KR102576390B1 - Method and apparatus for reducing false alarm based on statics analysis - Google Patents

Abstract

A method for reducing false alarms according to an aspect of the present invention includes the steps of, by an anomaly detection device, estimating the distribution of false alarms by analyzing data in a normal state; and monitoring by the anomaly detection device according to a preset standard. Determining whether target data is abnormal and comparing, by the anomaly detecting device, the frequency of data determined to be abnormal and the distribution of the false alarms to determine whether the data determined to be abnormal is false or abnormal; and The method may include not generating an alarm when the data determined to be abnormal is false or abnormal.

Description

Method and apparatus for reducing false alarm based on statics analysis {Method and apparatus for reducing false alarm based on statics analysis}

The present invention relates to a method and apparatus for reducing false alarms based on statistical analysis. More specifically, it relates to a method for filtering false alarms in consideration of the statistical distribution of Type I errors and an apparatus for performing the method.

One of the most important factors to secure a company's competitiveness is to prepare a stable process system to produce high-quality products. A high level of process and quality control can contribute not only to short-term aspects such as cost reduction and profit increase, but also to strengthening corporate competitiveness in the global era by increasing customer satisfaction and enhancing corporate image.

Many manufacturers are introducing a process anomaly detection system (Anomaly Detection System) for detecting anomalies that may occur in the process in order to prepare a stable process system. A process abnormality detection system is a system that monitors the state of the process, the quality of processed products, and the condition of equipment, detects abnormalities, and blocks risk factors in advance.

However, as the production system becomes more sophisticated, the monitoring data from the production process is also becoming very complex and voluminous. Therefore, existing monitoring methods based on univariate/multivariate control charts, such as the Shewhart x-bar control chart and Hotelling's T ² control chart, have limitations in handling the characteristics of such large-scale data.

One of the biggest problems of existing statistical hypothesis test-based methods is that they are vulnerable to false alarms. Here, the false alarm refers to giving an alarm that the process is abnormal even though it is actually in a normal state. This is also called a Type I error. It is a case where it was judged to be in an abnormal state according to a certain standard, but the judgment was wrong.

When an alarm occurs, the process stops the equipment and determines the cause. Therefore, if false alarms occur frequently, it will cause inconvenience to users of the anomaly detection system. In addition, production and management costs are increased at the production site, resulting in lowering the reliability of the anomaly detection system itself, like a shepherd boy.

In addition, the field of data collection as well as monitoring for process control is diversifying, and the application field for utilizing it is continuously increasing. For example, there are uses such as checking a health condition using a wearable device, detecting an abnormal behavior using an image captured by a camera, or detecting leakage of harmful substances in the air.

Statistical hypothesis test-based methods can be applied when data is collected in various fields, and monitoring or anomaly is detected using the collected data. Accordingly, there is a need for a method to minimize false alarms and notify abnormal conditions at a level suitable for the user according to the monitoring target.

KR 10-2009-0002106 A "Semiconductor manufacturing facility management system and statistical process management method" (2009.01.09) KR 10-2014-0031075 A "Qualitative fault detection and classification system for tool condition monitoring and associated method" (2014.03.12)

A technical problem to be solved by the present invention is to provide a method for reducing false alarms based on statistical analysis and an apparatus for performing the method.

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the description below.

A false alarm reduction method according to an aspect of the present invention for solving the above technical problem includes the steps of, by an anomaly detection device, estimating a distribution of false alarms by analyzing data in a normal state, and the anomaly detection device , Determining whether the data to be monitored is abnormal according to a predetermined criterion, and the anomaly detection device compares the frequency of the data determined to be abnormal with the distribution of the false alarms, and the data determined to be abnormal is false. The method may include determining whether there is an anomaly and not generating an alarm when the anomaly detection device is false or anomaly.

In one embodiment, the step of estimating the distribution of false alarms by analyzing the steady-state data may include estimating the distribution of false alarms as one of a binomial distribution or a Poisson distribution by analyzing the steady-state data. steps may be included.

In another embodiment, the step of determining whether the data determined to be abnormal is false or abnormal is the number i of data determined to be abnormal among a total of k pieces of data from the n-th data to the n-k+1-th data i The step of counting and calculating the frequency of data determined to be abnormal at the n-th time point using the value of i and the value of k, and when the data at the n-th time point is determined to be abnormal, the n-th The method may include determining whether the data at the n-th point in time is false or abnormal by using a frequency of data determined to be abnormal at the point in time.

In another embodiment, the step of determining whether the data judged to be abnormal is false or abnormal among a total of k pieces of data from the n+h th point to the n+h−k+1 th point of time data. The step of counting the number j of the detected data, the step of calculating the frequency of the data determined to be abnormal at the n + h time point using the value of j and the value of k, and the data at the n + h time point If it is determined to be abnormal, the method may further include determining whether the data at the n+h time point is false or abnormal using a frequency of the data determined to be abnormal at the n+h point in time.

