KR20170078252A - Method and apparatus for time series data monitoring - Google Patents

Abstract

A time series data monitoring method is provided. According to an embodiment of the present invention, there is provided a method of monitoring time series data, comprising the steps of: predicting a cluster of time series data of a measurement period of the prediction period from environment data of a prediction period, according to an analysis result of measurement time series data and environment data during a training period; Setting a management range for each viewpoint according to the time-variability of each measurement time-series data during a training period belonging to the predicted cluster, and determining whether the actual measurement time-series data of the prediction period satisfies the management range for each viewpoint And monitoring.

Description

TECHNICAL FIELD The present invention relates to a method and apparatus for monitoring time series data,

The present invention relates to a method and apparatus for monitoring time series data. More particularly, the present invention relates to a method for predicting time series data for a specific period by using a result of training time series data generated during a certain period of the past and for monitoring actual time series data based on the result, will be.

Time series data refers to data expressed as a function of time for a certain period of time. Such time series data can be predicted through analysis of past time series data. It can be monitored whether the difference between the actually generated time series data and the predicted time series data exceeds the predefined limit or violates the rule specified by the expert.

Expert-dependent time-series data monitoring rules are: i) problems that do not reflect complicated patterns such as process time series change and time series change of start-up mode because existing rule is limited to sensor viewpoint value, change amount and statistics; ) The problem is that reliability is questioned because the management coverage is normal for each management point, and iii) the actual measurement value. Even if the time series data is within the management range, abnormalities of the type in which small changes frequently occur are hard to detect I have a problem.

Korean Patent Publication No. 1998-7002852 Korean Patent Publication No. 2009-0073937

SUMMARY OF THE INVENTION It is an object of the present invention to provide a time series data monitoring method and apparatus for dynamically setting a management range for each viewpoint in accordance with time-variability of measured time series data during a training period.

Another object of the present invention is to provide a time series data monitoring method capable of determining a global anomaly when fine abnormalities accumulate and exceed a threshold value even if actual measured value time series data is within a management range, .

Another object of the present invention is to provide a time-series data monitoring method and apparatus that can display a time point when a real-time-of-measurement time-series data is accumulated within a management range and a minute abnormality accumulates and exceeds a threshold value .

The technical objects of the present invention are not limited to the above-mentioned technical problems, and other technical subjects not mentioned can be clearly understood by those skilled in the art from the following description.

According to an aspect of the present invention, there is provided a method for monitoring time series data according to an embodiment of the present invention, Setting a management range for each viewpoint according to a time-variability of each measurement time-series data during a training period belonging to the predicted cluster; And monitoring whether the management scope for each viewpoint is satisfied.

In one embodiment, the prediction period includes a first time point and a second time point after the first time point, and the step of setting the management range for each time point comprises: And setting the management range of the management table to a different value. The step of setting the management range of the first time point and the management time range of the second time point to be different from each other may be configured such that when the variance at the first time point is larger than the variance at the second time point, And setting the management range of the viewpoint to a value larger than the management range of the second viewpoint.

In one embodiment, the time series data monitoring method further comprises predicting the measured time series data of the prediction period using a regression model for the predicted cluster. In this case, the monitoring step may include determining whether a difference value between the actual measurement time series data at each time point and the predicted measurement time series data is within the management range for each time point.

According to an aspect of the present invention, there is provided a method for monitoring time series data according to an exemplary embodiment of the present invention, Predicting the measured time series data of the predicted period using a regression model for the predicted cluster, receiving actual measured value time series data of the predicted period, Obtaining the representative time series data of the measured time series data by using the representative time series data and obtaining the representative time series data of the measured time series data by using the representative time series data, doing Wu, and a step of determining the overall abnormal (global anomaly).

In one embodiment, the step of determining the overall abnormality may include generating a histogram of a DTW (Dynamic Time Warping) distance between each measurement time series data and the representative time series data during a training period belonging to the predicted cluster, and And determining the DTW distance satisfying the predetermined requirement on the histogram as the threshold value. The step of determining the DTW distance satisfying the pre-designated requirements on the histogram as the threshold may include determining a DTW distance that includes a predefined ratio in ascending order of the DTW distance among all measurement time series data belonging to the cluster, , Or determining the threshold using an average value and a standard deviation of the DTW distance on the histogram.

In one embodiment, determining the overall abnormality comprises: generating a local cost matrix indicating a data difference value for each point in time between the predicted measured time series data and the actual measured value time series data; Searching for a cost path, and generating an abnormal influence degree for each point in time using the minimum cost path. At this time, the step of generating an abnormal influence degree for each viewpoint may include: generating the abnormal influence degree by summing data difference values belonging to the least cost path based on each time point of the predicted measured time series data; . ≪ / RTI >

According to an aspect of the present invention, there is provided an apparatus for monitoring time series data, comprising: a memory for loading a computer program for analyzing measurement time series data during a training period to predict the measured time series data in a prediction period; And a storage for storing data to be inquired by the computer program, the environment data, and measurement time series data received through the network interface. Wherein the computer program comprises training logic, prediction logic and monitoring logic, the training logic comprising: an operation of clustering measurement time series data of a predefined period of time during a training period into a plurality of clusters, An operation of collecting data and an operation of generating an optimal classification model that optimally classifies clusters of the measurement time series data with at least a part of the plurality of environmental data as factors, An operation of predicting a cluster of the measured time series data in the prediction period using an optimal classification model and an operation of predicting the measured time series data of the prediction period by using a regression model for the predicted cluster, Prize The monitoring logic may further comprise: an operation of setting a management range for each viewpoint according to a time-variability of each measurement time-series data during a training period belonging to the predicted cluster, And an operation of determining a global anomaly when the difference between the measured time series data and the predicted measured time series data exceeds a threshold value obtained based on the representative time series data.

