KR102527933B1 - Devices and methods for monitoring real-time data based on dynamic thresholds - Google Patents

Abstract

Embodiments provide a real-time data monitoring method based on a dynamic threshold. According to an embodiment of the present invention, a data monitoring method comprises the steps of: generating a data value by receiving at least one piece of data from a user electronic device at each preset period according to the type of data, and generating a data set including the data value; comparing the data values of the data set with thresholds corresponding to the data values and outputting a comparison result; and transmitting a notification signal to the user electronic device based on the comparison result. The data value includes first to n^th data values received at first to n^th periods, respectively, and the n^th period follows an n-1^th period, wherein n is a natural number of 2 or more, and the threshold value may include first to n^th threshold values corresponding to each of the first to n^th data values. The present invention can more accurately generate the notification signal which notifies the occurrent of an abnormal operation.

Description

Data management apparatus and method for monitoring data in real time based on dynamic threshold

Embodiments of the present invention relate to an apparatus and method for monitoring data, and more specifically, to an apparatus for transmitting a notification signal when abnormal data occurs by tracking changes in data over time based on a dynamic threshold analysis technique, and It's about how.

Recently, as ICT technology-based services such as IoT, cloud, artificial intelligence, and big data are rapidly increasing, the use of cloud-based high-performance computing resources to process high-volume data in real time is increasing.

In addition, IoE (Internet of Everything) technology, which combines IoT technology with big data processing technology through connection with cloud servers, etc., is emerging. Accordingly, the need for a technology for monitoring and managing various data generated by various electronic devices is also increasing.

However, the conventional data monitoring apparatus and method only monitors whether data measured based on a fixed threshold reaches the threshold, so there is a disadvantage in that it does not provide appropriate feedback according to changes in the network environment in which data is generated. .

Embodiments provide a data monitoring apparatus and method for solving the above problem, which adjusts a threshold value by reflecting accumulated data related to data monitoring.

Technical tasks to be achieved in the embodiments are not limited to those mentioned above, and other technical tasks not mentioned will be considered by those skilled in the art from various embodiments to be described below. can

A data monitoring method according to an embodiment of the present invention includes generating a data value by receiving at least one piece of data individually at predetermined intervals according to the type of data, and generating a data set that is a set of the data values. ; comparing the data values of the data set with threshold values corresponding to the data values and outputting comparison results; Transmitting a notification signal to a user electronic device based on the comparison result; wherein the data value includes an n-th data value received at an n-th time, n is a natural number, and the n-th time is Following the n-1 th time period, the threshold value includes an n th threshold value corresponding to the n th data value, and the n th threshold value is at least one of the first threshold value to the n−1 th threshold value. can be determined by one.

[mathematical expression]

The nth threshold is calculated by the [Equation Equation], where vT(n) is the nth threshold value, D(n) is the nth data value, and n is the received data value. A natural number of 2 or more representing the period, c, may represent a correction coefficient.

The n-th threshold may be determined by data values received from a first time to the n−1-th time among data values included in the data set.

The n-th threshold is a maximum value among data values received from the first time to the n-1th time, a minimum value among data values received from the first time to the n-1th time, and the It may be calculated based on the standard deviation of the data values received from the 1st time to the n-1th time.

Correcting the n-th threshold by a processor; further comprising: a multilayer neural network including an input layer, one or more hidden layers, and an output layer; and optimizing based on the learning data by supervising and learning the multi-layer neural network using learning data having the data value received from the first time to the n-1th time as an input value and the nth threshold as an output value. and a learning engine that calculates a hyperparameter, wherein the input layer receives data values received from the first time to the n-1th time, and the one or more hidden layers, Each output value of the layer is multiplied by a weight and a bias is added and outputted. The output layer receives the output value of the hidden layer and outputs an output vector using an activation function, and the multilayer neural network outputs a loss connected to the output layer. A function layer is included, the output vector is input to the loss function layer, the loss function layer outputs a loss value using a loss function that compares the output vector with an answer vector for each feedback data, and Parameters of the multilayer neural network may be learned in a direction in which the loss value becomes smaller.

Data monitoring methods according to embodiments of the present invention may monitor data by changing a threshold value serving as a comparison standard in real time according to a change in data received from a server. Accordingly, a notification signal notifying that an abnormal operation has occurred can be generated more accurately, and appropriate feedback can be provided according to changes in the network environment.