In another embodiment, the distribution of the false alarms is a binomial distribution, and the step of determining whether the data judged to be abnormal is a binomial distribution by calculating the frequency of the data determined to be abnormal by an equation of the cumulative probability function of the binomial distribution. Including the step of calculating, where k is the number of data determined to be abnormal, n is the number of data subject to monitoring, and p is the false alarm probability of the binomial distribution.

In another embodiment, the distribution of the false alarms is a Poisson distribution, and the step of determining whether the data determined to be abnormal is a false abnormality, the frequency of the data determined to be abnormal is determined by the formula of the cumulative probability function of the Poisson distribution Calculating, wherein k is the number of data determined to be abnormal, and μ is the false alarm probability of the Poisson distribution.

In another embodiment, the step of determining whether the data judged to be abnormal is false or more, by comparing the value of 1-Pr(X<k) with a preset significance probability α, When the value is greater than α, a step of determining that the value is false or higher may be further included.

In another embodiment, the step of determining whether the data judged to be abnormal is false or more, by comparing the value of 1-Pr(X<k) with a preset significance probability α, When the value is smaller than α, the step of determining that the value is greater than true may be further included.

In another embodiment, the method may further include generating an alarm when the data determined to be abnormal are true abnormalities rather than false abnormalities.

Effects according to an embodiment of the present invention are as follows.

Using the present invention, the probability of false alarm that can occur even when observations are in a steady state can be modeled as a representative categorical statistical distribution, such as a binomial distribution or a Poisson distribution. . Through this, it is possible to classify true and false alarms based on probability by measuring the sparsity of alarms that may occur within a specific window.

Alarms with a high probability of being false alarms are filtered out, and only alarms with a high probability of being true alarms can actually provide an alarm. Alarm is a major factor that prompts users or engineers to take action in monitoring, and since it has a great impact on the company's revenue generation and service and process stability, reducing the rate of false alarms directly leads to product quality improvement. can lead

As such, using the false alarm filtering method proposed in the present invention, accuracy and reliability of information generated from monitoring can be improved. Improvement in accuracy and reliability of information generated from monitoring reduces management costs and has the effect of improving productivity.

The effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

1A to 1B are diagrams for explaining a method for detecting an anomaly based on a conventional management limit line.
2 is a flowchart of a false alarm reduction method based on statistical analysis according to an embodiment of the present invention.
3 is a conceptual diagram illustrating a false alarm reduction method based on statistical analysis according to an embodiment of the present invention.
4A to 4C are formulas for obtaining distribution probabilities of false alarms according to an embodiment of the present invention.
5A to 5B are diagrams for explaining a moving window that may be used in an embodiment of the present invention.
6 to 8 are diagrams for explaining the effect of a false alarm reduction method according to an embodiment of the present invention.
9 is a hardware configuration diagram of an apparatus for reducing false alarms based on statistical analysis according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Advantages and features of the present invention, and methods for achieving them, will become clear with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only the present embodiments make the disclosure of the present invention complete, and common knowledge in the art to which the present invention belongs. It is provided to fully inform the holder of the scope of the invention, and the present invention is only defined by the scope of the claims. Like reference numbers designate like elements throughout the specification.

Unless otherwise defined, all terms (including technical and scientific terms) used in this specification may be used in a meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless explicitly specifically defined. Terms used in this specification are for describing embodiments and are not intended to limit the present invention. In this specification, singular forms also include plural forms unless specifically stated otherwise in a phrase.

As used herein, "comprises" and/or "comprising" means that a stated component, step, operation, and/or element is the presence of one or more other components, steps, operations, and/or elements. or do not rule out additions.

Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings.

1A to 1B are diagrams for explaining a method for detecting an anomaly based on a conventional management limit line.

Referring to FIG. 1A , an index from 0 to 1,000 is displayed on the x-axis, and a value from 0 to 9 is displayed on the y-axis. The x-axis is a collection of 1,000 pieces of monitoring data according to a pre-determined period, and the value at that time is displayed on the y-axis as a value from 0 to 8.

At this time, the management limit line (111; threshold) is set to a value of 6. That is, if the monitoring data has a value greater than 6, it is judged as abnormal and an alarm is generated. However, as can be seen in FIG. 1A , no abnormality actually occurs among values exceeding 6. Although the control limit line 111 is set to 6, it can be seen that many false alarms occur.

As such, most of the conventional monitoring methods compare a value measured using a sensor or the like with a preset management limit line 111 to determine whether there is an abnormality. An abnormality is detected using an upper limit line, a lower limit line, or a band-type management limit line having both upper and lower limits.

However, when an abnormality is detected using the control limit line 111 in this way, a false alarm may be generated due to an error in a parametric assumption about the population distribution. For example, if the anomaly detection system is designed assuming a normal distribution, but the actual data does not follow the normal distribution, a lot of actual data outside the control limit 111 is inevitable, which leads to false alarms.

Also, even when monitoring statistics follow typical characteristics of modern data, false alarms can be high. Examples include non-normality, non-linearity, multimodality, and time-varying properties.