1 is a block diagram illustrating a time-series data prediction and monitoring system according to an embodiment of the present invention.
FIGS. 2 to 4 are flowcharts of a time-series data prediction and monitoring method according to an embodiment of the present invention.
5 is a view for explaining measured time series data referred to in some embodiments of the present invention.
FIG. 6 is a diagram for explaining a result of clustering measurement time series data of FIG. 5 and generating representative time series data of each cluster; FIG.
FIG. 7 is a view for explaining a storage form of a result of performing clustering on measured time series data collected during a training period in some embodiments of the present invention. FIG.
8 is a diagram for explaining multidimensional measurement time series data referred to in some embodiments of the present invention.
9 is a diagram for explaining a process of determining the number of clusters when clustering time series data in some embodiments of the present invention.
10 is a view for explaining multidimensional environment time series data among environmental data referred to in some embodiments of the present invention.
11 is a view for explaining a date attribute of environmental data referred to in some embodiments of the present invention.
12 is a diagram for explaining that environmental data is clustered in some embodiments of the present invention.
FIG. 13 is a diagram for explaining representative values representative of a specific environment among environmental data referred to in some embodiments of the present invention. FIG.
FIG. 14 is a view for explaining a storage form of a result of clustering environmental time series data among environmental data in some embodiments of the present invention. FIG.
15 and 16 are views for explaining a classification model referred to in some embodiments of the present invention.
17 is a diagram for explaining that, in some embodiments of the present invention, a regression model for predicting measured time series data of a prediction period is designated for each measurement time series data cluster.
FIGS. 18 to 19 are diagrams for explaining the time-by-time variability of each measurement time series data belonging to a specific measurement time series data cluster in some embodiments of the present invention.
FIG. 20 is a diagram for explaining how a management range for each viewpoint is set according to an embodiment of the present invention. FIG.
FIG. 21 is a diagram for explaining the reason why an abnormality determination is necessary even if the actual measurement value time series data is within the management range, according to an embodiment of the present invention.
22 is a diagram for explaining that a threshold for determining a global anomaly is set according to an embodiment of the present invention.
FIGS. 23 to 25 are diagrams for explaining the evaluation of the abnormal influence degree at each time point when a general abnormality is determined according to an embodiment of the present invention, thereby displaying a time point that causes a problem. FIG.
26 is a block diagram of a time-series data monitoring apparatus according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention and the manner of achieving them will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

Unless defined otherwise, all terms (including technical and scientific terms) used herein may be used in a sense commonly understood by one of ordinary skill in the art to which this invention belongs. Also, commonly used predefined terms are not ideally or excessively interpreted unless explicitly defined otherwise. The terminology used herein is for the purpose of illustrating embodiments and is not intended to be limiting of the present invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification.

For convenience of understanding, before describing the embodiments of the present invention in full, the meanings of the terms used in this specification will be described.

Measured time series data: Indicates time series data of measured values measured by sensors and the like. The measured time series data may be separated by a predetermined period (for example, 24 hours). The sensor may be, for example, a temperature sensor, a brightness sensor, a power consumption sensor connected to a building management system, a temperature sensor, a pressure sensor or the like provided in a production facility, a temperature sensor provided in the computing device, A usage sensor, a storage I / O load sensor, a network usage sensor, and the like. It goes without saying that the sensor capable of generating measurement time series data may include measurement devices other than those illustrated above.

Environmental data: It is data on various environments that may affect the measurement time series data. The environmental data may be classified into i) environmental time series data, ii) environmental representative values, and iii) environmental attribute values. For example, the temperature time series data for 24 hours, the humidity time series data for 24 hours, and the like correspond to the environmental time series data, and the average temperature and the average humidity for each date correspond to the environmental representative value. The holiday / weekdays whether or not the environment property value corresponds to the environmental property value.

Training period: In order to predict time series data, it is necessary to collect data for a certain period of time and learn through techniques such as machine learning. The training period refers to a certain period in the past that is the learning target. The expiration time of the training period may be current. That is, the current data can be collected and collected at the same time as the data is collected. The time series data of the measurement time series data and the environmental data during the training period can be clustered through learning.

Estimation period: Using the learning result during the training period, the measurement time series data of a specific period can be predicted. In the present specification, a prediction target period of measurement time series data is referred to as a prediction period. The prediction period may be a specific period in the future, or may be a specific period in the past for diagnosis of the past period.

Time series data monitoring system

Hereinafter, a configuration and operation of a time series data monitoring system according to an embodiment of the present invention will be described with reference to FIG. The time series data monitoring system according to the present embodiment may include a measurement apparatus 10 and a measurement monitoring apparatus 20.

The measurement apparatus 10 is a device for generating measurement time series data. The measurement apparatus 10 can transmit the generated measurement time series data to the measurement value monitoring apparatus 20 and the terminal apparatus 40 via the network. As already mentioned, the measuring device 10 may be, for example, a temperature sensor, a brightness sensor, a power usage sensor connected to a building management system, a temperature, a pressure sensor or the like provided in a production facility, A CPU usage sensor, a memory usage sensor, a storage I / O load sensor, a network usage sensor, and the like.

The environmental data management device 30 generates or collects environmental data that may affect the measurement time series data and provides the environmental data to the measurement value monitoring device 20. [

The measurement monitoring apparatus 20 learns the measurement time series data and the environment data during a training period and predicts the measurement time series data during a prediction period using the learning results.

Hereinafter, the data learning related operation of the measurement value monitoring apparatus 20 will be described.

