KR102624950B1 - System for detecting abnormal value with periodicity using time-series data - Google Patents

Abstract

In the present invention, when detecting abnormal traffic values of network equipment subject to inspection, the period-outlier values, which are abnormal values with periodicity, are set in advance and at the same time, the occurrence of abnormal values is analyzed only in the section corresponding to the period of the preset cycle-anomaly value. By being configured to appropriately correct abnormal values, it not only reduces unnecessary calculation processing, time, and cost due to detection of abnormal values, but also provides periodicity using time series data that can maximize the accuracy and reliability of predictive maintenance predictions. It relates to an abnormal value detection system having.

Description

System for detecting abnormal value with periodicity using time-series data}

The present invention relates to a system for detecting abnormal values with periodicity using time series data. Specifically, when detecting abnormal traffic values of network equipment that is subject to inspection, the period-anomaly values, which are abnormal values with periodicity, are set in advance and at the same time, It analyzes whether abnormal values occur only in the section corresponding to the preset cycle-outlier value cycle, and is configured to appropriately correct the generated abnormal values, thereby saving unnecessary computational processing, time, and cost due to abnormal value detection. Rather, it is about an abnormal value detection system with periodicity using time series data that can maximize the accuracy and reliability of predictive maintenance prediction.

Recently, as communication infrastructure has expanded and IT (Information Technology) technology has become more sophisticated, the penetration rate and usage of network equipment has increased exponentially. In particular, in most office environments, multiple networks are being formed to build information infrastructure, and the number of various network devices such as routers and switches has increased.

Such network equipment frequently experiences abnormal traffic levels due to various reasons such as malware, hacking, and internal module failure.

Accordingly, various studies are being conducted on traffic inspection systems to predict network equipment failures and errors by detecting and analyzing abnormal values of network equipment.

A representative method of this type of predictive maintenance system for network equipment is to send a packet (Http request) to the network equipment, receive a response packet (Http response), and analyze the traffic of the network equipment to detect abnormal values. This is widely used.

In general, when network equipment inspects traffic, a phenomenon in which abnormal amounts of traffic (hereinafter referred to as periodic-outliers) is periodically detected occurs frequently, even though there are no special events.

At this time, abnormal values refer to data in which traffic values temporarily increase sharply, decrease sharply, or oscillate.

These cycle-outliers may be caused by special operation processing (Job) being performed every cycle in network equipment, but it is not yet clear what the cause of the cycle-outliers is.

Meanwhile, in recent years, various studies have been conducted on predictive maintenance systems that utilize and learn normal traffic values of network equipment to create an AI model and then predict predictive maintenance using the generated AI model. At this time, because period-outlier values deteriorate the excellence and quality of the AI model, when learning an AI model, preprocessing is essential to detect period-outlier values and then correct them to normal values.

However, research on technologies and methods for separately detecting and correcting cycle-outliers is still very insufficient, and as a result, there is a problem of low accuracy and precision of predictive maintenance prediction.

Domestic Registered Patent No. 10-1074064 (title of the invention: network traffic monitoring method and device) collects traffic in a shortened period that is shorter than the traffic collection period, detects equipment and interfaces with traffic abnormalities, and detects equipment and interfaces with traffic abnormalities, and collects traffic in a shorter period than before. A network traffic monitoring method and device is disclosed that does not increase the load on the inspection equipment even by collecting and inspecting traffic in this short, shortened cycle. However, the network traffic monitoring method and device includes a cycle-outlier value that is an abnormal value and has periodic characteristics. Since there is no description of any technology or method for separately detecting and automatically correcting the detected cycle-outlier values, there is a problem in that the efficiency and accuracy of monitoring are significantly reduced due to the detection of cycle-outliers.

In addition, this application has the research project name of '2020 Gyeonggi-do Technology Development Project' and the research project title of 'Development of a network equipment predictive maintenance system using artificial intelligence' supported by the 'Gyeonggi-do Economic and Science Promotion Agency' research management specialized organization of the 'Gyeonggi-do' ministry. , the application was filed based on the project identification number of 'P20200136'.