In particular, the type of problem that has been raised most recently is when the characteristics of observations that change in various forms over time are not properly considered. If the characteristics of these data are not properly reflected, numerous monitoring errors will occur in the actual production environment.

Referring to FIG. 1B , it can be seen that the control limit line 111 is set to a value of 8. Since the control limit line 111 is set higher than that of FIG. 1A , the alarm is reduced to occur only twice between the 600 and 800 indexes. Even this, however, amounts to a false alarm.

As can be seen in the example of FIG. 1A or 1B, whether or not an alarm is determined depending on how the management limit line 111 is set. When the value of the control limit line 111 is 6, many false alarms may occur, and when the value of the control limit line 111 is 8, false alarms may be somewhat reduced.

As such, the conventional anomaly detection method based on the control limit line 111 attempts to reduce false alarms by appropriately setting the value of the control limit line 111 . However, this method has limitations. This is because if the control limit 111 is set too high in order to reduce false alarms, abnormality detection may not be performed properly. That is, a type 2 error may occur in which the error is not detected as an error even though it is actually an error.

If you try to reduce false alarms using the control limit line 111, the sensitivity of monitoring will decrease. Existing management techniques based on statistical hypothesis testing have trade-off characteristics between the sensitivity of monitoring and the occurrence of false alarms. Therefore, there is a limit in which false alarms cannot be lowered below a certain level of management area (Expected false alarm rete).

No monitoring technique with good performance can reduce false alarms below the significance level set by the user. For example, if the false alarm rate expected by the user is set to 5%, about 50 false alarms may occur during 1,000 processes. Of course, if the false alarm rate is set to 1% to reduce false alarms, the number of false alarms can be reduced to about 10 while the process is performed 1,000 times.

As such, the 1% or 5% false alarm rate (Type I Error Rate) commonly used in monitoring is somewhat unreasonable for actual process engineers to accept as a maintenance measure. Because despite the most ideal process, 1 to 5 false alarms can occur out of 100 monitoring times. because it also increases. If a lot of false alarms keep going off, engineers sometimes turn off the alarms in advance.

The reason why Statistical Quality Control (SQC), Statistical Process Control (SPC), and Condition Based Maintenance (CBM) using previously used statistical verification methods are neglected in the field because false alarms occur too often.

As such, fundamental limitations of statistics apply equally to the monitoring problem, making it difficult to utilize them practically. Therefore, a method to solve the limitations of monitoring problems such as statistical quality control and process control is needed. In other words, there is a need for a way to reduce false alarms while maintaining the sensitivity of monitoring.

2 is a flowchart of a false alarm reduction method based on statistical analysis according to an embodiment of the present invention.

In order to solve the fundamental problem of the conventional statistical hypothesis verification method, the method proposed by the present invention applies the concept of sparsity of information occurrence to monitoring. By defining a categorical distribution that occurs within a specific interval, the true or false probability of an alarm is calculated, and based on this, whether or not an actual alarm is determined is determined.

The Type I error rate or false alarm rate is called alpha (α). In the most ideal process situation, a false alarm is generated according to the pre-set alpha value. For example, assuming that the significance probability is set to 0.05 and the normal feature value of 100 observations is monitored, the ideal monitoring result is that about 5 false alarms occur.

In terms of run length, the logic is that about 1 false alarm can occur for every 20 runs. Assuming that each trial of the monitoring is Bernoulli performance, as a result, a binomial distribution with n = 100, p = significance probability (0.05), and q = 1-p can be derived.

That is, while n observations pass, the probability that an observation triggers a false alarm or true alarm follows a binomial distribution, so it is possible to use this to obtain a false alarm probability and finally determine whether to sound an alarm. That is, if the probability of a false alarm is high, it can be filtered out so that it does not actually sound an alarm.

A similar effect can be expected by relaxing the assumption more realistically and learning the alarm frequency that occurs within a specific time or space as a Poisson Distribution rather than based on the number of trials as the standard for actual quality characteristic monitoring. there is. This can also be obtained from the false alarm probability by the Poisson distribution with n = 100 and μ = 5.

In this way, the probability of false alarms can be calculated based on the alarm frequency within a specific number or period by utilizing the binomial distribution or Poisson distribution. In addition, rather than sounding an alarm immediately when the statistics exceed the threshold, that is, the control limit, the false alarm rate can be reduced while securing the sensitivity of monitoring as the final alarm sounding by considering the distributional characteristics of the occurrence frequency. .

Referring to FIG. 2 , the method for reducing false alarms proposed in the present invention first collects normal pattern data (S1100). Since the method proposed in the present invention is a method for reducing false alarms without changing the control limit line 111, monitoring data is collected in a state in which there is no particular abnormality in the process.

In fact, since the monitoring data was collected while the process was normal, all alarms that occurred among the collected data corresponded to false alarms. At this time, the frequency of false alarms is estimated based on the moving window (S1200). The moving window means a certain period of observation data.

