 따라 데이터의 변화율을 도출하고, 도출된 변화율을 사용할 수도 있다.Referring to FIG. 4, it is a diagram for explaining a recurrent neural network composed of an encoder-decoder. Time series input to encoder 420

and time series data output to the decoder 410

can be trained using Here, the time series input to the encoder 420 and the time series output to the decoder 410 are the same, in other words,

to

You can use the training method by substituting . These techniques can be applied by distinguishing them as follows according to the type of given time series data. In addition, the rate of change of data may be derived according to the type of data, and the derived rate of change may be used.

Referring to FIG. 3 , time series data 301 may be input as input data. At this time, preprocessing is performed to move the time series data to the same size by moving a window of a predetermined size, and when there is a label capable of distinguishing normal data from unusual data from the preprocessed time series data, and normal data Training can be performed by classifying it as a case where there is no label or other information that can obtain and singular data. The detection system may determine whether a label exists in the time series data (302). When a label does not exist in the time series data, the detection system may calculate a singular score for the time series data using a recurrent neural network-based encoder-decoder (303). Training for the singular score based on the recurrent neural network includes adjusting the weights to which the nodes of the neural network belong, and the weights of the trained nodes are used to classify new time series data into a normal state, an attention state, and a singular state. This can be the basis for calculating the singularity score. At this time, data (HD) having a high singular score among the calculated singular scores can be constructed, and the singular score for the data (HD) having a high singular score and the A-score, which is the minimum value of the singular score having a high singular score, are selected. can be computed (304). Then, the N-score, which is the maximum value of feature scores for time series data from which data with high outliers are removed, and singular scores of time series data (LD) from which data with high outliers are removed, can be calculated (305). In this way, normal data, cautionary data, and specific data may be distinguished based on the calculated A-score and N-score (314).

When a label exists, the detection system may train normal data using a recurrent neural network-based encoder-decoder (311). The detection system may calculate 312 an N-score for normal data and calculate 313 an A-score using unusual data. In this way, based on the calculated N-score and A-score, it is possible to distinguish normal data, cautionary data, and idiosyncratic data for time series data.

For example, a case in which time-series data repeatedly occurs during a predetermined period, such as a process of a machine, will be described. If the training data consists of n time series T _i (i=1, 2, 3, ..., n), and each time series data T _i consists of data at m time points, that is, T _i = It is given in the form of (t ₁ , t ₂ , ..., t _m ), and when each T _i is data that occurs repeatedly in the same process or similar situation, basically after data standardization, the following action can proceed.

에 대한 손실값

를

의 특이점수라고 한다. 이 특이점수는 훈련 상황에 따라 달라질 수 있다. The case where it is known whether or not each T _i contains an abnormal situation will be described. It is possible to train the RNN-based encoder-decoder so that the input time series data and the output time series data are the same using only data that does not contain anomalies. At this time, a general loss function used in deep learning can be used as the loss function, and when all parameters are fixed after training, new input data

loss value for

cast

is called the singular point of This singular score may vary depending on the training situation.

인 경우, 스코어 구간

을 정상 구간,

을 주의 구간,

을 특이 구간이라고 구분하고, 새로운 시계열 데이터의 스코어가 포함되는 구간에 따라 각각 정상 상태, 주의 상태, 특이 상태로 판정할 수 있다. 그리고,

인 경우, 스코어 구간

을 정상 구간,

을 주의 구간,

을 특이 구간으로 구분하고, 새로운 시계열 데이터의 스코어가 포함되는 구간에 따라 각각 정상 상태, 주의 상태, 특이 상태로 판정할 수 있다. The maximum value of the singularity score for normal data is called the N-score, the value of the N-score is M, the minimum value of the feature score of the data (singular data) including the abnormal situation is called the A-score, Let the value be described as m. then,

If , the score interval

to the normal interval,

the interval of attention,

is classified as a singular section, and may be determined as a normal state, a state of caution, and a singular state, respectively, according to the section including the score of the new time series data. and,

If , the score interval

to the normal interval,

the interval of attention,

is classified as a singular section, and according to the section including the score of the new time series data, it can be determined as a normal state, a state of caution, and a singular state, respectively.