The present invention is intended to solve this problem, and the problem of the present invention is to pre-set the period-anomaly value, which is an abnormality value with periodicity, in advance when detecting an abnormal traffic value of network equipment to be inspected, and at the same time, the preset period-anomaly value By analyzing the occurrence of abnormal values only in the section corresponding to the cycle, and organizing the occurrence of abnormal values to be appropriately corrected, not only can unnecessary calculation processing, time, and cost due to detection of abnormal values be reduced, but also the predictive maintenance prediction is possible. The purpose is to provide an abnormal value detection system with periodicity using time series data that can maximize accuracy and reliability.

In addition, another problem of the present invention is that when the test management server sets the cycle-outlier value, it detects the reference time (t), cycle (T), and optimal cycle-deviation (△T) and then matches them to provide cycle-outlier reference information. At the same time as generating, when monitoring collected data, it is configured to determine whether abnormal values occur only in the section corresponding to the period-outlier standard information, thereby further reducing the computational throughput, cost, and time for detecting abnormal values. Time series data The purpose is to provide an abnormal value detection system with periodicity using .

In addition, another problem to be solved by the present invention is that when the test management server detects an abnormal value, it automatically corrects the abnormal value to an appropriate traffic value and stores it, and at the same time, the prediction algorithm that predicts predictive maintenance learns using the corrected data. The purpose is to provide an abnormal value detection system with periodicity using time series data that can increase the accuracy and reliability of predictive maintenance prediction.

The solution of the present invention for solving the above problem is an anomaly value detection system including a network device to be inspected and a test management server that collects traffic values from the network device: the test management server includes a database unit; a data collection unit that collects traffic values from the network equipment; It is executed every preset setting cycle (T2), and after converting the collected data collected during the setting period (T2) into time series data, when the traffic value increases or decreases above the threshold, this is determined as an abnormal value. When an abnormal value with periodic characteristics is detected among the abnormal values that have been set, the abnormal values with the same period (T) are set as cycle-outliers, and the last abnormal value that occurred among the abnormal values of the set cycle-outlier values is detected. a period-outlier setting unit that generates period-outlier reference information by matching the reference time (t), which is an intermediate value, and the period (T) of abnormal values, and then stores it in the database unit; a monitoring unit that converts the collected data collected by the data collection unit into time series data and monitors it; An abnormal value determination unit that determines whether an abnormal value has occurred in the time series data of the monitoring unit only in a section corresponding to the reference time (t) and period (T) of the period-outlier reference information stored in the database unit; It is executed when an abnormal value is detected by the abnormal value determination unit, and includes an abnormal value correction unit that corrects the traffic value of the detected abnormal value to the average value of traffic values in the section before and after the abnormal value.

In addition, in the present invention, the cycle-outlier setting unit includes a collection data extraction module that extracts the collected data collected by the data collection unit from the database unit during the setting period (T2); a time series data conversion module that sorts the collected data extracted by the collected data extraction module according to a timeline and converts and sorts them into time series data; an abnormal value detection module that detects abnormal values by analyzing traffic values of the time series data converted by the time series data conversion module; a periodicity determination module that uses time information of the abnormal values detected by the abnormal value detection module to determine whether a period-outlier, which is an abnormal value with periodic characteristics, exists among the abnormal values; It is executed when the periodicity determination module determines that a cycle-outlier exists, and sets the midpoint of the last detected anomaly value among the abnormal values of the detected cycle-anomaly as the reference time (t). Setting module; It is executed when it is determined that a cycle-outlier exists by the periodicity determination module, and after calculating the time differences between the abnormal values of the adjacent cycle-outlier, the average value of the calculated time differences is set as the period (T) of the cycle-outlier. Cycle setting module; It is preferable to include a period-outlier reference information generation module that generates period-outlier reference information by matching the reference time setting module and the reference time (t) and period (T) set by the period setting module.