For example, the probability of a false alarm is calculated based on measurement data from 1 to 200 index. Next, the probability of a false alarm is calculated based on the measured data from the 2 to the 201 index. Next, the probability of a false alarm is calculated based on the measurement data from index 3 to index 202. In this way, the probability of a false alarm is calculated while moving the interval.

Through this learning, after calculating the probability of a false alarm within a certain size of a moving window, that is, a certain period, in advance, monitoring data required to detect an actual anomaly is collected (S1300). Next, using the probability of a false alarm calculated in advance, a probability that an abnormality detected in the current monitoring data is a false alarm is obtained, and based on this, whether or not an actual alarm is determined is determined (S1400).

Conventional anomaly detection methods inevitably generate alarms of a certain level even though they are normal according to a set false alarm rate. If you adjust the false alarm rate to adjust the alarm level, there is a risk of not detecting the true alarm. In other words, sensitivity and false alarm reduction are trade-offs.

Therefore, as a representative technique for reducing false alarms, there is a method of filtering out meaningless parameters, such as mean and variance, by tracking changes in the process by improving statistics. In addition, there is a method of accurately inferring an upper control limit (UCL) and a lower control limit (LCL) through nonparametric estimation of a normal distribution. In addition, there is a method of removing indiscriminate abnormal patterns by combining data mining techniques with existing monitoring.

However, since all of these methods are methods for detecting abnormalities based on a specific management limit line, limitations of the methodology of threshold-based alarm determination still exist. In particular, there are many cases in which data to be monitored have time-series correlation, and in most cases, existing techniques assume the consistency of process change, that is, that all observations are independent of each other.

So, in the end, the logic of the existing techniques has a limit in that the preset false alarm rate cannot be fundamentally avoided by acknowledging and accepting the limitations of significant probability-based decision-making in current statistics. It can be seen as an original sin that occurs because it is judged whether it is abnormal based on the control limit line.

In order to solve this problem, the method proposed by the present invention is a method for solving a fundamental problem arising from existing statistical hypothesis testing. This is to reflect the categorical distribution, which is the statistical distribution of false alarms, to monitoring. When an abnormality occurs in a facility or process, since the abnormality does not occur one-time as in the false alarm of FIG. This can lead to securing the reliability of monitoring itself.

If the method of the present invention is applied to most common statistical monitoring techniques, such as process monitoring, statistical quality control techniques, health care monitoring for patient conditions, predictive maintenance of expensive equipment/production facilities, hacking intrusion detection, fraudulent use of cards, etc. You can reduce the occurrence of false alarms and notify only true alarms as alarms.

If the probability of a false alarm is obtained by utilizing the characteristics of various categorical distributions, it is used not only for properly filtering out false alarms, but also for various preprocessing techniques of data analysis in that existing continuous variables can be converted into categorical probability distributions. can also be utilized. In particular, it has the advantage of being able to adjust the alarm sensitivity to a desired level, going further than the existing technique.

3 is a conceptual diagram illustrating a false alarm reduction method based on statistical analysis according to an embodiment of the present invention.

Referring to FIG. 3 , the method for reducing false alarms proposed in the present invention largely goes through two steps. Phase 1 of FIG. 3 is a learning phase, and Phase 2 is an application phase. The learning step is a step of learning the probability of a false alarm in the normal state data, i.e., when no anomaly has actually occurred, and the application step is to first determine whether or not there is an anomaly using the control limit line for the data being monitored, and then If it is determined, it is a step of obtaining a probability that the corresponding abnormality is a false alarm and filtering if it is a false alarm.

First of all, the learning phase, which is Phase 1, learns normal patterns. That is, normal data is collected. This is to collect monitoring data that has occurred in the past, but it should be data that has not actually occurred. In other words, it collects data that only generated false alarms. This can be referred to as primary monitoring.

Next, check the alarm occurrence information in the primary monitoring data. In other words, it checks when a false alarm occurred. And using this, the probability of a false alarm is calculated based on the moving window. At this time, the binomial distribution or Poisson distribution can be used as the distribution of false alarms.

The information on the frequency of false alarms learned in this way can be used as a criterion for determining whether to sound an actual alarm in the application phase of Phase 2 later. To put it simply, after learning "If you observe 100 data when it is normally normal, there are 5 false alarms", if an abnormality is detected more than 5 times within 100 moving windows, it is regarded as an actual abnormality and an alarm is generated. is to do This reduces false alarms while maintaining sensitivity.

Of course, this is an example of simply comparing the frequency of false alarms in the learned model and the frequency of anomaly detection in the observed data for better understanding. . A configuration for determining whether or not to give an alarm based on the distribution of false alarms will be described in detail later with reference to FIGS. 4A to 4C.

Looking at the application step, which is Phase 2 of FIG. 3 , the process of applying to actual monitoring data can be seen. Monitoring data for actual application is data in which abnormal or normal data are mixed. At this time, the control limit line is primarily used to detect abnormalities.