As a result of learning about the data during the training period, the measurement time series data of the predetermined period unit is clustered into a plurality of clusters, and representative time series data of each measurement time series data can be determined.

As a result of learning about data during the training period, environmental time series data of a predetermined period unit is clustered into a plurality of clusters, and representative time series data of each environmental time series data can be determined. The measured time series data and the environmental time series data are preferably clustered in the same manner.

Also, as a result of learning about the data during the training period, an optimal classification model for receiving the environment data and outputting clusters of the measurement time series may be generated. Wherein the optimal classification model comprises: i) selecting at least some of the collected plurality of environmental data as factors; and ii) optimally classifying clusters of the measured time series data in a space or plane comprising axes indicating the factors Generating a classification model; iii) determining a performance indicator value of the generated classification model; iv) selecting at least a portion of the plurality of environmental data as a parameter; generating the classification model; And selecting an optimal classification model among the generated classification models based on the performance index value by repeating the selection of the factor while changing the selection of the factor.

Also, as a result of learning about the data during the training period, a regression model for predicting the measurement data from the environmental data may be constructed for each measurement time series cluster. The regression model may be any of a variety of regression models such as, for example, Multivariate Adaptive Regression Splines (MARS) or polynomial regression. Regarding the regression model or regression analysis, since various data such as articles are disclosed, a detailed description of the regression model will be omitted. For example, you can visit the website at https://en.wikipedia.org/wiki/Regression_analysis.

Hereinafter, the operation related to the measurement time series data prediction by the measurement value monitoring apparatus 20 will be described.

The measured value monitoring device 20 inputs the predicted environmental data prediction value to the optimum classification model to predict the measured time series data cluster of the prediction period. The environmental data predicted value in the prediction period may be weather forecast information such as average temperature, average humidity, average wind speed, and the like. The measurement value monitoring device 20 may receive the environmental data prediction value of the prediction period from the environment data management device 30. [

The measurement value monitoring device 20 can transmit information such as representative time series data for the predicted measured value time series data cluster to the terminal device 40 via the network.

If the environmental data time series is included in the factor of the optimal classification model, the measurement monitoring apparatus 20 determines that the environmental data time series prediction value (for example, daytime temperature time series prediction value) of the prediction period is obtained as the learning result during the training period Determine which environmental data time series clusters belong to. At this time, the cluster can be quickly determined by comparing the representative time series data of each environmental data time series cluster with the environmental data time series prediction value. The measurement monitoring apparatus 20 inputs an identifier (for example, an index value) of the determined environment data time series cluster to the optimum classification model to predict a measurement time series data cluster of the prediction period.

The measurement value monitoring device 20 predicts the time series data of the predicted time series by using a regression model for the cluster of predicted measured time series data. The regression model receives time series data for a first environment (e.g., temperature) as a factor, and outputs measured time series data in that case. The regression model may include at least one of a time series data cluster identifier for a second environment (e.g., humidity), a representative value for a third environment (e.g., solar radiation) and environmental attributes (e.g., weekday / One can receive additional input.

The measurement monitoring apparatus 20 can transmit predicted measurement time series data (e.g., tomorrow's 24 hour energy consumption time series data prediction) to the terminal device 40 via the network.

Hereinafter, the data monitoring related operation of the measurement value monitoring apparatus 20 will be described.

The measurement value monitoring device 20 sets the management range for each viewpoint according to the time-variability of each measurement time-series data belonging to the cluster of the predicted measured value time series data. For example, if the variability is greater at 3:00 pm than 10:00 am as a result of analysis of measurement time series data belonging to the cluster during the training period, the measurement monitoring device 20 will manage at 3:00 pm than 10:00 am Set the range to be wider. Since the learning result during the training period indicates that the data deviation was larger at 3:00 pm than at 10:00 am, it is necessary to set the management range to be wider at 3:00 pm than at 10:00 am, Can be prevented.

If the difference between the actual measurement value time series data and the predicted measurement time series data exceeds a threshold value obtained based on the representative time series data even if the actual measurement value time series data is within the management range, It can be judged as a global anomaly. According to the present embodiment, even if the actual measurement value time series data is within the management range, when the minute abnormalities are accumulated and exceed the limit value, it is determined that the overall abnormality is exceeded so that the manager managing the time series data performs fine data monitoring .

Although the measurement monitoring apparatus 20 and the environmental data management apparatus 30 are shown as being physically separated from each other in FIG. 1, in some embodiments, the environment data management apparatus 30 may be provided in the large- May be configured as one module.

How to monitor time series data

Hereinafter, a time-series data monitoring method according to an embodiment of the present invention will be described with reference to FIG. 2 to FIG. The time series data monitoring method according to the present embodiment can be executed by the computing device, for example, by the measurement monitoring device 20 described with reference to FIG.

The time series data monitoring method according to the present embodiment includes an operation of learning data of a training period, an operation of estimating measured time series data of a prediction period using the result of the learning, and an operation of receiving and monitoring actual measurement time series data . The operation of learning the data of the training period will be described with reference to FIGS. 2 to 3, and the operation of predicting the measured time series data of the predicted period and the operation of monitoring the actual measured value time series data will be described with reference to FIG.

Referring to FIG. 2, measurement time series data of a training period and a plurality of environment data are received (S100, S102). The plurality of environmental data may include time series data or representative values indicating a first environment (e.g., temperature) and time series data or representative values indicating a second environment (e.g., humidity), environmental attributes / Whether it is weekday). Among the received measurement time series data and environment data, environmental time series data are clustered among similar things in the training process (S104, S106). Hereinafter, the clustering process (S104, S106) will be described in detail.

