KR20180081437A - Outlier detecting method, device and system using the method - Google Patents

Abstract

The present invention relates to an outlier detecting method and a device and system using the same that are capable of determining whether data newly acquired is an outlier by using a change value and a residual value of the data newly acquired. According to the present invention, the outlier detecting method includes the steps of: acquiring change value data and residual value data on learning data having a reference size; determining whether data newly acquired is an outlier by using the change value data and the residual value data acquired and a change value and a residual value of the data newly acquired; and substituting the data determined as the outlier with a regression value based on the last n data values of the learning data, wherein n is a natural number.

Description

TECHNICAL FIELD [0001] The present invention relates to an outlier detection method, an apparatus and a system using the outlier detection method,

The present invention relates to an outlier detection method and an apparatus and a system using the outlier detection method. More particularly, the present invention relates to an outlier detection method, and more particularly, And an apparatus and a system using the same.

The generalized extreme studentized deviate (GESD) model is an outlier detection algorithm using statistical distribution. In the GESD model, a null hypothesis is given that there is no anomaly in a given dataset, and the opposite hypothesis is given that there are up to r anomalies. The GESD model uses r data values as a statistic, assuming that the data follows a normal distribution.

The GESD model is used in many industries that require detection of extreme values, such as weather, finance, and factories. However, most of the recent extreme value detection models that use GESD models have poor prediction accuracy in special situations such as data trend or seasonality.

Technical Solution According to an aspect of the present invention, there is provided an outlier detection method, an apparatus and a system using the outlier detection method. The outcome detection method includes a step of determining whether the newly acquired data corresponds to an outlier And an apparatus and a system using the method.

According to an aspect of the present invention, there is provided an outlier detection method, comprising: obtaining change value data and residual value data for learning data of a reference size; calculating the difference value data and the residual value data Determining whether the newly acquired data corresponds to an outlier by using a change value and a residual value of newly acquired data and comparing the data determined as an outlier with the last n and n is a natural number) of the plurality of data values.

According to an exemplary embodiment, the change value data is obtained by calculating a difference between a target data value and an adjacent previous data value of the target data value, for each of the data values contained in the training data collected in a time series .

According to an exemplary embodiment, the change value data is obtained by calculating a difference between a target data value and a previous data value that is not adjacent to the target data value, for each of the data values included in the learning data collected in a time series ≪ / RTI >

According to an exemplary embodiment, the residual value data includes, for each of the data values included in the learning data collected in a time series, a regression value based on a plurality of previous data values adjacent to the target data value and a difference . ≪ / RTI >

According to an exemplary embodiment, the number of the plurality of previous data values adjacent to the target data value may be determined according to a user setting or a data change trend.

According to an exemplary embodiment of the present invention, the step of determining whether the newly acquired data corresponds to an outlier may include determining whether a change value for the newly acquired data corresponds to an outlier, And if it is an outlier, the newly acquired data can be determined as an outlier.

According to an exemplary embodiment, the step of detecting whether the newly acquired data corresponds to an outlier may include determining whether the newly acquired data corresponds to an outlier through an Extreme Studentized Deviate (ESD) test or a Generalized ESD (GESD) test Can be detected.

According to an exemplary embodiment, the newly acquired data can be acquired in real time or non real time.

According to an exemplary embodiment, the outlier detection method may further include changing the reference size of the learning data according to a user setting or a data change trend.

According to an exemplary embodiment, when the reference size is increased according to the step of changing the reference size, data that is replaced with the regression value while keeping the existing data values of the learning data may be included in the learning data have.

According to an aspect of the present invention, there is provided an apparatus for detecting an abnormal value, the apparatus comprising: an acquisition unit configured to acquire variation value data and residual value data for learning data of a reference size, An outlier determining unit that determines whether the newly acquired data corresponds to an outlier using the change value and the residual value of the newly acquired data, And a learning data updater that replaces the n data with a regression value based on a plurality of data values of n).

According to an exemplary embodiment, when the change value for the newly acquired data corresponds to an outlier, or when the residual value for the newly acquired data corresponds to an outliers, It can be judged to be outliers.

According to an exemplary embodiment, the outlier detection apparatus may further include a learning data size controller for changing the reference size of the learning data according to a user setting or a data change trend.

According to an exemplary embodiment, the outlier detection apparatus may further include a failure determination unit that determines a failure status of the apparatus that provided the data newly acquired by the outlier detection apparatus, based on the determination result of the outlier determination unit .

The abnormal value detection system according to an aspect of the present invention includes an abnormal value detection device for detecting an abnormal value contained in the data based on a server and data provided from the server, And acquires the change value data and the residual value data for the learning data of the new acquisition data and the change value data and the residual value data for the learning data using the obtained change value data and the residual value data, And an unexpected value determiner for determining whether one of the data corresponds to an outlier and data detected as an outlier by using a regression value based on a plurality of data values of last n (n is a natural number) And a learning data updater that replaces the training data updater with a learning data updater.

The method and apparatus according to the technical idea of the present invention can determine whether the newly acquired data corresponds to an outlier by using a change value and a residual value of newly acquired data together, Has a high prediction accuracy even in a special environment such as a time-dependent trend or seasonality.