Next, the alarm information learned in the phase 1 learning phase is used. That is, based on the moving window, the number of times an abnormality outside the management limit line is detected within the recently determined number of observation data is counted. The value counted in this way is compared with the frequency of false alarms obtained in the previous learning step, and finally whether to generate an alarm is determined.

If the alarm frequency is greater than the false alarm frequency, it is regarded as an actual abnormality and an alarm is generated, and if the alarm frequency is less than the false alarm frequency, it is still regarded as a false alarm and filtered so that no alarm actually occurs. In the method shown in FIG. 3 , an alarm actually occurs only when an abnormality is detected at a frequency higher than the false alarm frequency learned in the learning phase, which is Phase 1, within the moving window.

4A to 4C are formulas for obtaining distribution probabilities of false alarms according to an embodiment of the present invention.

In general, under ideal process conditions, a false alarm is generated according to a pre-set alpha value. For example, if the significance probability is set to 0.05, a value exceeding the control limit line 111 may occur about 5 times out of 100 observation data, even though there is actually no abnormality. In other words, the probability that an observation triggers a false alarm during n observations follows a binomial distribution.

Referring to FIG. 4A , a cumulative probability function in the case of using a binomial distribution can be seen. That is, assuming that each attempt to measure data for monitoring follows Bernoulli performance, as a result, when the number of data measurements n, the number of false alarms k, and the false alarm probability p are assumed, the cumulative probability function as in the formula of FIG. 4a (Cumulative Distribution Function) is displayed.

In a binomial distribution, when the number of trials n is very large and the false alarm probability p is very small, the binomial distribution can be expressed as a Poisson distribution. In other words, more flexible results can be obtained if learning is based on the frequency of alarm occurrence within a specific time rather than based on the number of attempts. Referring to FIG. 4B , a cumulative probability function in the case of using a Poisson distribution can be seen.

In FIG. 4B , when n is very large and p is small, a specific random variable x can be approximated as μ=np. That is, if there are many monitoring observation sites and the preset false alarm rate is small, it is okay to estimate the Poisson distribution, which is easier to calculate than the binomial distribution.

As such, the critical value of the binomial distribution or Poisson distribution can be set as a value for determining whether an alarm is generated. For example, n and p of the binomial distribution or μ of the Poisson distribution can be calculated using normal pattern data in the phase 1 learning phase. Therefore, Phase 1, the learning phase, is to generate statistics about the frequency of false alarms that occur when monitoring is applied to normal data.

The process of applying n and p of the binomial distribution or µ of the Poisson distribution to actual monitoring is Phase 2, the application phase. First, an anomaly is detected according to the alpha value previously set for monitoring. That is, when observation data outside the management limit line 111 occurs, it is primarily determined to be abnormal.

And, if the number of observation data determined to be abnormal among the recent n observation data is greater than the false alarm pattern, it is regarded as an actual abnormality and an alarm is sounded. To do this, in the phase 1 learning phase, the statistical parameters (n, p) of the binomial distribution or the statistical parameters (μ) of the Poisson distribution are obtained.

Referring to FIG. 4C , it is possible to see a formula for determining whether an abnormality currently occurring in the application phase of Phase 2 is false or true. When there are a number of observed anomalies among the latest n observation data, using the formulas shown in FIGS. 4A to 4B , the cumulative probability Pr(X<a) of generally occurring false alarms in a normal state can be obtained.

Subtract this value from 1, i.e. =1-Pr(X<a) is compared with the alpha value set by the user to finally decide whether or not to sound an alarm. If the value of =1-Pr(X<a) is smaller than the alpha value, it is judged to be abnormal and an alarm sounds, If the value of =1-Pr(X<a) is greater than the alpha value, it is judged to be false and an alarm is not sounded.

The reason for subtracting from 1 after finding the cumulative probability of false alarms Pr(X<a) is to compare with the alpha value. To explain this in more detail, let's take a look at Table 1, which summarizes the binomial distribution table for n = 20.

(n=20) x p=0.05 p=0.10 p=0.15 0 0.3585 0.1216 0.1368 One 0.3774 0.2702 0.2293 2 0.1887 0.2852 0.2428 3 0.0596 0.1901 0.1821 4 0.0133 0.0898 0.1028 5 0.0022 0.0319 0.0454 6 0.0003 0.0089 0.0160 7 0.0000 0.0020 0.0046 8 0.0000 0.0004 0.0011 9 0.0000 0.0001 0.0002 10 0.0000 0.0000 0.0000

For convenience of understanding, the description continues based on 20 measurement data. Let's assume that the probability of a false alarm is 0.05 when the probability of a false alarm is calculated in the learning phase, which is Phase 1, and when n=20, that is, when data is observed 20 times. In general, since the false alarm rate is set to about 5%, a false alarm may occur about 1 time out of 20 observation data.

Next, let's assume that monitoring is performed on actual data in Phase 2, the application phase. At this time, data is collected in real time according to a pre-set period, compared with the control limit line, and an abnormality is judged when the control limit is exceeded. This was performed in a conventional monitoring method based on statistical hypothesis verification, and in the conventional method, an alarm was generated immediately after an abnormality was determined.