In addition, in the present invention, the cycle-outlier setting unit is executed when the periodicity determination module determines that a cycle-outlier exists, and each abnormality value of the cycle-outlier is assigned a period (T) based on the reference time (t). When applying, the optimal periodic deviation is calculated based on the median value of each abnormal value, calculates the time differences up to the point when the abnormal value occurred, and then sets the maximum value among the calculated time differences as the optimal periodic deviation (△T). It further includes a setting module, wherein the abnormal value determination unit is a section corresponding to the reference time (t), period (T), and optimal period deviation (△T) of the period-outlier reference information generated by the period-outlier setting unit. It is desirable to determine whether abnormal values have occurred only.

In addition, in the present invention, the test management server further includes an artificial intelligence learning unit and an AI-based predictive maintenance unit, the artificial intelligence learning unit is executed every preset learning cycle (T1), and the collected data collected by the data collection unit When the collected data replaced by the values corrected by the abnormal value correction unit is referred to as correction data, the correction data collected during the learning cycle (T1) and the predictive maintenance prediction data are used to perform the collected correction data and predictive maintenance. Create learning data that can learn the correlation between prediction data, use the generated learning data to derive an extraction model, which is a set of parameter values for the correlation between correction data and predictive maintenance prediction data, and learn a prediction algorithm. The AI-based predictive maintenance unit is executed every preset prediction cycle (T3), extracts correction data collected during the prediction cycle (T3), and then uses the extracted correction data as input data for the prediction algorithm to generate predictive maintenance prediction data. It is desirable to output .

According to the present invention, which has the above problems and solutions, when detecting abnormal traffic values of network equipment to be inspected, the period-outlier values, which are abnormal values with periodicity, are set in advance and at the same time, the section corresponding to the preset period-ideal period is set in advance. By analyzing only the occurrence of abnormal values and organizing the occurrence of abnormal values appropriately, it not only reduces unnecessary processing, time, and cost due to detection of abnormal values, but also maximizes the accuracy and reliability of predictive maintenance predictions. It becomes possible.

In addition, according to the present invention, when the test management server sets the cycle-outlier value, it detects the reference time (t), cycle (T), and optimal cycle-deviation (△T) and then matches them to generate cycle-outlier reference information. At the same time, when monitoring collected data, it is configured to determine whether abnormal values occur only in the section corresponding to the period-outlier standard information, thereby further reducing the computational processing amount, cost, and time for detecting abnormal values.

In addition, according to the present invention, when the test management server detects an abnormal value, it automatically corrects the abnormal value to an appropriate traffic value and stores it, and at the same time, a prediction algorithm that predicts predictive maintenance is configured to learn using the corrected data, thereby improving predictive maintenance prediction. Accuracy and reliability can be improved.

1 is a configuration diagram showing an abnormal value detection system with periodicity, which is an embodiment of the present invention.
Figure 2 is a block diagram showing the test management server of Figure 1.
Figure 3 is an example diagram showing a chart in which traffic values collected by the monitoring unit of Figure 2 are arranged as time series data.
FIG. 4 is an exemplary diagram illustrating the period-outlier reference information used in the present invention of FIG. 2.
Figure 5 is a block diagram showing the period-outlier setting unit of Figure 2.

Hereinafter, an embodiment of the present invention will be described with reference to the attached drawings.

1 is a configuration diagram showing an abnormal value detection system with periodicity, which is an embodiment of the present invention.

The abnormal value detection system 1 with periodicity of the present invention, when detecting abnormal traffic values of network equipment to be inspected, sets the period-anomaly value in advance, which is an abnormal value with periodicity, and at the same time maintains the period of the preset cycle-anomaly value. By analyzing the occurrence of abnormal values only in the relevant section and appropriately correcting the abnormal values, it not only reduces unnecessary processing, time, and cost due to detection of abnormal values, but also improves the accuracy and reliability of predictive maintenance predictions. This relates to an anomaly value detection system with periodicity using time series data that can maximize .