The received measurement time series data is processed in units of the predefined period. For example, if the period is 24 hours, the measured time series data may be separated by 0 hour. The period may be set to a different value according to each measurement time series data. For example, time series data of energy consumption in a building can be separated by 24 hours, and data on the elevator operating distance within a building can be separated by a week.

The measured time series data of each cycle is classified into one of a plurality of clusters through clustering. FIG. 5 is an overlay of energy usage time series data separated by 24 hours. The time series data as shown in Fig. 5 may be clustered by well-known clustering logic such as k-means logic. The k-mean logic is an algorithm for grouping the given data into k clusters, and operates in a way that minimizes the variance of the distance difference with each cluster. The k-means logic is a type of self-learning, and it plays a role of labeling input data that is not labeled. This algorithm has similar structure to clustering using EM algorithm. Since the k-average logic shows excellent performance in clustering with time series data, this embodiment has the effect of improving clustering quality by performing clustering using k-average logic.

On the other hand, according to another embodiment, various clustering logic may be utilized, as well as k-means logic. For information on clustering logic, see the web document 'https://en.wikipedia.org/wiki/Cluster_analysis'.

In one embodiment, after clustering, representative time series data of time series data belonging to each cluster can be selected using time series averaging logic. For example, various well-known time series averaging logic such as DTW Barycenter Averaging (DBA) can be utilized. For DBA logic, see 'F. Petitjean, A. Ketterlin, P. Gancarski, A global averaging method for dynamic time warping, with applications to clustering '. In FIG. 6, the measured time series data of FIG. 5 is clustered with a total of five clusters, and representative time series data of each cluster is extracted.

DBA logic effectively extracts representative time series data in clusters clustered by k-means logic. In this embodiment, the combination of clustering using k-means logic and representative time series data extraction using clustered DBA logic provides the effect of optimal clustering and cluster representative time series data extraction.

FIG. 7 shows a form in which measured time series data of a 24-hour period is stored for each date. As shown in FIG. 7, the measurement time series data for each cycle can be stored together with the cluster index serving as an identifier of the cluster. In addition, representative time series data of each cluster may be stored as a result of clustering. On the other hand, the collected measurement time series data may be multidimensional time series data composed of n (n > = 2) different measurement time series data as shown in Fig.

In performing clustering on time-series data, it is a problem how many clusters are to be clustered. If the number of clusters is too small, low homogeneity of the time series data belonging to each cluster is problematic. If the number of clusters is too large, clustering efficiency becomes poor. Therefore, it is important to determine the proper number of clusters to improve the quality of clustering. In an embodiment of the present invention, the number of clusters is finally determined based on the sum of similarity values between representative time series data for each cluster and measurement time series data of each cycle belonging to each cluster. The similarity sum value can be calculated using difference value calculation logic between various time series data such as DTW distance.

In the case shown in FIG. 9, as the number of clusters is increased from 1 to 5, the DTW distance sum value between the representative time series data of each cluster and the measurement time series data of each cycle belonging to each cluster sharply decreases, If the number of clusters is 5 or more, the decrease in the DTW distance sum becomes small. That is, in the case shown in FIG. 9, even if the number of clusters is increased to 5 or more, the quality of the clustering is not affected. Therefore, in one embodiment, as the number of clusters increases from 1 to k, as the number of clusters increases, the decrease of the sum of DTW distances increases beyond a reference value, and as the number of clusters increases beyond k, If it is less than this criterion, the number of clusters can be finally determined as k.

On the other hand, when the measured time series data is multidimensional time series data composed of two or more individual measured value time series, a Multi-Dimensional Dynamic Time Warping (MD-DTW) between the representative time series for each cluster and the measured time series data of each cycle belonging to each cluster, The number of clusters can be finally determined based on the sum of similarities (e. G., DTW distance) according to the logic. The time series data monitoring method according to the present invention provides scalability for multidimensional time series data because clustering and representative time series data of each cluster can be generated in the same way as one dimensional time series data even if the time series data is multilevel data. That is, in this embodiment, the multidimensional time series data can also be used as a factor for predicting the cluster of the time series data of the measurement time series of the prediction period.

As already mentioned, the time series data in the environment data is also clustered in the same manner as the clustering method of the measurement time series data, and the representative time series data of each cluster is extracted. FIG. 12 shows the results of clustering the temperature time series data of summer and winter and extracting representative time series data of each cluster.

The reason for clustering time series data among environmental data is that the possibility of completely the same data is low due to the nature of time series data. Therefore, the environmental data is clustered so that the time series data of the environment data can be included as a factor for predicting the cluster of the measurement time series data. An identifier (e.g., an index) of each cluster may be used as a factor of an optimal classification model for predicting clusters of measured time series data. Details of the optimum classification model will be described in detail later with reference to Figs. 3, 15 and 16.

10 shows multidimensional environment time series data. For example, in the case of n-dimensional environment time series data including n different environment time series data, clustering as one n-dimensional environment time series data is more preferable than clustering by separating into n one- Lt; RTI ID = 0.0 > environment. ≪ / RTI > Therefore, the multidimensional environment time series data also needs to be used as a factor of the optimal classification model. Clustering and representative time series data can also be extracted from multidimensional environment time series data using the same method as clustering and representative time series data extraction method described above for multidimensional measurement time series data.

As already mentioned, the environmental data collected and learned in some embodiments of the present invention also includes data that is not time series data. For example, data indicating an attribute value of the environment (e.g., whether it is Saturday / weekday / holiday by date in FIG. 11) or data indicating representative values of each environment (for example, temperature / / Average pressure value) can also be included in the environmental data. According to an exemplary embodiment, environment data other than time series data are clustered by a well-known clustering method, and representative values of each cluster can also be extracted.