Effects obtainable from the embodiments are not limited to the effects mentioned above, and other effects not mentioned are clearly derived and understood by those skilled in the art based on the detailed description below. It can be.

BRIEF DESCRIPTION OF THE DRAWINGS Included as part of the detailed description to aid understanding of the embodiments, the accompanying drawings provide various embodiments and, together with the detailed description, describe technical features of the various embodiments.
1 is a diagram schematically illustrating a network environment in which a server and a user electronic device are connected according to an embodiment of the present invention.
2 is a block diagram for explaining the structure of a server according to an embodiment of the present invention.
3 is a block diagram for explaining an artificial intelligence module implemented in a processor of a server.
FIG. 4 is a diagram for explaining the structure of the multilayer neural network of FIG. 3 .
5 is a flowchart illustrating a data monitoring method according to an embodiment of the present invention.
6 is a graph showing data values received by the server.
7 is a graph showing data values received by the server.

The following embodiments combine elements and features of the embodiments in a predetermined form. Each component or feature may be considered optional unless explicitly stated otherwise. Each component or feature may be implemented in a form not combined with other components or features. In addition, various embodiments may be configured by combining some components and/or features. The order of operations described in various embodiments may be changed. Some components or features of one embodiment may be included in another embodiment, or may be replaced with corresponding components or features of another embodiment.

In the description of the drawings, procedures or steps that may obscure the gist of various embodiments are not described, and procedures or steps that can be understood by those skilled in the art are not described. did

Throughout the specification, when a part is said to "comprising" or "including" a certain element, it means that it may further include other elements, not excluding other elements, unless otherwise stated. do. In addition, terms such as “… unit”, “… unit”, and “module” described in the specification mean a unit that processes at least one function or operation, which is hardware or software or a combination of hardware and software. can be implemented as Also, “a or an”, “one”, “the” and like terms are used herein in the context of describing various embodiments (particularly in the context of the claims below). Unless otherwise indicated or clearly contradicted by context, both the singular and the plural can be used.

Hereinafter, embodiments according to various embodiments will be described in detail with reference to the accompanying drawings. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The detailed description set forth below in conjunction with the accompanying drawings is intended to describe exemplary embodiments of various embodiments, and is not intended to represent a single embodiment.

In addition, specific terms used in various embodiments are provided to help understanding of various embodiments, and the use of these specific terms may be changed into other forms without departing from the technical spirit of various embodiments. .

1 is a diagram schematically illustrating a network environment in which a server and a user electronic device are connected according to an embodiment of the present invention. 2 is a block diagram for explaining the structure of a server according to an embodiment of the present invention.

Referring to FIG. 1 , in a network environment, a plurality of user electronic devices 200 may communicate with a server 100 through a network. In a network environment, the server 100 may communicate with a plurality of user electronic devices 200 through a short-distance wireless communication network or communicate with at least one of the plurality of user electronic devices 200 through a long-distance wireless communication network. The server 100 may manage a plurality of user electronic devices 200 connected to the server 100 . The server 100 may receive data from the electronic device 200, process the received data, and store the processed data.

The server 100 may provide a data management program for each of a plurality of user electronic devices 200 connected to the server 100 . A data management program can be composed of 3-tiers of Manager, Agent, and Viewer. Agent can be in charge of data collection. Manager can collect and store data for performance and event detection. Also, Manager can store threshold values corresponding to data for each item. The manager can compare data for each item with a corresponding threshold value, and deliver a notification signal to the user when an abnormal operation is detected. The Viewer can diagram and output the data so that the user can check each data and check the graphs and charts. The data management program may be stored as software in the memory of the server 100 . The data management program may include an operating system for controlling one or more resources of a user's electronic device, middleware, or an application executable in the operating system.

The plurality of user electronic devices 200 may generate various data by a user's manipulation. To this end, the user electronic device may include an input module, a processor, and a communication module. The processor of the user electronic device may, for example, execute software to control at least one other component of the user electronic device connected to the processor and perform various data processing or calculations. The input module may receive a command or data to be used in a component of the user electronic device from the outside of the user electronic device (eg, a user). The input module may include, for example, a microphone, a mouse, a keyboard, a key (eg, a button), or a digital pen (eg, a stylus pen). However, this is exemplary and embodiments of the present invention are not limited thereto.

Referring to FIG. 2 , a server 100 according to an embodiment of the present invention may include a processor 110, a memory 120, a data management unit 130, and a notification generator 140.