In addition, as shown in FIG. 1, the abnormal value detection system 1 with periodicity of the present invention detects whether abnormal values occur in traffic values collected from the network equipment 5 to be inspected and the network equipment 9 to be inspected. At the same time as it is detected, it is corrected and stored, and the test management server (3) outputs predictive maintenance prediction data for the network equipment (5) through an AI model created using the stored correction data, and the test management server (3). It consists of clients (7) that connect to request and receive prediction data results, a test management server (3), network equipment (5), and a communication network (not shown) that provides a data movement path between the clients (7). .

The communication network supports data communication between the test management server (3), network equipment (5), and clients (7), and may be specifically composed of a wired or wireless network such as a wide area network (WAN).

Network equipment 9 refers to a node that performs network-based communication and includes network elements such as typical gateways and switches.

Clients 7 are digital devices that support connection to a communication network, and may specifically consist of a smart phone, laptop, tablet-PC, etc.

At this time, although not shown in the drawing, the client 5 is composed of a communication module, memory, monitor, control module, etc.

In addition, an application program that requests information from the test management server (3) in conjunction with the test management server (3) or displays response data according to the request and has various graphic user interfaces (GUIs) may be installed on the client (7). You can.

Figure 2 is a block diagram showing the test management server of Figure 1.

The test management server 3 in FIG. 2 analyzes the traffic values collected from the network equipment 5, which is the inspection target, and sets the cycle-anomaly value in advance. At the same time, when storing the collected data, the abnormal value is set only in the section corresponding to the cycle-anomaly value. is determined, corrected, and stored, and when learning the prediction algorithm that outputs predictive maintenance prediction data, learning is performed using the corrected values.

In addition, as shown in FIG. 2, the test management server 3 includes a control unit 30, a database unit 31, a communication interface unit 32, an artificial intelligence learning unit 33, a packet transmission unit 34, It consists of a data collection unit 35, a monitoring unit 36, an abnormal value detection unit 37, an abnormal value correction unit 38, a cycle-anomaly value setting unit 39, and an AI-based predictive maintenance unit 40.

The control unit 30 is the operating system (OS) of the test management server 3, and the control objects 31, (32), (33), (34), (35), (36), (37), ( Manage and control 38), (39), and (40).

In addition, the control unit 30 executes the packet transmission unit 35, the data collection unit 36, and the monitoring unit 37 when the test of the corresponding network equipment 5 begins at the request of the administrator (User).

Additionally, the control unit 30 stores the collected data collected by the data collection unit 35 in the database unit 31. At this time, the collected data consists of traffic values of the network equipment (5).

Additionally, the control unit 30 executes the artificial intelligence learning unit 33 every preset learning cycle (T1).

In addition, the control unit 30 executes the period-outlier setting unit 39 at each preset setting period (T2), and stores the reference information of the period-outlier value set by the period-outlier setting unit 39 in the database unit 31. Save.

Additionally, the control unit 30 executes the AI-based predictive maintenance unit 40 at every preset prediction cycle (T3).

The database unit 31 stores network configuration information of the network equipment 5 to be inspected.

Additionally, the database unit 31 stores the prediction algorithm learned by the artificial intelligence learning unit 33.

Additionally, the data collected by the data collection unit 35 is stored in the database unit 31.

Additionally, the database unit 31 stores collected data (hereinafter referred to as correction data) whose abnormal values have been corrected by the abnormal value correction unit 38.

Additionally, the database unit 31 stores reference information on the abnormal value set by the period-outlier value setting unit 34.

The communication interface unit 32 transmits and receives data with the network equipment 5 and clients 7 that are subject to inspection.

The artificial intelligence learning unit 33 is executed at every preset learning cycle (T1) under the control of the control unit 30 and learns the prediction algorithm used in the AI-based predictive maintenance unit 40.

At this time, the prediction algorithm is a machine learning algorithm that uses correction data, which is collected data in which abnormal values have been corrected, as input data and outputs predictive maintenance prediction data for the corresponding network equipment (5).

In addition, the artificial intelligence learning unit 33 uses the correction data and predictive maintenance prediction data to generate learning data that can learn the correlation between the correction data and predictive maintenance prediction data, and uses the generated learning data to make corrections. An extraction model, which is a set of parameter values for the correlation between data and predictive maintenance prediction data, is derived.