14 shows a form in which environmental time series data of a 24-hour period is stored for each cycle. As shown in FIG. 14, the environment time series data for each cycle can be stored together with the cluster index serving as an identifier of the cluster. In addition, representative time series data of each cluster may be stored as a result of clustering.

Returning back to Fig. 2, the operation after clustering will be described. When clustering is completed, an optimal model for obtaining clusters of measured time series data is generated (S108). The model indicates an optimal classification model that best classifies clusters of the measurement time series data on a plane or a space formed by at least a part of the plurality of received environmental data as respective axes.

For example, when the first axis is the temperature time series data cluster and the second axis is the humidity time series data cluster, the measurement time series data during the training period is displayed on the plane constituted by the first axis and the second axis , One reference line that best classifies the clusters of the measured time series data on the plane may be displayed. At this time, by using the reference line, clusters of measured time series data can be obtained by inputting temperature time series data clusters and humidity time series data clusters in the prediction period. Therefore, the optimal model for obtaining the clusters of the measured time series data is an optimal classification for best classifying clusters of the measured time series data on the plane or space constituted by at least a part of the received plurality of environment data as the respective axes It is a model.

Referring to FIG. 3, the operation (S108) of generating the optimal classification model will be described in more detail.

First, environment data to be used as a factor among a plurality of environmental data is selected. For example, if the collected environmental data are of three kinds (A, B, C), there are seven kinds of choices (A, B, C, AB, AC, BC, ABC). It is assumed that the measurement time series data does not depend on only one environmental data. If you choose to use two sets of environmental data as parameters, you can construct a plane consisting of two factors and display the time series data of each period over the training period on this plane.

FIG. 15 is a diagram showing a case in which two environment time series data are selected, and on a plane constituted by a first axis indicating a cluster index of the first environment time series data and a second axis indicating a cluster index of the second environment time series data, Is the index number of the cluster. When the data of the training period is processed as shown in Table 1 below, a cluster of the measured time series data can be displayed as shown in FIG.

Cycle First environment time series data
Cluster index Second environment time series data
Cluster index Measured time series data
Cluster index One One One One 2 2 One One 3 One 2 One 4 2 2 One 5 3 One One 6 4 One 2 7 3 2 2 8 One 3 2 9 2 3 2 10 3 3 2 11 4 2 2 12 5 One 2 13 6 One 2 14 5 2 2 15 4 3 2 16 5 3 2 17 6 3 2 18 6 2 2

On the plane shown in FIG. 15, the problem of optimally classifying clusters of measured time series data can be solved by using various classification logic such as SVM (Support Vector Machine) logic and decision tree logic. That is, the embodiment of the present invention uses various classification logic introduced through a web document 'https://en.wikipedia.org/wiki/Statistical_classification', for example, in a plane or a space , It is possible to expand the model to optimally classify the clusters of the measured time series data of each period. However, for convenience of understanding, an embodiment utilizing SVM logic will be described below.

FIG. 16 shows a case in which one environmental time series data (temperature time series data) and one environmental representative value (average humidity) data are respectively selected as factors. As described above, since the environmental time series data can not be displayed on the axis as it is, the first axis indicates the cluster index of the environmental time series data. When the SVM logic is executed, a hyperplane 63 is obtained that can distinguish two heterogeneous data on the plane (measurement time series data of the first cluster and measurement time series data of the second cluster) on the plane. The maximum margin at this time is the distance between two vectors 61 and 62 parallel to the hyperplane as they pass data closest to the hyperplane 63.

16, the hyperplane 63 shown in Fig. 16 is an optimal classification model. However, considering another factor selection, a classification model may be generated that can better classify the measurement time series data of the first cluster and the measurement time series data of the second cluster. In one embodiment, the performance indicator of the classification model is a maximum margin value according to a hyperplane generated according to the SVM logic. The larger the maximum margin, the better the performance indicator.

Therefore, in order to obtain an optimal classification model that best classifies clusters of the measured time series data, a case where the maximum margin value is the largest is searched while various collected environmental data are combined in various ways.

3, the environment data to be used as a parameter in the plurality of environmental data is selected (S180), and a space (when three or more parameters are selected) constituted by axes indicating the selected parameter or a plane (S182), and determines the performance index value of the classification model (when the SVM logic is used, the maximum margin value) (S184). (S186), the selection of the factor is changed (S188), and a classification model is generated using the selected factor (S182) until the performance index value of the generated classification model (S184) is repeated.

When selecting an argument, all cases of selecting at least a part of a plurality of environment data are possible, a range of selectable number of factors can be specified, or the type of selectable data can be limited to a specific type (for example, Environment time series data and environment representative values).

After all the factor selection cases are examined, the performance index values of the classification models generated in the respective factor selection cases are compared, and the classification model having the highest performance index value is selected as the optimal classification model (S189).

Next, as a part of the training work, a regression model is constructed in which environment data of a cycle belonging to the measurement time series data is input for each measurement time series cluster and the measurement time series data is output. That is, the step of constructing the regression model may be performed by using only the data of the period clustered in the first measured value time series data cluster without using the data of the period clustered with the second measured value time series data cluster, And constructing a corresponding regression model. For example, in the case shown in Table 1, when constructing the regression model corresponding to the measurement time series data cluster No. 1, only the environmental data of the cycles 1 to 5 are used.

The construction of the regression model can be performed by applying various logic presented through a web document 'https://en.wikipedia.org/wiki/Regression_analysis' or the like. For example, it may be one of various regression models such as Multivariate Adaptive Regression Splines (MARS) or polynomial regression.

The regression model has first environment time series data of the environment data as a first independent variable. In order to output the measured time series data, at least one time series data which varies with the passage of time must be inputted.