에 대한 손실값

를 획득할 수 있다. 이때, 손실값

를 내림차순으로 정렬시킨 후, 각 항들의 차이 혹은 비율의 최댓값이 기 설정된 기준을 초과할 경우, 이 최댓값을 구성하는 항을 이상상황의 경계로 삼는다. 구체적으로, 표준화된 데이터가 n개의 시계열 T_i(i=1, 2, 3, ..., n)로 이루어져 있고, 각각의 손실을

라고 하고, 이를 내림차순으로 정리한 것을

(i=1, 2, 3, ..., n)라고 하자.

(비율인 경우는

)라고 하고,

,

라고 하면

가 기 설정된 값(미리 정해놓은 값) C보다 큰 경우, A-스코어는

, N-스코어는

이 된다. 이때 스코어 구간

을 정상 구간,

를 주의 구간,

를 특이 구간이라고 구분하고, 새로운 시계열 데이터의 스코어가 포함되는 구간에 따라 각각 정상 상태, 주의 상태, 특이 상태로 판정할 수 있다. 이때,

가 기 설정된 값 C보다 작은 경우는 특이상태가 없는 것으로 판정하며, 추후 데이터가 추가적으로 수집되거나 C의 값을 조정함에 따라 새롭게 판정할 수 있다. 또한 C를 결정하기 위해서는 경험치나 전문가의 식견을 활용할 수도 있다. As another example, a case where it is not known whether each Ti includes an abnormal situation will be described. After training so that the input time series data and the output time series data of the recurrent neural network-based encoder-decoder are the same using the entire data, each training data

loss value for

can be obtained. At this time, the loss value

After arranging in descending order, if the maximum value of the difference or ratio of each term exceeds the preset standard, the term constituting the maximum value is taken as the boundary of the abnormal situation. Specifically, the standardized data consists of n time series T _i (i=1, 2, 3, ..., n), and each loss

, and arrange them in descending order

Let (i=1, 2, 3, ..., n).

(In case of ratio

) and

,

If you say

If is greater than the preset value (predetermined value) C , the A-score is

, the N-score is

becomes At this point, the score range

to the normal interval,

the interval of attention,

is classified as a singular section, and may be determined as a normal state, a state of caution, and a singular state, respectively, according to the section including the score of the new time series data. At this time,

If is less than the preset value C , it is determined that there is no singular state, and a new determination can be made as additional data is collected later or the value of C is adjusted. In addition, experience points or expert insights can be used to determine C.

로 주어져 있고, 원하는 시계열 데이터의 길이를 m이라고 하면, 다음과 같이 앞과 뒤의 시계열 데이터가 일부 중첩되도록 시계열 데이터 T_i를 정할 수 있다. As another example, a case in which data in the same state, such as a stock price, is not repeated will be described. Time series data is a sequence

, and if the length of the desired time series data is m, the time series data T _i can be determined so that the front and back time series data partially overlap as follows.

Thereafter, as described above, the operation may be performed in the same manner as in the case where data is repeatedly generated for a predetermined period.

The detection system can detect abnormal situations in real time. Expansion of data input in real time may be performed differently for each case in which the data repeatedly occurs for a predetermined period and in the case where data in the same state, such as a stock price, is not repeated. If data occurs repeatedly during a fixed period, the data observed so far and a data set that does not contain an existing anomaly, or the data observed so far and the data belonging to the LD are combined, and then the combined time series data is scored. It can be calculated to provide the probability of a normal state, a state of attention, a singular state, or each situation. If the data in the same state is not repeated, the score can be calculated using m pieces of recent data including the current data.