The processor 110 may generate a data value by receiving at least one piece of data individually at predetermined intervals according to the type of data, and may generate a data set that is a set of data values.

Data received by the processor 110 from the plurality of user electronic devices 200 may include data on at least one of Performance, Process, Log, Filesystem, Ping, and PortScan.

The processor 110 may receive each data from the plurality of user electronic devices 200 at preset intervals. Data received at each time may be received as a 'data value' having a real value.

The data value received by the processor 110 may include a plurality of data values received at a plurality of times. The plurality of data values may include a first data value, a second data value, a third data value, ??, and an n-th data value. Here, n is a natural number, and the nth period may be a period subsequent to the n−1th period.

The processor 110 may calculate a safe range based on the data values. Here, the safe range may mean a normal range in which data values may be distributed with respect to specific data received by the server 100 . That is, when the data value received by the server 100 from the user electronic device 200 falls within the safe range, the processor 110 of the server 100 determines that no error has occurred in the user electronic device 200. can

The processor 110 may compare each data value of the data set with a threshold value corresponding to the data value, and output a comparison result. Here, the threshold value may be a reference value for determining whether data values received by the server 100 from the user electronic device 200 are within a normal range.

The processor 110 may calculate the nth threshold based on the data values received at the first time to the n−1th time among the data values included in the data set. Alternatively, the processor 110 may calculate the nth threshold based on at least one of the first to n−1th thresholds.

In addition, the processor 110 may store commands or data received from other components in a volatile memory, process the commands or data stored in the volatile memory, and store resultant data in a non-volatile memory. In one embodiment, the processor 110 is a main processor (eg, central processing unit or application processor) or a secondary processor (eg, graphics processing unit, neural network processing unit (NPU: neural network processing unit)) that can operate independently of or in conjunction therewith. processing unit) and sensor hub processor). For example, when the server 100 includes a main processor and an auxiliary processor, the auxiliary processor may use less power than the main processor or may be set to be specialized for a designated function. A secondary processor may be implemented separately from, or as part of, the main processor.

The auxiliary processor is, for example, a component of at least one of the components of the server 100, on behalf of the main processor while the main processor is in an inactive state, or together with the main processor while the main processor is in an active state. It may control at least some of the functions or states associated with the element. In one embodiment, a coprocessor may be implemented as part of other functionally related components.

In one embodiment, when the auxiliary processor is a neural network processing device, the auxiliary processor may include a hardware structure specialized for processing an artificial intelligence model. AI models can be created through machine learning. Such learning may be performed, for example, in the server 100 itself where the artificial intelligence model is performed, or may be performed through a separate server.

The learning algorithm may include, for example, supervised learning, unsupervised learning, semi-supervised learning or reinforcement learning, but in the above example Not limited. The artificial intelligence model may include a plurality of artificial neural network layers. Artificial neural networks include deep neural networks (DNNs), convolutional neural networks (CNNs), recurrent neural networks (RNNs), restricted boltzmann machines (RBMs), deep belief networks (DBNs), bidirectional recurrent deep neural networks (BRDNNs), It may be one of deep Q-networks or a combination of two or more of the foregoing, but is not limited to the foregoing examples. The artificial intelligence model may include, in addition or alternatively, software structures in addition to hardware structures.

The memory 120 may store data and data values received from the plurality of user electronic devices 200 . Also, the memory 120 may store at least one threshold value generated by the processor 110 based on data values. The memory 120 may store a safety range boundary value generated by the processor 110 based on data values.

In addition, the memory 120 may store various data used by at least one component of the server 100 . Data may include, for example, input data or output data for software and related instructions. The memory 120 may include volatile memory or non-volatile memory.

The data management unit 130 may generate a data set based on data values received from the plurality of user electronic devices 200 by the processor 110 . A data set may include information about a unique data type. Data received from each of the plurality of user electronic devices 200 may vary. Data may be classified according to at least one classification criterion. The data management unit 130 may build a database based on data stored in the memory 120 . The database may have a general data structure implemented in the storage space of the server 100 using a database management program (DBMS). The database may select one of one or more threshold values stored in the database in response to a control signal of the processor 110 or the data management unit 130 using a database management program. Specifically, the database may select and output one or more threshold values stored in the database based on the control of the data management unit 130 .