Wherein the regression model includes a cluster identifier of a second environment time series data different from the first environment time series data, a representative value (e.g., an average temperature) representative of a specific environment of each cycle of the environment data, And at least one of data (e.g., whether it is weekday / holiday) as an additional independent variable.

Hereinafter, an operation of predicting and monitoring measured time series data of a prediction period will be described with reference to FIG.

The environmental data of the forecast period is received (S200). The received environmental data may be a predicted value. The environmental data may be, for example, weather forecast information. The weather forecast information may include, for example, an average temperature of the prediction period, an average humidity, temperature time series prediction data according to time, and the like. It is preferable that the environment data include all data included as a factor of the optimal classification model for time series data to be predicted.

If environmental time series data is included as a factor of the optimal classification model, it is determined in step S202 whether the time series data predicted by the environmental time series data is closest to the clusters of the environmental time series data.

The representative time series data of each cluster is extracted at the time of clustering the environmental time series data (S106). The environmental time series data of the prediction period is not compared with all the data belonging to each cluster but only with the representative time series data of each cluster when determining the cluster corresponding to the environmental time series data of the prediction period (S202). That is, a cluster of the environmental time series data to which the environmental time series data of the prediction period belongs is selected based on the similarity degree according to the difference value calculation logic between the environmental time series data of the prediction period and the representative time series for each cluster of the environmental time series data do.

The degree of similarity may be, for example, various logic for computing a difference value between time series data such as DTW (Dynamic Time Warping) difference arithmetic logic between environmental time series data of the prediction period and representative time series data of each cluster of environment time series data . ≪ / RTI >

For example, if the number of clusters is 10, only 10 DTW values must be compared in the determination of the cluster (S202). Therefore, in this embodiment, the cluster corresponding to the environment time series data of the prediction period can be determined quickly It has an effect.

By inputting the environmental data of the prediction period into the factor of the optimal classification model, a cluster of the measured time series data of the prediction period is predicted (S204). As mentioned above, when the environment time series data is included in the factor of the optimal classification model, the cluster identifier (e.g., cluster index) of the environmental time series data is input instead of the environmental time series data itself.

When the environmental data of the predicted period is input to the regression model corresponding to the cluster of the predicted measured value time series data, the measured time series data of the predicted period can be obtained (S206). As shown in Fig. 17, according to the present embodiment, when the measurement time series data cluster is different, the applied regression model also changes. For example, if the energy usage is forecasted measurement time series data and the energy usage data cluster in the forecast period is predicted as # 1, then the regression model may be model 1 of the MARS (Multivariate Adaptive Regression Splines) model format . If the energy usage data cluster of the forecast period is predicted as # 2, then the regression model will be different for the second model.

On the other hand, if the predicted measurement time series data is different, a regression model of another model type may be applied. For example, FIG. 17 shows that polynomial regression is used for water usage time series data.

Hereinafter, the monitoring-related operation of the actual measured value time series data will be described.

The variability of each measurement time series data belonging to the cluster of measured time series data predicted at step S204 is evaluated (S208). In FIG. 18, each measurement time series data belonging to a cluster of a specific measurement time series data (energy use amount) is superimposed and displayed. In the evaluation of the variability, the variance or standard deviation of each measurement time series data belonging to the cluster is calculated for each time point. That is, in this case, the variance or standard deviation is the volatility of each point of view. FIG. 19 shows the standard deviation calculated for each time (time) with respect to the data of FIG. FIG. 19 shows a point at which the standard deviation is at the minimum (60) at 6 o'clock, and a point at which the standard deviation is at the maximum (71) at 9 o'clock.

Next, the management information for each viewpoint is generated using the result of the evaluation of the volatility of each viewpoint (S208) (S210). For example, point-in-time management information may be generated as follows.

U (t) = P (t) +?? (T)

L (t) = P (t) -?? (T)

In the above equation, U (t) is an upper limit value at a time point t, a is a coefficient that can be set by the manager, and? (T) is a value of the predicted measurement time series data obtained as a result of the volatility evaluation Is the standard deviation value at time t of each measurement time series data belonging to the cluster.

Fig. 20 shows the management information generation result at each point of time, in which the result of the volatility evaluation (S208) shown in Fig. 19 is reflected. As shown in FIG. 20, the management range 72 is set to the narrowest at 6 o'clock during the training period, and the management range 73 is set to be the widest at 9 o'clock when the volatility is the lowest. When the actual measurement value time series data is received after the management range is set as shown in FIG. 20 (S214), the difference value between the actual measurement value time series data at each time point and the predicted measurement time series data is within the management range It is determined whether abnormal pattern monitoring is performed at each point in time (S216).

According to the present embodiment, the management range can be improved by reflecting the learning result during the training period and by setting different management ranges for each viewpoint, and as a result, when abnormal abnormal measurement time series data occur, There is an effect that can be.

On the other hand, even if the accuracy of the management range is raised by setting the dynamic management range for each viewpoint as shown in FIG. 20, if the actual measurement value time series data does not deviate from the management range, it is not determined as an abnormal pattern. The actual measured value time series data 78 shown in FIG. 21 is also continuously positioned between the upper management range limit line 76 and the lower management range limit line 77, so that it will not be determined as an abnormal pattern. However, it can be seen that the actual measured value time series data 78 shown in FIG. 21 exceeds the predicted measured time series data 75 continuously during daytime (79).

According to an embodiment of the present invention, even if the actual measured value time series data is within the management range, the difference between the actual measured value time series data and the predicted measured time series data exceeds a threshold value obtained based on the representative time series data , It is determined to be a global anomaly. For overall abnormal determination, generation of overall abnormal range information (S212) is necessary. The overall abnormal range information may mean the limit value. Hereinafter, a method of setting the threshold value will be described with reference to FIG.