를 구성하고,

의 스코어가 정상 상태, 주의 상태, 특이 상태에 속한 경우의 수를 각각 a, b, c라고 하면, 정상 상태, 주의 상태, 특이 상태에 속해있는 확률은 각각 a/n, b/n, c/n이 된다. As an example, a case in which data is repeatedly generated during a predetermined period, such as a process of a machine, will be described. T=(r ₁ , r ₂ , ..., r _l ,) occurred in real time until the lth point in time, and the data set or LD that does not contain anomalies is n time series T _i (i=1 , 2, 3, ..., n), and each time series T _i is composed of data at m points in time, that is, T _i = (t ₁ , t ₂ , ..., t _m ), and when each T _i is repetitive data occurring in the same process or situation, combined data can be formed as follows. In other words,

to configure,

If the number of cases in which the score belongs to the normal state, attention state, and singular state is a, b, and c, respectively, the probability of belonging to the normal state, attention state, and singular state is a/n, b/n, and c/, respectively. becomes n.

라고 하면 이전의 m-1개의 데이터를 포함한 시계열 데이터

를 구성하고, 이 시계열 데이터의 스코어를 이용하여 정상 상태, 주의 상태, 특이 상태를 판정할 수 있다.As another example, if the same data is not repeated, such as stock prices, the current data

, time series data including the previous m-1 data

is constituted, and a normal state, a state of caution, and a singular state can be determined using the score of this time series data.

The devices described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components. Devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), and a programmable PLU (programmable logic unit). logic unit), microprocessor, or any other device capable of executing and responding to instructions. A processing device may run an operating system (OS) and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of software. For convenience of understanding, there are cases in which one processing device is used, but those skilled in the art will understand that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that it can include. For example, a processing device may include a plurality of processors or a processor and a controller. Other processing configurations are also possible, such as parallel processors.

Software may include a computer program, code, instructions, or a combination of one or more of the foregoing, which configures a processing device to operate as desired or processes independently or collectively. You can command the device. Software and/or data may be any tangible machine, component, physical device, virtual equipment, computer storage medium or device, intended to be interpreted by or provide instructions or data to a processing device. can be embodied in Software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer readable media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program commands recorded on the medium may be specially designed and configured for the embodiment or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler.

As described above, although the embodiments have been described with limited examples and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques may be performed in an order different from the method described, and/or components of the described system, structure, device, circuit, etc. may be combined or combined in a different form than the method described, or other components may be used. Or even if it is replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents of the claims are within the scope of the following claims.

Claims (11)