The notification generator 140 generates a notification signal when the data value received from the server 100 is out of the allowable range (eg, exceeds a threshold value corresponding to the data value or is less than a threshold value) can do. The types of notifications generated by the notification generation unit 140 may vary. For example, the notification generating unit 140 may control the user electronic device 200 to output a warning message on the display of the user electronic device 200 when the data value is out of a permissible range.

The communication module 150 may support establishing a wired communication channel or a wireless communication channel between the server 100 and an external electronic device, and performing communication through the established communication channel. The communication module 150 may include one or more communication processors that operate independently of the processor 110 and support wired communication or wireless communication. In one embodiment, the communication module 150 may include a wireless communication module or a wired communication module. A corresponding communication module among these communication modules may communicate with the server 100 through a network. These various types of communication modules may be integrated into one component or implemented as a plurality of separate components.

The wireless communication module may support a 5G network after a 4G network and a next-generation communication technology, for example, NR access technology (new radio access technology). NR access technologies include high-speed transmission of high-capacity data (enhanced mobile broadband (eMBB)), minimization of terminal power and access of multiple terminals (massive machine type communications (mMTC)), or high reliability and low latency (ultra-reliable and low latency (URLLC)). -latency communications)) can be supported. The wireless communication module may support a high frequency band, for example, to achieve a high data rate. The wireless communication module uses various technologies for securing performance in a high frequency band, for example, beamforming, massive multiple-input and multiple-output (MIMO), and full-dimensional multiple-output (FD). Technologies such as full dimensional MIMO (MIMO), array antenna, analog beam-forming, or large scale antenna may be supported. The wireless communication module may support various requirements defined for the server 100, external electronic devices, or network systems. In one embodiment, the wireless communication module may support peak data rate for realizing eMBB, loss coverage for realizing mMTC, or U-plane latency for realizing URLLC.

The antenna module 160 may transmit a signal or power to an external electronic device or receive it from the outside. In one embodiment, the antenna module 160 may include an antenna including a radiator formed of a conductor or a conductive pattern formed on a substrate. In one embodiment, the antenna module 160 may include a plurality of antennas. In this case, at least one antenna suitable for a communication method used in a communication network such as a network may be selected from the plurality of antennas by, for example, the communication module 150 . A signal or power may be transmitted or received between the communication module 150 and an external electronic device through the selected at least one antenna.

In one embodiment, commands or data may be transmitted or received between the server 100 and the user electronic device 200 connected to the network. The server 100 may be the same as the user electronic device 200 or a different type of device. In one embodiment, all or part of operations executed in the server 100 may be executed in the user electronic device 200 .

For example, when server 100 is required to perform a function or service automatically or in response to a request from a user or other device, server 100 instead of executing the function or service itself or Additionally, one or more external electronic devices may be requested to perform the function or at least part of the service. One or more external electronic devices receiving the request may execute at least a part of the requested function or service or an additional function or service related to the request, and deliver the execution result to the server 100 . The server 100 may provide the result as at least a part of a response to the request as it is or additionally processed. To this end, for example, cloud computing, distributed computing, mobile edge computing (MEC), or client-server computing technology may be used. The server 100 may provide an ultra-low latency service using, for example, distributed computing or mobile edge computing.

Each component included in the server 100 is connected to a communication path connecting software modules or hardware modules inside the device and can organically operate with each other. These components may communicate using one or more communication buses or signal lines. Each component of the server 100 means a unit that processes at least one function or operation, and may be implemented as a software module, a hardware module, or a combination of software and hardware.

The server 100 may have the same configuration as a conventional web server or WAP server in terms of hardware. However, in terms of software, it may include a program module that is implemented through any language such as C, C++, Java, Visual Basic, or Visual C and performs various functions. In addition, the server 100 is generally connected to an unspecified number of clients and/or other servers through an open computer network such as the Internet, receives a request for performing a task from a client or other server, and derives and provides a task result for it. It means a computer system and the computer software (server program) installed for it. In addition, the server 100, in addition to the above-described server program, a series of application programs that operate on the server 100 and various databases (DB: Database, hereinafter referred to as It should be understood as a broad concept including "DB").

3 is a block diagram for explaining an artificial intelligence module implemented in a processor of a server. FIG. 4 is a diagram for explaining the structure of the multilayer neural network of FIG. 3 .

Referring to FIG. 3 , the processor 110 may include a multilayer neural network 111 and a learning engine 112 .