The distance between the actual measurement value time series data and the predicted measurement time series data can be obtained by utilizing a difference value calculation logic between widely known time series data. For example, the distance between the actual measured value time series data and the predicted measured time series data can be obtained by using various methods such as a DTW distance and a sum of Euclidian distances at respective time points. At this time, the limit value may also be set based on the DTW distance or the sum of the Euclidian distances of the respective viewpoints. Hereinafter, for convenience of explanation, it is assumed that the DTW distance is used as the distance between the actual measurement time series data and the predicted measurement time series data.

Generating a histogram of a DTW (Dynamic Time Warping) distance between each measurement time series data and representative time series data during a training period belonging to the predicted cluster, and setting a DTW distance satisfying a predetermined requirement on the histogram to the threshold value You can decide.

The DTW distance of the measured time series data belonging to a specific cluster with the representative time series data of the cluster is mostly distributed as shown in FIG. That is, the frequency graph 81 of the DTW distance from the representative time series data of the cluster will have a pattern gradually increasing from 0 to decreasing. The threshold value is determined as the DTW distance satisfying the predetermined requirement on the histogram as shown in Fig. An actual measurement value time series data is received (S214), and an anomaly determination is made when the DTW distance between the actual measurement value time series data and the predicted measurement time series data exceeds the threshold value, and in the opposite case, (S216).

The predefined requirement may include a predefined rate in ascending order of the DTW distance among the entire measurement time series data belonging to the cluster. For example, when the number of time series data belonging to the cluster is 1000, the DTW distance at which the frequency of 990, which is 99% of the total frequency of 1000, is included on the histogram can be determined as the threshold value.

The predefined requirement may be the average DTW distance and the standard deviation on the histogram and then the average DTW distance may be the sum of the standard deviation of the predetermined multiple.

In one embodiment, even when the actual measured value time series data is within the management range, when it is determined as a global anomaly, information on the cause of the time series data at a certain point may additionally be provided.

As shown in FIG. 23, it is assumed that the actual measured value time series data 83 is input in the situation where the predicted measured time series data 82 exists. 24 shows a local cost matrix indicating a data difference value (for example, an absolute value) for each time point of the predicted measured time series data 82 and the actual measured value time series data 83. In FIG. As shown in FIG. 23, the total number of viewpoints is 10, and a method of moving to the neighboring cell having the smallest difference value from (the first viewpoint, the first viewpoint) to the tenth viewpoint The minimum cost path can be searched.

After the search for the minimum cost path is completed, the abnormal difference degree may be generated by adding the data difference value belonging to the minimum cost path based on each time point of the predicted measurement time series data 82. For example, in the case of the first point of view, the difference value of (the first point of time and the first point of time) is '1', the abnormal influence degree is calculated. In the case of the fifth point of time, The abnormal influence is calculated by adding 10, which is the sum of the data difference values of 4, 5, 0, and 1, respectively. 3, 7, 3, 10, 2, 3, 6, 9, and 6 in order from the first point to the tenth point in the order of the degree of abnormality affecting the overall abnormality ).

The abnormal influence degree is displayed on the terminal device of the manager as shown in Fig. 25, so that the manager can intuitively grasp the point in time at which the problem occurs. The greater the degree of the abnormal influence, the stronger the display, the more emphasized the display, or the additional alarm means such as sound can be mobilized.

The methods according to the embodiments of the present invention described above with reference to Figs. 2 to 25 can be performed by the execution of a computer program embodied in computer readable code. The computer program may be transmitted from a first computing device to a second computing device via a network, such as the Internet, and installed in the second computing device, thereby enabling it to be used in the second computing device. The first computing device and the second computing device all include a server device, a physical server belonging to a server pool for cloud services, and a fixed computing device such as a desktop PC.

The computer program may be stored in a recording medium such as a DVD-ROM, a flash memory device, or the like.

Time series data monitoring device

Hereinafter, the configuration and operation of a time-series data monitoring apparatus according to another embodiment of the present invention will be described with reference to FIG.

26, the time series data monitoring apparatus 20 according to the present embodiment includes a processor 200, a memory 206, a network interface 204, a storage 208, and a system bus 202 . The processor 200, the network interface 204, the storage 208 and the memory 206 transmit and receive data via the system bus 202. The memory 206 loads the computer program for analyzing the measured time series data during the training period and for predicting the measured time series data of the predicted period. The processor 200 executes the computer program loaded in the memory.

The network interface 204 receives measured time series data and environmental data of a training period through a plurality of sensors and a network connected to the environmental data management apparatus and receives environment data of the forecast period and actual measurement time series data, Transmits to the terminal device through the network interface 204 the cluster information of the measured time series data or the measurement result of the predicted time series data or the result of the monitoring of the measured time series data.

The storage 208 stores measurement time series data received via the network interface 204, the environment data and the measurement time series clustering result data 280 inquired by the computer program, environment time series clustering result data 282, A per-cluster regression model 284, per-view management range information 286, and overall abnormal range information 288.

The measured time series clustering result data 280 includes the result of clustering the measured time series data during the training period and the representative time series data of each cluster.

The environment time series clustering result data 282 includes a result of clustering environment time series data during a training period and representative time series data of each cluster.

The measurement time series data cluster-by-cluster regression model 284 includes configuration information of a cluster-by-cluster regression model of each measurement time series data. The configuration information of the regression model may include regression model type information and a factor list.

The point-of-time management range information 286 may include a standard deviation of each time point of the measurement time series data for the training period belonging to the cluster for each measurement time series data cluster.

The global anomaly range information 288 may include a limit value indicating a DTW distance value from representative time series data of the cluster for each measurement time series data cluster.