In the abnormal situation detection method performed by the detection system,
inputting first time-series data generated in real time to a recurrent neural network composed of a trained encoder and decoder; and
Determining whether an abnormal situation has occurred from the first time-series data using a recurrent neural network composed of the trained encoder and decoder
including,
The recurrent neural network composed of the trained encoder and decoder,
Learning to distinguish a normal section, an attention section, and a singular section for a singular score determined based on a loss value of the second time series data for training,
The determining step is
Using the recurrent neural network composed of the trained encoder and decoder, the corresponding data is selected among the normal state, the attention state, and the singular state according to which section among the normal section, the attention section, and the singular section is included in the singular score of the first time series data. to decide which one
An abnormal situation detection method characterized by. According to claim 1,
The recurrent neural network composed of the trained encoder and decoder,
Determining whether a label exists in the second time series data, and if the label does not exist in the second time series data, identifying normal data and unusual data in the second time series data (identification process) to perform, calculate a singular score for each data in the second time series data, and distinguish normal data from singular data once or sequentially using the calculated singular score.
An abnormal situation detection method characterized by. According to claim 2,
The recurrent neural network composed of the trained encoder and decoder,
A data set (HD) having a singular score equal to or higher than a preset criterion is constructed from among the second time series data, and a data set (LD) obtained by removing data having a singular score equal to or higher than the preset criterion and a loss function are used to obtain the Training a recurrent neural network composed of an encoder and a decoder, and through the training, singular scores for the data set (LD) from which data having singular scores equal to or higher than the predetermined criterion are removed and data having singular scores equal to or greater than the predetermined criterion are removed Calculate the N-score, which is the maximum value of the singular score for the set (LD), and through the training, the singular score for the data set (HD) having a singular score equal to or higher than the preset criterion and the singular score equal to or greater than the preset criterion Calculate the A-score, which is the minimum value of the singular score for the data set with
If the calculated N-score is less than the calculated A-score, less than the calculated N-score is determined as a normal zone, and if the calculated N-score or more is less than the calculated A-score, a caution zone, If it is more than the calculated A-score, it is classified as a specific area, and if the calculated N-score is greater than the calculated A-score, it is determined that less than the calculated A-score is a normal area, and the calculated A-score is determined as a normal area. -Categorize into a caution zone if the score is less than the calculated N-score, or a special zone if the calculated N-score is higher, and the difference of the distribution of the singular scores is greater than or equal to a predetermined standard in the tail part Searching for boundary data that distinguishes normal data and unusual data in the second time series data based on a boundary point showing Implemented to detect anomalies
An abnormal situation detection method characterized by. According to claim 2,
The recurrent neural network composed of the trained encoder and decoder,
When a label exists in the second time series data, normal data and unusual data are classified from the second time series data, an N-score is calculated for the classified normal data through the training, and the classified unusual data is If the calculated N-score is smaller than the calculated A-score, the area less than the calculated N-score is determined as a normal zone, and the calculated N-score or more is determined as the normal area. If it is less than A-score, dividing into a caution zone, if it is more than the calculated A-score, into a special zone, if the calculated N-score is greater than the calculated A-score, less than the calculated A-score It is determined as a normal zone, and if it is greater than the calculated A-score and less than the calculated N-score, it is implemented to classify it as a caution zone, and if it is greater than or equal to the calculated N-score, as a special zone
An abnormal situation detection method characterized by. delete In a program stored in a computer readable storage medium to execute an abnormal situation detection method performed by a detection system,
inputting first time-series data generated in real time to a recurrent neural network composed of a trained encoder and decoder; and
Determining whether an abnormal situation has occurred from the first time-series data using a recurrent neural network composed of the trained encoder and decoder
including,
The recurrent neural network composed of the trained encoder and decoder,
Learning to distinguish a normal section, an attention section, and a singular section for a singular score determined based on a loss value of the second time series data for training,
The determining step is
Using the recurrent neural network composed of the trained encoder and decoder, the corresponding data is selected among the normal state, the attention state, and the singular state according to which section among the normal section, the attention section, and the singular section is included in the singular score of the first time series data. to decide which one
A program stored in a computer readable storage medium characterized by a. According to claim 6,
The recurrent neural network composed of the trained encoder and decoder,