The learning engine 112 may pre-supervise the multilayer neural network 111 using a plurality of training data. A multilayer neural network is a predictive model implemented in software or hardware that mimics the computational power of a biological system by using a large number of artificial neurons (or nodes).

The learning engine 112 takes the data value received by the server 100 as an input value and calculates it by the processor 110 so that the multilayer neural network 111 can accurately generate a content selection signal based on the learning data. The multilayer neural network 111 may be supervised using learning data having a threshold value as an output value. Data values and thresholds will be described later.

At this time, supervised learning means learning to find an output value according to a given input value by using data with input values and corresponding output values as learning data, and means learning that takes place in a state where the correct answer is known. The set of input values and output values given in supervised learning is called training data.

Referring to FIG. 6 , the multilayer neural network 111 may include an input layer 111_a, one or more hidden layers 111_b, and an output layer 111_c.

In one embodiment, the multilayer neural network 111 receives an input value and multiplies an input layer 111_a having nodes corresponding to the number of components of the first feature vector and an output value of the input layer 111_a by a weight, Multiplying weights for each output value of a first hidden layer and output values of the first hidden layer after adding a bias, multiplying weights for each output value of a second hidden layer and output values of the second hidden layer after adding a bias; , may include an output layer (output layer) 111_c that outputs the result using an activation function. Although only two hidden layers are shown in FIG. 6 , one or more hidden layers 111_b may include a larger number of hidden layers in addition to the first hidden layer and the second hidden layer.

For example, the activation function may be a Softmax function, but embodiments of the present invention are not limited thereto, and the activation function may be various other functions such as a LeRU function. Weights and biases can be continuously updated by supervised learning.

Specifically, the output vector may be input to a loss function layer connected to the output layer 111_c. The loss function layer may output a loss value using a loss function that compares an output vector with a correct answer vector for each training data. Parameters of the multilayer neural network 111 may be supervised in a direction in which a loss value decreases.

For example, the loss function layer can calculate a loss value according to [Equation 1]. In [Equation 1], N is the number of a plurality of training data, n is a natural number identifying the learning data, k is a natural number identifying the value of the nth learning data, nk is the kth value of the nth learning data , t may mean correct answer data, y may mean an output vector, and E may mean a loss value.

Alternatively, the loss function layer may calculate a loss value according to [Equation 2]. In [Equation 2], n is the number of training data for each class, y and j are identifiers representing classes, C is a constant value, M is the number of classes, x_y is the probability that the training data belongs to class y, x_j is learning A probability value, L, that data belongs to class j may mean a loss value.

To this end, the processor 110 may include an artificial intelligence machine learning model. When the server 100 is implemented as hardware, the processor 110 may include a hardware structure specialized for processing a machine learning model. Machine learning models can be created through artificial intelligence machine learning.

The machine learning algorithm may include, for example, supervised learning, unsupervised learning, semi-supervised learning or reinforcement learning, but the foregoing example not limited to The artificial intelligence model may include a plurality of artificial neural network layers. Artificial neural networks include deep neural networks (DNNs), convolutional neural networks (CNNs), recurrent neural networks (RNNs), restricted boltzmann machines (RBMs), deep belief networks (DBNs), bidirectional recurrent deep neural networks (BRDNNs), It may be one of deep Q-networks or a combination of two or more of the foregoing, but is not limited to the foregoing examples. The artificial intelligence model may include, in addition or alternatively, software structures in addition to hardware structures.

The processor 110 may be manufactured in the form of at least one hardware chip and mounted in a device. For example, the processor 110 may be manufactured in the form of a dedicated hardware chip for artificial intelligence (AI), or a conventional general-purpose processor (eg, CPU or application processor) or graphics-only processor (eg, GPU). ) and may be mounted on various devices described above.

In this case, the processor 110 may be mounted on one device or may be mounted on a separate device. Meanwhile, the learning model of the processor 110 may be implemented as a software module. When the learning model is implemented as a software module (or a program module including instructions), the software module may be stored in a computer-readable, non-transitory computer readable media. there is. Also, in this case, at least one software module may be provided by an Operating System (OS) or a predetermined application. Alternatively, some of the at least one software module may be provided by an Operating System (OS), and the other part may be provided by a predetermined application.

5 is a flowchart illustrating a data monitoring method according to an embodiment of the present invention. 6 is a graph showing data values received by the server. 7 is a graph showing data values received by the server.