The packet transmission unit 34 is executed when an inspection of a specific network device 5 is initiated at the request of an administrator (User), and transmits a packet (Http request) to the network device 5.

The data collection unit 35 collects traffic values of the network equipment 5 that receives packets from the packet transmission unit 34.

Figure 3 is an example diagram showing a chart in which traffic values collected by the monitoring unit of Figure 2 are arranged as time series data.

The monitoring unit 36 sorts the traffic values collected by the data collection unit 35 according to the timeline to generate time series data 910 of FIG. 3.

At this time, as shown in FIG. 3, a period-outlier value 911 having periodicity and an abnormal value may be detected in the time series data 910. At this time, the period-outlier value 911 refers to abnormal values having the same period.

FIG. 4 is an exemplary diagram illustrating the period-outlier reference information used in the present invention of FIG. 2.

The abnormal value determination unit 37 extracts the period-outlier standard information set by the period-outlier value setting unit 39 from the database unit 31.

At this time, as shown in FIG. 4, the cycle-outlier standard information includes 1) the cycle (T), which is the time difference between the repeated abnormal values of the cycle-outlier value 911, and 2) the abnormal values of the cycle-outlier value 911. It includes the reference time (t3), which is the occurrence time of the last abnormal value, and 3) cycle-deviation (△T) information.

That is, when the abnormal value determination unit 37 of the present invention monitors the time series data of traffic generated by the monitoring unit 36, the abnormal value is not detected for all sections, but is included in the period-outlier standard information. Determine whether an abnormal value has occurred only in the section corresponding to the reference time (t), period (T), and period-deviation (△T).

At this time, abnormal values refer to data in which traffic values temporarily increase sharply, decrease sharply, or oscillate.

In other words, the present invention does not determine whether an abnormal value is present in all sections, but rather observes the abnormal value only in the section set by the period-outlier value setting unit 39 to determine the computational throughput, time, and cost for detecting the abnormal value. Consumption can be significantly reduced.

Additionally, if the control unit 30 determines that an abnormal value has been detected in the abnormal value determination unit 37, it executes the abnormal value correction unit 38.

The abnormal value correction unit 38 is executed when the abnormal value determination unit 37 determines that an abnormal value has been detected.

Additionally, the abnormal value correction unit 38 extracts normal traffic values before and after the section in which the abnormal value was detected, and then calculates the average value of the extracted traffic values.

Additionally, the abnormal value correction unit 38 corrects the traffic values of the abnormal value by replacing the traffic values of the abnormal value with the calculated average value.

At this time, the data including the normal traffic values of the collected data and the traffic values corrected for the abnormal traffic values are called correction data, and the correction data is stored in the database unit 31 under the control of the control unit 30. do.

Figure 5 is a block diagram showing the period-outlier setting unit of Figure 2.

The cycle-outlier value setting unit 39 is executed at every preset setting period (T2) under the control of the control unit.

In addition, as shown in FIG. 5, the period-outlier value setting unit 39 includes a collection data extraction module 391, a time series data conversion module 392, an anomaly value detection module 393, and a periodicity determination module 394. , It consists of a reference time setting module 395, a period setting module 396, an optimal period deviation setting module 397, and a period-outlier reference information generation module 398.

The collection data extraction module 391 extracts the collection data collected by the data collection unit 35 from the database unit 31 during a set period (T2) from the current point in time.

At this time, the collected data is the traffic value of the network equipment 5, and more specifically, it means raw values in a state in which the traffic value of the abnormal value has not been corrected by the abnormal value correction unit 38.

The time series data conversion module 392 sorts the collected data extracted by the collected data extraction module 391 according to the timeline, and converts and sorts them into time series data.

The abnormal value detection module 393 analyzes traffic values of time series data converted by the time series data conversion module 392 and detects abnormal values.

At this time, abnormal values refer to data in which traffic values temporarily increase sharply, decrease sharply, or oscillate.