Determining whether a label exists in the second time series data, and if the label does not exist in the second time series data, identifying normal data and unusual data in the second time series data (identification process) and constructing a data set (HD) having a singular score equal to or greater than a preset criterion among the second time series data, and removing data having a singular score equal to or greater than the preset criterion. A data set (LD) and a loss function The recurrent neural network composed of the encoder and the decoder is trained using , and the singular score for the data set (LD) from which data having a singular score equal to or higher than the predetermined criterion is removed through the training and a singular score having a singular score equal to or greater than the predetermined criterion An N-score, which is the maximum value of the singular score for the data set (LD) from which data is removed, is calculated, and the singular score for the data set (HD) having a singular score equal to or higher than the preset standard through the training, and the preset Calculate an A-score, which is the minimum value of the singular score, for a data set having a singular score higher than a criterion, and if a label exists in the second time series data, classify normal data and outlier data from the second time series data through the training And, it is possible to calculate the N-score for the classified normal data, and calculate the A-score using the classified specific data,
If the calculated N-score is less than the calculated A-score, less than the calculated A-score is determined as a normal zone, and if the calculated N-score or more is less than the calculated A-score, a caution zone, If it is more than the calculated A-score, it is classified as a specific area, and if the calculated N-score is greater than the calculated A-score, it is determined that less than the calculated A-score is a normal area, and the calculated A-score is determined as a normal area. -If the score is greater than or less than the calculated N-score, it is implemented to classify into a caution zone, and if it is greater than or equal to the calculated N-score, into a special zone
A program stored in a computer readable storage medium characterized by a. According to claim 6,
The recurrent neural network composed of the trained encoder and decoder,
Boundary data for distinguishing normal data from singular data is searched for in the second time series data based on a boundary point having a difference greater than or equal to a preset standard in a tail portion of the distribution of singular scores, and the searched boundary is searched for. Implemented to detect an abnormal situation including a normal state, an attention state, and an unusual state of the first time series data using data
A program stored in a computer readable storage medium characterized by a. In the detection system for detecting an abnormal situation,
an input unit for inputting first time-series data generated in real time to a recurrent neural network composed of a trained encoder and decoder; and
Determination unit for determining whether an abnormal situation has occurred from the first time-series data using a recurrent neural network composed of the trained encoder and decoder
including,
The recurrent neural network composed of the trained encoder and decoder,
Learning to distinguish a normal section, an attention section, and a singular section for a singular score determined based on a loss value of the second time series data for training,
The judge,
Using the recurrent neural network composed of the trained encoder and decoder, the corresponding data is selected among the normal state, the attention state, and the singular state according to which section among the normal section, the attention section, and the singular section is included in the singular score of the first time series data. to decide which one
Characterized by a detection system. According to claim 9,
The recurrent neural network composed of the trained encoder and decoder,
Determining whether a label exists in the second time series data, and if the label does not exist in the second time series data, identifying normal data and unusual data in the second time series data (identification process) performs, calculates a singular score for each data in the second time series data, distinguishes normal data from singular data once or sequentially using the calculated singular score, and sets a predetermined criterion among the second time series data. Constructing a data set (HD) having a singular score higher than or equal to the predetermined standard, and using a data set (LD) from which data having a singular score higher than the predetermined standard is removed and a loss function Train a recurrent neural network composed of the encoder and decoder and, through the training, the singular score for the data set (LD) from which data having a singular score equal to or higher than the predetermined criterion was removed and the singular score for the data set (LD) from which data having a singular score greater than or equal to the set criterion were removed through the training The N-score, which is the maximum value, is calculated, and through the training, a singular score for a data set (HD) having a singular score equal to or higher than the preset criterion and a singular score for a data set having a singular score equal to or higher than the preset criterion are calculated. Calculate an A-score, which is the minimum value, and if a label exists in the second time series data, classify normal data and unusual data from the second time series data through the training, and obtain an N-score for the classified normal data. and calculating an A-score using the classified specific data,
If the calculated N-score is less than the calculated A-score, less than the calculated A-score is determined as a normal area, and if the calculated N-score or more is less than the calculated A-score, a caution area, If it is more than the calculated A-score, it is classified as a specific area, and if the calculated N-score is greater than the calculated A-score, it is determined that less than the calculated A-score is a normal area, and the calculated A-score is determined as a normal area. -If the score is greater than or equal to the calculated N-score, it is implemented to classify into a caution zone, and if it is greater than or equal to the calculated N-score, into a special zone
Characterized by a detection system. According to claim 9,
The recurrent neural network composed of the trained encoder and decoder,
Boundary data for distinguishing normal data from singular data is searched for in the second time series data based on a boundary point having a difference greater than or equal to a preset standard in a tail portion of the distribution of singular scores, and the searched boundary is searched for. Implemented to detect an abnormal situation including a normal state, an attention state, and an unusual state of the first time series data using data
Characterized by a detection system.

Images