Referring to FIG. 5, first, in step S510, the processor 110 receives at least one piece of data individually at predetermined intervals according to the type of data to generate a data value, and creates a data set that is a set of data values. .

Data received from the plurality of user electronic devices 200 by the server 100 may vary. Data received by the server 100 from the plurality of user electronic devices 200 may include at least one of Performance, Process, Log, Filesystem, Ping, and PortScan. The server 100 may receive each data from the plurality of user electronic devices 200 at preset intervals. In this case, the period may be different depending on the type of data. For example, in the case of 'Performance' data, the reception period may be 60 seconds. In the case of 'Process' data, the reception period may be 20 seconds. In the case of 'Filesystem' data, the reception period may be 60 seconds. Data received at each time may be received as a 'data value' having a real number value. In this case, the parameter of each data value may be different according to the type of data.

The data value may include an n-th data value received at the n-th time. That is, the data values include the first data value received at the first time, the second data value received at the second time, the third data value received at the third time, ??, and the n-1th time received. It may include the n−1 th data value and the n th data value received at the n th time. Here, n is a natural number, and the nth period may be a period subsequent to the n−1th period. The data management unit 130 may create a data set based on the received data values. A data set may include information about a unique data type.

6 shows data values received by the server 100 over time for specific data. The reception period of data shown in FIG. 6 is T. Referring to FIG. 6 , the sizes of data values received at the first time (1 on the t-axis) to the fifth time (5 on the t-axis) may be different. The maximum value of the data values received from the first time (1) to the fifth time (5) is the data value (D(3)) received from the third time (3), and the first time (1) to the fifth time (5). The minimum value of the data values received in (5) is the data value D(2) received in the second period (2).

In one embodiment, processor 110 may calculate a safe range based on the data values. Here, the safe range may mean a normal range in which data values may be distributed with respect to specific data received by the server 100 . That is, when the data value received by the server 100 from the user electronic device 200 falls within the safe range, the processor 110 of the server 100 determines that no error has occurred in the user electronic device 200. can However, this is just an example, and the processor 110 of the server 100 may further analyze various data and determine whether an error has occurred in the user electronic device 200 based on the analysis result.

In one embodiment, the safe range may be calculated based on a maximum value and a minimum value of data values received in a specific time interval. Specifically, the safety range is a value obtained by adding the standard deviation of the data values received in the specific time interval to the maximum value of the data values received in the specific time interval, and the minimum value of the data values received in the specific time interval plus the standard deviation of the data values received in the specific time interval. It can be calculated based on the value obtained by subtracting the standard deviation of the data values.

For example, the safety range may be calculated based on the data value D(2) received at the second time period 2 and the data value D(3) received at the third time period . In this case, the safety range is from the value obtained by subtracting the standard deviation of the data values received at the first time (1) to the fifth time (5) from the data value received at the second time (2), and at the third time (3). It can be calculated as a range from the data value received at ) to the value obtained by adding the standard deviation of the data values received at the first time (1) to the fifth time (5).

In step S520, the processor 110 compares data values of the data set with threshold values corresponding to the data values, and outputs a comparison result.

Here, the threshold value may be a reference value for determining whether data values received by the server 100 from the user electronic device 200 are within a normal range.

The threshold value (v_T) is a first threshold value corresponding to the first data value, a second threshold value corresponding to the second data value, a third threshold value corresponding to the third data value, ??, n-1 An n-1 th threshold corresponding to the data value and an n th threshold corresponding to the n th data value may be included. In this case, the processor 110 may compare the first data value with the first threshold value and output a comparison result. Also, the processor 110 may compare the second data value with the second threshold value and output a comparison result. Similarly, the processor 110 may compare the n-th data value with the n-th threshold value and output a comparison result.

In one embodiment, the n-th threshold is the first data value (D(1)) received at the first time among the data values included in the data set to the n-1th data received at the n-1th time. It can be determined by the values D(n-1). Specifically, the processor 110 may calculate the nth threshold as a value obtained by adding a correction coefficient to the maximum value of the safety range described above with reference to FIG. 6 .

In another embodiment, the nth threshold may be determined by at least one of the first to n−1th thresholds. Specifically, the nth threshold may be determined based on the first to n−1th thresholds. Referring to FIG. 7 , the processor 110 may determine a third threshold based on the first threshold and the second threshold, and determine a fourth threshold based on the first to third thresholds. there is. That is, the processor 110 may calculate a threshold corresponding to a data value received by the server 100 after a specific time interval based on the threshold calculated during the specific time interval.