The storage 208 may further store information on the optimal classification model for each measurement time series data.

The computer program includes training logic 260, prediction logic 262, and monitoring logic 264.

The training logic 260 includes an operation of clustering measurement time series data of a predetermined period unit during a training period into a plurality of clusters, an operation of collecting a plurality of environmental data during the training period, An operation of selecting at least a part of a parameter as a factor and an operation of generating a classification model that optimally classifies clusters of the measured time series data in a space or a plane constituted by axes indicating the factor, Determining a performance indicator value, selecting the factor, generating the classification model, and determining the performance indicator value by repeating the selection of the factor while changing the performance indicator value to a reference The optimal classification model among the generated classification models .

The prediction logic 262 uses the optimal classification model to predict a cluster of the measured time series data in the prediction period and a prediction model of the prediction time series data using the predicted period And estimating the time series data of the measured value.

The monitoring logic 264 may include an operation of setting a management range for each viewpoint according to a time-variability of each measurement time-series data during a training period belonging to the predicted cluster, And an operation of determining a global anomaly when the difference between the actual measurement value time series data and the predicted measurement time series data exceeds a threshold value obtained based on the representative time series data.

In the present specification, the operation is interpreted and executed by the processor 200 and consists of a series of or more instructions that perform a specific function.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, You will understand. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

Claims (11)

Predicting a cluster of measured time series data of the predicted time period from environmental data of a predicted time period according to an analysis result of measurement time series data and environmental data during a training period;
Setting a management range for each viewpoint according to a time-variability of each measurement time-series data during a training period belonging to the predicted cluster; And
And monitoring whether the actual measurement time series data of the prediction period satisfies the management range for each viewpoint.
How to monitor time series data. The method according to claim 1,
Wherein the prediction period includes a first time point and a second time point after the first time point,
Wherein setting the management scope for each viewpoint includes setting the management scope of the first viewpoint and the management scope of the second viewpoint to different values.
How to monitor time series data. 3. The method of claim 2,
Wherein the step of setting the management range of the first viewpoint and the management scope of the second viewpoint are different from each other,
And setting the management range of the first viewpoint to a value larger than the management range of the second viewpoint when the variability at the first viewpoint is larger than the variability at the second viewpoint.
How to monitor time series data. The method according to claim 1,
Further comprising: predicting the measured time series data of the prediction period using a regression model for the predicted cluster,
Wherein the monitoring comprises:
Determining whether a difference value between the actual measurement value time series data at each time point and the predicted measurement time series data is within the management range for each view point,
How to monitor time series data. Predicting a cluster of measured time series data of the predicted time period from environmental data of a predicted time period according to an analysis result of measurement time series data and environmental data during a training period;
Predicting the measured time series data of the prediction period by using a regression model for the predicted cluster;
Receiving actual measured value time series data of the prediction period;
Obtaining representative time series data of the predicted cluster; And
Even if the actual measured value time series data is within the management range, if the difference between the actual measured value time series data and the predicted measured time series data exceeds a threshold value obtained based on the representative time series data, , ≪ / RTI >
How to monitor time series data. 6. The method of claim 5,
Wherein the step of determining as the overall abnormality comprises:
Generating a histogram of a time series distance between each measurement time series data and the representative time series data during a training period belonging to the predicted cluster; And
Determining the time-series distance satisfying a pre-specified requirement on the histogram as the threshold,
How to monitor time series data. The method according to claim 6,
The step of determining, as the threshold value, a DTW distance satisfying a predetermined requirement on the histogram,
And determining, as a threshold value, the time-series distance in which a pre-specified ratio is included in ascending order of the time-series distance among all measurement time-series data belonging to the cluster.
How to monitor time series data. The method according to claim 6,
Wherein the step of determining the time-series distance satisfying a predetermined requirement on the histogram as the threshold value comprises:
And determining the threshold using an average value and a standard deviation of the time series distance on the histogram.
How to monitor time series data. 6. The method of claim 5,
Wherein the step of determining as the overall abnormality comprises:
Generating a local cost matrix indicating a data difference value between the predicted measured value time series data and the actual measured value time series data at each time point;
Searching for a least cost path on the local cost matrix; And
Using the least cost path to generate an abnormal impact for each point in time,
How to monitor time series data. 10. The method of claim 9,
Wherein the step of generating the abnormal influence degree for each viewpoint comprises:
And summing the data difference values belonging to the minimum cost path based on each time point of the predicted measured value time series data to generate the abnormal influence degree.
How to monitor time series data. A memory for loading a computer program for analyzing measured time series data during a training period to predict said measured time series data in a predicted period;
A processor for executing the computer program loaded in the memory;
Network interface; And
A storage for storing measurement time series data received via the network interface, the environment data, and data inquired by the computer program,
The computer program comprising training logic, prediction logic and monitoring logic,
The training logic comprises:
Clustering measurement time series data of a predetermined period unit during a training period into a plurality of clusters;
Collecting a plurality of environmental data during the training period;
And an operation of generating an optimal classification model that optimally classifies clusters of the measurement time series data with at least a part of the plurality of environmental data as factors,
The prediction logic comprises:
An operation of predicting a cluster of the measurement time series data in the prediction period using the optimal classification model; And
And estimating the time series data of the predicted period by using a regression model for the predicted cluster,
The monitoring logic comprises:
An operation for setting a management range for each viewpoint according to a time-variability of each measurement time-series data during a training period belonging to the predicted cluster; And
Even if the actual measured value time series data is within the management range, if the difference between the actual measured value time series data and the predicted measured time series data exceeds a threshold value obtained based on the representative time series data, ≪ / RTI >
Time series data monitoring device.

Images