However, in the present invention, the probability that the result of the abnormal determination is a false alarm is calculated even after it is determined to be abnormal. For example, if an abnormality is detected once among the observation data from the 1st to the 20th index, the value of Pr(X<1) in FIG. 4C is calculated with reference to Table 1. That is, the probability when Pr(X<1)=Pr(X=0) is obtained.

In Table 1, when p=0.05, Pr(X=0) has a value of 0.3585. That is, even if a false alarm occurs 1 out of 20 times, the probability that false alarm is 0 among 20 observation data corresponds to 35.85%. using this value Subtracting from 1 to obtain 0.6415. Since the alpha value, which is the probability of significance, is greater than this value, it is classified as more than false and an alarm is not raised.

Next, let's assume that monitoring data corresponding to the 21st index is collected, and this time, it is outside the control limit and judged as an anomaly. Then, the current moving window targets 20 pieces of measurement data from the 2nd index to the 21st index, and there is data made by a total of 2 or more judgments in it.

At this time, in order to obtain the probability that the data of the 21st index, that is, the data judged to be abnormal, is false or abnormal, the probability of Pr(X<2) is similarly obtained. Pr(X<2)=Pr(X=0)+Pr(X=1)=0.3585+0.3774=0.7359. at this time =1-0.7359=0.2641. Since the alpha value, which is the probability of significance, is greater than this value, it is classified as more than false and an alarm is not raised.

Next, let's assume that monitoring data corresponding to the 22nd index is collected, and this time, too, it is outside the control limit and judged to be an anomaly. Then, the current moving window targets 20 pieces of measurement data from the 3rd index to the 22nd index, and there is data made by a total of 3 or more judgments within it.

At this time, in order to obtain the probability that the data of the 22nd index, that is, data determined to be abnormal, is false or abnormal, the probability of Pr(X<3) is similarly obtained. Pr(X<3)=Pr(X=0)+Pr(X=1)+Pr(X=2)=0.3585+0.3774+0.1887=0.9246. at this time =1-0.9246=0.0754. The alpha value, which is the probability of significance, is 0.05, so it is greater than this value, so it is also classified as more than false and an alarm is not raised.

Next, let's assume that monitoring data corresponding to the 23rd index is collected, and this time, too, it is outside the control limit and judged as an anomaly. Then, the current moving window targets 20 pieces of measurement data from the 4th index to the 23rd index, and there is data made by a total of 4 or more judgments within it.

At this time, in order to obtain the probability that the data of the 23rd index, that is, data judged to be abnormal, is false or abnormal, the probability of Pr(X<4) is similarly obtained. Pr(X<4)=Pr(X=0)+Pr(X=1)+Pr(X=2)+Pr(X=3)=0.3585+0.3774+0.1887+0.0596=0.9842. at this time =1-0.9842=0.0158. The alpha value, which is the probability of significance, is 0.05, so it is smaller than this value, so it is classified as an anomaly and an alarm is sounded.

That is, if a total of 4 abnormalities are detected within the moving window targeting 20 pieces of measurement data, it is judged as an actual abnormality and an alarm is sounded from this point on. This is based on the alpha value of 0.05, which is the probability set by the user. Instead, when one abnormality is detected, two abnormalities are detected, or three abnormalities are detected within the previous 20 measurement data, it is determined as a false abnormality and an alarm may not be generated.

In this way, the false alarm reduction method proposed by the present invention calculates the probability that the abnormality is a false anomaly using the false alarm distribution learned in advance when an anomaly is detected, and compares the value with the alpha value to determine whether an alarm is actually generated. judge This can reduce the number of false alarms.

That is, in the present invention, when more abnormalities than the pattern of false alarms observed in the learning phase (Phase 1) are monitored within the moving window, an alarm is actually generated. The reason why false alarms are filtered out is that if an abnormality occurs in the equipment or facility to be monitored, more than that is continuously observed. That is, one or two anomalies are filtered out in comparison with false alarm patterns, but an alarm is generated if an anomaly is continuously detected.

5A to 5B are diagrams for explaining a moving window that may be used in an embodiment of the present invention.

Referring to FIG. 5A , it can be seen that the moving window 121 is set based on n=200. The moving window 121 used in the present invention refers to a data measurement period within a specific range. Since most of the data to be monitored is periodically measured, the moving window 121 may be viewed as a specific time period.

As can be seen in FIG. 5A, the number of monitoring data exceeding the management limit line 111 within the moving window 121 corresponding to a specific section is counted. That is, it is checked how many pieces of monitoring data determined to be abnormal within the section of the moving window 121 are. In addition, the false alarm probability p of the binomial distribution can be calculated using the number in the learning phase of Phase 1, and the false alarm probability of the monitoring data determined to be abnormal can be calculated in the application phase of Phase 2.