The periodicity determination module 394 uses the time information of the abnormal values detected by the abnormal value detection module 393 to determine whether there are abnormal values with periodic characteristics among the abnormal values.

At this time, if the periodicity determination module 394 determines that there are no abnormal values with periodicity among the detected abnormal values, it does not perform a separate operation. However, if there are abnormal values with periodicity among the detected abnormal values, The standard time setting module 395, period setting module 396, and optimal period deviation setting module 397 are executed.

At this time, period-outlier refers to abnormal values having the same period (T).

The reference time setting module 395 sets the midpoint of the last detected abnormality value among the periodicity abnormality values detected by the periodicity determination module 394 as the reference time (t).

The period setting module 395 calculates the time differences between adjacent periods and outliers, and then sets the average value of the calculated time differences as the period (T) of the corresponding period and outlier.

When applying the period (T) based on the reference time (t) to each abnormal value of the cycle-anomaly value, the optimal period deviation setting module 397 determines whether the corresponding abnormal value is generated based on the median value of each abnormal value. After calculating the time differences up to the point in time, the maximum value among the calculated time differences is set as the optimal period deviation (△T).

The period-outlier reference information generation module 398 includes the reference time (t), period (T), and optimal period set by the reference time setting module 395, the period setting module 396, and the optimal period deviation setting module 397. Period-outlier reference information is generated by matching the deviation (△T).

At this time, the period-outlier reference information generated by the period-outlier reference information generation module 398 is stored in the database unit 31 under the control of the control unit 30.

Going back to FIG. 2, looking at the AI-based predictive maintenance unit 40, the AI-based predictive maintenance unit 40 is executed at every preset prediction cycle (T3) under the control of the control unit 30.

In addition, the AI-based predictive maintenance unit 40 extracts the correction data collected during the prediction cycle (T3) and then uses the extracted correction data as input data for the prediction algorithm learned by the artificial intelligence learning unit 33 to perform predictive maintenance. Output predicted data.

In this way, the system for detecting abnormal values with periodicity (1), which is an embodiment of the present invention, sets the period-anomaly value in advance, which is abnormal values with periodicity, when detecting abnormal traffic values of network equipment to be inspected, and at the same time, sets the period-anomaly value in advance at the same time as the abnormal value with periodicity. -Analyzes whether abnormal values occur only in the section corresponding to the cycle of the abnormal values, and is configured to appropriately correct the abnormal values that occur, thereby not only reducing unnecessary computational processing, time, and cost due to detection of abnormal values, but also predictive maintenance. Accuracy and precision can be maximized.

In addition, the anomaly value detection system (1) with periodicity of the present invention detects the reference time (t), period (T), and optimal period-deviation (△T) when the test management server sets the period-anomaly value, and then detects them. It is configured to generate cycle-outlier standard information by matching and at the same time, when monitoring collected data, determine whether abnormal values occur only in the section corresponding to the cycle-outlier standard information, thereby reducing the computational throughput, cost, and time for detecting abnormal values. It can be reduced further.

In addition, the abnormal value detection system 1 with periodicity of the present invention automatically corrects and stores the abnormal value to an appropriate traffic value when the test management server detects an abnormal value, and at the same time, a prediction algorithm that predicts predictive maintenance collects the corrected data. By being configured to learn through use, the accuracy and reliability of predictive maintenance predictions can be increased.

1: Abnormal value detection system with periodicity
3: Test management server 5: Network equipment
7:Client 30:Control unit
31: database unit 32: communication interface unit
33: Artificial intelligence learning unit 34: Packet transmission unit
35: Data collection unit 36: Monitoring unit
37: Abnormal value determination unit 38: Abnormal value correction unit
39: Period-outlier setting unit 40: AI-based predictive maintenance unit
391: Collection data extraction module 392: Time series data conversion module
393: Abnormal value detection module 394: Periodicity determination module
395: Standard time setting module 396: Period setting module
397: Optimal cycle deviation setting module 398: Cycle-outlier standard information generation module