The processor 110 may calculate the n-th threshold value using [Equation 3].

In [Equation 3], vT(n) is the nth threshold value, D(n) is the nth data value, n is a natural number of 2 or more indicating the time at which data is received, and c may mean a correction coefficient. .

Through [Equation 3], the processor 110 adjusts the size of the threshold based on the sizes of the 1st to n-1th data values received before the nth time period, that is, at the 1st to n−1th times can Accordingly, as shown in FIG. 7, when a large data value (sixth data value D (6) in FIG. 7) is received at a specific time (sixth time (6) in FIG. 7), this is reflected. Thus, the threshold can be raised.

In step S530, the processor 110 may transmit a notification signal to the user electronic device based on the comparison result.

As described above, the monitoring method of the present invention may monitor data by changing a threshold value serving as a comparison standard in real time according to a change in data received from the server. Accordingly, a notification signal notifying that an abnormal operation has occurred can be generated more accurately, and appropriate feedback can be provided according to changes in the network environment.

The embodiments described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components. For example, the devices, methods and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate (FPGA). array), programmable logic units (PLUs), microprocessors, or any other device capable of executing and responding to instructions. A processing device may run an operating system (OS) and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of software. For convenience of understanding, there are cases in which one processing device is used, but those skilled in the art will understand that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that it can include. For example, a processing device may include a plurality of processors or a processor and a controller. Other processing configurations are also possible, such as parallel processors.

Software may include a computer program, code, instructions, or a combination of one or more of the foregoing, which configures a processing device to operate as desired or processes independently or collectively. The device can be commanded. Software and/or data may be any tangible machine, component, physical device, virtual equipment, computer storage medium or device, intended to be interpreted by or provide instructions or data to a processing device. , or may be permanently or temporarily embodied in a transmitted signal wave. Software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer readable media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program commands recorded on the medium may be specially designed and configured for the embodiment or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with limited drawings, those skilled in the art can apply various technical modifications and variations based on the above. For example, the described techniques may be performed in an order different from the method described, and/or components of the described system, structure, device, circuit, etc. may be combined or combined in a different form than the method described, or other components may be used. Or even if it is replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents of the claims are within the scope of the following claims.

Claims (5)

generating a data value by receiving at least one piece of data from a user electronic device at intervals individually preset according to the data type, and generating a data set including the data value;
comparing the data values of the data set with threshold values corresponding to the data values and outputting comparison results;
Transmitting a notification signal to the user electronic device based on the comparison result; including,
The data values include first through n-th data values received at first through n-th times, the n-th period following the n-1th period, n being a natural number greater than or equal to 2;
The threshold includes first to nth thresholds corresponding to the first to nth data values, respectively;
[mathematical expression]

The nth threshold is calculated by the [Equation Equation], where vT(n) is the nth threshold value, D(n) is the nth data value, and n is the received data value. A natural number of 2 or more denoting the period, c denotes a correction factor,
A dynamic threshold-based real-time data monitoring method. According to claim 1,
The nth threshold is determined by the first to n-1th thresholds,
A dynamic threshold-based real-time data monitoring method. According to claim 1,
The nth threshold is determined by the first to n−1th data values among the data values included in the data set.
A dynamic threshold-based real-time data monitoring method. According to claim 3,
The nth threshold is based on the maximum value of the first to n−1 th data values, the minimum value of the 1st to n−1 th data values, and the standard deviation of the first to n−1 th data values. produced,
A dynamic threshold-based real-time data monitoring method. According to claim 4,
Further comprising: correcting the n-th threshold value by a processor;
The processor may include a multi-layer neural network including an input layer, one or more hidden layers, and an output layer; and superparameters optimized based on the training data by supervising the multilayer neural network using training data having the first to n−1 th data values as input values and the n th threshold value as an output value. Including; a learning engine that calculates
The input layer receives the first to n−1 th data values, the one or more hidden layers multiply output values of the input layer by a weight, add a bias, and output the output values. The output value of the hidden layer is input and an output vector is output using an activation function.
The multilayer neural network includes a loss function layer connected to the output layer, the output vector is input to the loss function layer, and the loss function layer compares the output vector with a correct answer vector for each feedback data. A loss value is output using , and the parameters of the multilayer neural network are learned in a direction in which the loss value decreases.
A dynamic threshold-based real-time data monitoring method.

Images