The reason why the section to be studied or the section to be monitored is named the moving window 121 in the present invention is that the moving window 121 slides along the x-axis as shown in FIG. 5B. That is, since the section to be studied or the section to be monitored is continuously moved, this is called a moving window 121. Or, in other words, it may be referred to as a moving window or a moving section.

When the moving window 121 is used, abnormal detection is counted for monitoring data within a specified number from currently measured monitoring data in the application phase of Phase 2. That is, if the size of the moving window 121 is n = 200, the number of anomalies detected is counted for the most recent 200 monitoring data and compared with the distribution of false alarms analyzed in the phase 1 learning phase.

Through this, it is possible to obtain the frequency of data detected as abnormal beyond the management limit line 111 . If this frequency is lower than the distribution of false alarms, it is determined as a false alarm and an alarm is not generated, and if this frequency is higher than the distribution of false alarms, it is determined to be a real abnormality and an alarm may be generated.

Then, even though the significance probability is set to 5%, the engineer can filter out a significant number of false alarms and receive only alarms corresponding to actual anomalies. However, since the control limit line 111 is not modified, the sensitivity is not affected. That is, since false alarms are reduced without compromising the sensitivity of monitoring, limitations of conventional monitoring methods based on statistical hypothesis verification can be overcome.

6 to 8 are diagrams for explaining the effect of a false alarm reduction method according to an embodiment of the present invention.

Referring to FIG. 6 , it can be seen at the top that a number of false alarms have occurred in the monitoring data from 0 to 1,000 index. Most false alarms can be reduced by applying the false alarm reduction method proposed in the present invention to this monitoring data.

In the upper drawing of FIG. 6, false alarms are indicated by an x mark. As can be seen in FIG. 6, most of the false alarms are data exceeding the control limit line 111 than the pattern of false alarms in the normal state analyzed in the learning step. Since the frequency of is not high, it can be seen that false alarms are reduced as shown in the lower figure of Figure 6 even if it is judged as false or higher in the step of determining whether to raise an alarm and does not generate an alarm.

Similarly, in FIG. 7 , a process of filtering false alarms using the false alarm reduction method proposed in the present invention can be seen. Referring to the upper part of FIG. 7 , it can be seen that two false alarms occurred by exceeding the management limit line 111 between the 100 index and the 200 index.

In addition, between the 500 index and the 1,000 index in FIG. 7 , it can be seen that an error actually occurred in the facility and a significant amount of the monitoring data exceeded the management limit line 111 and an actual alarm occurred. Even in this case, if the false alarm reduction method proposed in the present invention is applied, only the false alarm in the front part can be filtered.

In fact, looking at the lower part of FIG. 7 , it can be seen that two false alarms that exceed the management limit line 111 between the 100 index and the 200 index are filtered out and no alarm is generated. Instead, between the 500 index and the 1,000 index where the abnormality actually occurred, the frequency of monitoring data determined to be abnormal was higher than the distribution of false alarms in the learning stage, indicating that an alarm occurred.

This is also the case in the example of FIG. 8 . In the example of FIG. 8 , a false alarm occurs before index 500, and an alarm occurs after index 500 due to an actual failure. Even at this time, if the false alarm reduction method proposed in the present invention is applied, false alarms up to the 500 index or earlier can be excluded from the alarms in consideration of the frequency of monitoring data determined to be abnormal.

Above, the method for reducing false alarms based on statistical analysis proposed in the present invention has been reviewed. First, the distribution of false alarms is analyzed by collecting monitoring data and false alarm occurrence data during normal conditions. It approximates the distribution of false alarms with a binomial or Poisson distribution to obtain a numerical value representing the probability of a false alarm.

After n and p of the binomial distribution or μ of the Poisson distribution are obtained in the learning process, the number of monitoring data determined to be abnormal beyond the control limit based on the moving section is counted. A value of a cumulative probability function (CDF) of a binomial distribution or a Poisson distribution is obtained using the number of data determined to be abnormal in the corresponding movement section.

Then, the value obtained by subtracting the value of the cumulative probability function from 1 is compared with the alpha value, which is the probability of significance set by the user. and generate an alert. This increases the reliability of the anomaly detection system by reducing the number of false alarms without compromising the sensitivity to detect anomalies quickly.

In this process, the case of using the binomial distribution or the cumulative probability function of the Poisson distribution is used as an example to help understanding, but using various other types of false alarm distributions, it is difficult to determine whether the case detected as an anomaly in the current monitoring data is actually an anomaly. It can be judged whether it is false or abnormal. And based on the result, whether or not an actual alarm can be determined can be determined.

9 is a hardware configuration diagram of an apparatus for reducing false alarms based on statistical analysis according to an embodiment of the present invention.

Referring to FIG. 9 , the false alarm reduction device 10 based on statistical analysis may include one or more processors 510 , memory 520 , storage 560 , and interface 570 . The processor 510 , memory 520 , storage 560 , and interface 570 transmit and receive data through the system bus 550 .

The processor 510 executes the computer program loaded into the memory 520, and the memory 520 loads the computer program from the storage 560. The computer program may include a data collection operation 521 , a false alarm probability calculation operation 523 and a monitoring operation 525 .