Claims (4)

In an abnormal value detection system that includes a network device to be inspected and a test management server that collects traffic values from the network device:
The test management server is
database part;
a data collection unit that collects traffic values from the network equipment;
It is executed every preset setting cycle (T2), and after converting the collected data collected during the setting period (T2) into time series data, when the traffic value increases or decreases above the threshold, this is determined as an abnormal value. When an abnormal value with periodic characteristics is detected among the abnormal values that have been set, the abnormal values with the same period (T) are set as cycle-outliers, and the last abnormal value that occurred among the abnormal values of the set cycle-outlier values is detected. a period-outlier setting unit that generates period-outlier reference information by matching the reference time (t), which is an intermediate value, and the period (T) of abnormal values, and then stores it in the database unit;
a monitoring unit that converts the collected data collected by the data collection unit into time series data and monitors it;
an abnormal value determination unit that determines whether an abnormal value has occurred in the time series data of the monitoring unit only in a section corresponding to the reference time (t) and period (T) of the period-outlier reference information stored in the database unit;
An abnormal value correction unit that is executed when an abnormal value is detected by the abnormal value determination unit and includes an abnormal value correction unit that corrects the traffic value of the detected abnormal value by the average value of traffic values in the section before and after the abnormal value. Detection system. The method of claim 1, wherein the period-outlier setting unit
a collection data extraction module that extracts the collected data collected by the data collection unit from the database unit during the setting period (T2);
a time series data conversion module that sorts the collected data extracted by the collected data extraction module according to a timeline and converts and sorts them into time series data;
an abnormal value detection module that detects abnormal values by analyzing traffic values of the time series data converted by the time series data conversion module;
a periodicity determination module that uses time information of the abnormal values detected by the abnormal value detection module to determine whether a period-outlier, which is an abnormal value with periodic characteristics, exists among the abnormal values;
It is executed when the periodicity determination module determines that a cycle-outlier exists, and sets the midpoint of the last detected anomaly value among the abnormal values of the detected cycle-anomaly as the reference time (t). Setting module;
It is executed when it is determined that a cycle-outlier exists by the periodicity determination module, and after calculating the time differences between the abnormal values of the adjacent cycle-outlier, the average value of the calculated time differences is set as the period (T) of the cycle-outlier. Cycle setting module;
An abnormal value comprising a period-outlier reference information generation module that generates period-outlier reference information by matching the reference time setting module and the reference time (t) and period (T) set by the period setting module. Detection system. The method of claim 2, wherein the period-outlier setting unit
It is executed when it is determined that a cycle-outlier value exists by the periodicity determination module, and when a period (T) is applied to each abnormal value of the cycle-outlier value based on the reference time (t), the middle of each abnormal value It further includes an optimal periodic deviation setting module that calculates the time differences up to the point when the abnormal value occurs based on the value, and then sets the maximum value among the calculated time differences as the optimal periodic deviation (△T),
The abnormal value determination unit
Determining whether an abnormal value has occurred only in the section corresponding to the reference time (t), period (T), and optimal period deviation (△T) of the period-outlier reference information generated by the period-outlier setting unit Characterized by an abnormal value detection system. The method of claim 3, wherein the test management server further includes an artificial intelligence learning unit and an AI-based predictive maintenance unit,
The artificial intelligence learning department
It is executed every preset learning cycle (T1), and when the collected data replaced by the values corrected by the abnormal value correction unit in the collected data collected by the data collection unit is called correction data, the learning cycle (T1) By using the correction data and predictive maintenance prediction data collected during the period, learning data that can learn the correlation between the collected correction data and predictive maintenance prediction data is created, and the generated learning data is used to create correction data and predictive maintenance prediction data. A prediction algorithm is learned by deriving an extraction model, which is a set of parameter values for the correlation between
The AI-based predictive maintenance department
It is executed every preset prediction cycle (T3), and extracts correction data collected during the prediction period (T3), then uses the extracted correction data as input data for the prediction algorithm to output predictive maintenance prediction data. Abnormal value detection system.