The data collection operation 521 collects data to be monitored through a sensor through the interface 570 . This data can be used to determine the distribution of false alarms in the training phase. In addition, it can be used to determine whether to actually sound an alarm by detecting whether or not there is an abnormality in the monitoring data in the application stage and calculating the probability that the detected abnormality is a false anomaly.

Monitoring data collected by the data collection operation 521 may be stored as learning data 561 and monitoring data 563 in the storage 560 through the system bus 550 . Data collected in the learning phase of Phase 1 may be stored as learning data 561 , and data collected in the application phase of Phase 2 may be stored as monitoring data 563 .

The false alarm probability calculation operation 523 is an operation corresponding to the learning step and analyzes the learning data 561 to determine the distribution of false alarms. Through this, the false alarm frequency is obtained and stored as the false alarm frequency 565 of the storage 560 through the system bus 550 .

Finally, the monitoring operation 525 is an operation corresponding to the application step, and compares the monitoring data 563 with the control limit line to primarily determine whether or not there is an abnormality. Next, by comparing with the false alarm frequency 565, a probability of whether the result judged as abnormal is false or true is obtained, and an actual alarm is sounded based on this.

Each component of FIG. 9 may mean software or hardware such as a Field Programmable Gate Array (FPGA) or an Application-Specific Integrated Circuit (ASIC). However, the components are not limited to software or hardware, and may be configured to be in an addressable storage medium or configured to execute one or more processors. Functions provided in the components may be implemented by more subdivided components, or may be implemented as a single component that performs a specific function by combining a plurality of components.

Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art to which the present invention pertains can be implemented in other specific forms without changing the technical spirit or essential features of the present invention. you will be able to understand Therefore, the embodiments described above should be understood as illustrative in all respects and not limiting.

Claims (9)

estimating, by an anomaly detection device, a distribution of false alarms by analyzing data in a normal state;
determining, by the abnormality detecting device, whether data to be monitored is abnormal according to a predetermined criterion;
comparing, by the anomaly detection device, a frequency of data determined to be abnormal and a distribution of the false alarms, and determining whether the data determined to be abnormal is false or abnormal; and
Including, by the abnormality detection device, not generating an alarm when the data determined to be abnormal is false or abnormal,
The step of determining whether the data judged as abnormal is false or abnormal,
Calculating a cumulative probability of a false alarm for the frequency of the data determined to be abnormal using a probability function according to the estimated distribution; and
Determining whether the data determined to be abnormal based on the cumulative probability of the false alarm is false or abnormal,
How to reduce false alarms. According to claim 1,
The step of estimating the distribution of false alarms by analyzing the steady state data,
Analyzing the steady-state data to estimate the distribution of false alarms as either a binomial distribution or a Poisson distribution.
How to reduce false alarms. According to claim 1,
Calculating the cumulative probability of false alarms comprises:
counting the number i of data determined to be abnormal among a total of k pieces of data from the data of the nth point of time to the data of the n−k+1th point of time; and
Comprising the step of calculating the frequency of data determined to be more than the nth time point using the value of i and the value of k,
How to reduce false alarms. According to claim 3,
Calculating the cumulative probability of false alarms comprises:
counting the number j of data determined to be abnormal among a total of k pieces of data from the n+h-th data to the n+h-k+1-th data; and
Comprising the step of calculating the frequency of data determined to be abnormal at the n + h time point using the value of j and the value of k,
How to reduce false alarms. According to claim 1,
The distribution of false alarms is a binomial distribution,
Calculating the cumulative probability of false alarms comprises:
The formula of the cumulative probability function of the binomial distribution,

To calculate the cumulative probability of the false alarm for the frequency of the data determined to be abnormal by
k is the frequency of data determined to be abnormal, n is the number of data subject to monitoring, p is the false alarm probability of the binomial distribution,
How to reduce false alarms. According to claim 1,
The distribution of false alarms is a Poisson distribution,
Calculating the cumulative probability of false alarms comprises:
The formula of the cumulative probability function of the Poisson distribution,

To calculate the cumulative probability of the false alarm for the frequency of the data determined to be abnormal by
k is the frequency number of data judged to be abnormal, μ is the false alarm probability of the Poisson distribution,
How to reduce false alarms. According to any one of claims 5 or 6,
The step of determining whether the data judged as abnormal is false or abnormal,
Comparing the value of 1-Pr(X<k) with a preset significance probability α, and determining that the value of 1-PR(X<k) is greater than α is more than false,
How to reduce false alarms. According to any one of claims 5 or 6,
The step of determining whether the data judged as abnormal is false or abnormal,
Comparing the value of 1-Pr(X<k) with a preset significance probability α, and determining that the value of 1-PR(X<k) is less than α is more than true,
How to reduce false alarms. According to claim 1,
Further comprising the step of generating an alarm when the data determined to be abnormal is not false or more than true,
How to reduce false alarms.

Images