The method and apparatus according to embodiments of the present invention can replace data determined as an outlier with a regression value based on a plurality of data values of last n (n is a natural number) of the learning data, It is possible to remarkably reduce the influence of the abnormality already generated on the detection of the subsequent abnormality.

Further, the method and apparatus according to the technical idea of the present invention can flexibly change the reference size of the learning data in accordance with the user setting or the data change tendency, The accuracy can be further improved.

BRIEF DESCRIPTION OF THE DRAWINGS A brief description of each drawing is provided to more fully understand the drawings recited in the description of the invention.
1 is a flowchart of an outlier detection method according to an embodiment of the present invention.
2 is a block diagram of an outlier detection apparatus according to an embodiment of the present invention.
FIG. 3 is a block diagram according to one embodiment of the outlier detector shown in FIG. 2. FIG.
4 is learning data used in an outlier detection method according to an embodiment of the present invention.
5 is change value data used in an outlier detection method according to an embodiment of the present invention.
6 is a graph illustrating the concept of a residual used in the method of detecting an outlier according to an embodiment of the present invention.
7 is residual value data used in an outlier detection method according to an embodiment of the present invention.
8 is a graph showing one embodiment of newly acquired data shown in FIG.
FIG. 9 shows updated learning data according to the newly acquired data shown in FIG.
10 is a graph showing another embodiment of the newly acquired data shown in FIG.
11 is an example of learning data updated according to the newly acquired data shown in FIG.
12 is another embodiment of the learning data updated according to the newly acquired data shown in FIG.
13 is a block diagram of an outlier detection system according to an embodiment of the present invention.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. However, it should be understood that the technical idea of the present invention is not limited to the specific embodiments but includes all changes, equivalents, and alternatives included in the technical idea of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0029] In the following description of the present invention, a detailed description of known technologies will be omitted when it is determined that the gist of the present invention may be unnecessarily obscured. In addition, numerals (e.g., first, second, etc.) used in the description of the present invention are merely an identifier for distinguishing one component from another.

Also, in this specification, when an element is referred to as being "connected" or "connected" with another element, the element may be directly connected or directly connected to the other element, It should be understood that, unless an opposite description is present, it may be connected or connected via another element in the middle.

The terms "to", "to", "to", "to", and "module" in the present specification mean units for processing at least one function or operation, A micro processor, a central processing unit (CPU), a graphics processing unit (GPU), an Accelerate Processor Unit (APU), a digital signal processor (DSP), an application specific integrated circuit (ASIC) (Field Programmable Gate Array), or the like, or a combination of hardware and software.

It is to be clarified that the division of constituent parts in this specification is merely a division by each main function of each constituent part. That is, two or more constituent parts to be described below may be combined into one constituent part, or one constituent part may be divided into two or more functions according to functions that are more subdivided. In addition, each of the constituent units described below may additionally perform some or all of the functions of other constituent units in addition to the main functions of the constituent units themselves, and that some of the main functions, And may be carried out in a dedicated manner.

Hereinafter, embodiments according to the technical idea of the present invention will be described in detail.

1 is a flowchart of an outlier detection method according to an embodiment of the present invention. 2 is a block diagram of an outlier detection apparatus according to an embodiment of the present invention.

1 and 2, an outlier detection apparatus 100 according to an embodiment of the present invention includes a learning data generator 110, an outlier determination unit 120, a learning data size controller 130, a learning data updater 140, and a fault determinator 150.

The learning data generator 110 may acquire the collected data (O-DATA) from the outside and generate the learning data (T-DATA) of the reference size based on the acquired collected data (O-DATA) .

The learning data generator 110 may provide the generated learning data T-DATA to the outlier determination unit 120. [

According to the embodiment, the learning data generator 110 may collect collected data (O-DATA) from the outside until learning data (T-DATA) of a reference size can be generated.

The outlier determining unit 120 may calculate and obtain the change value data and the residual value data for the learning data (T-DATA) (S20). Details thereof will be described later with reference to FIG. 3 to FIG.

The outliers 120 are based on the change value data and the residual value data for the learning data (T-DATA) provided from the learning data generator 110 and the change values and residual values for the newly acquired data (N-DATA) , It can be determined whether or not the newly acquired data (N-DATA) corresponds to an outlier (S30).

According to the embodiment, newly acquired data can be acquired in real time or in non-real time.

According to the embodiment, the outlier determination unit 120 determines the last n data (N-DATA) of the learning data (T-DATA) when the newly acquired data (N-DATA) n is a natural number), and transmits the data value to the learning data updater 140.

According to another embodiment, the outlier determining unit 120 may transmit the newly acquired data (N-DATA) to the learning data updater 140 when the newly acquired data (N-DATA) does not correspond to the outliers.

The outliers 120 may transmit to the failure determiner 150 information about whether the newly acquired data (N-DATA) corresponds to an outlier.

The learning data size controller 130 can control the reference size of the learning data (T-DATA).

According to the embodiment, the learning data size controller 130 determines necessity of changing the reference size of the learning data (T-DATA) according to the user setting or the data change trend (S40) DATA) can be reduced or increased.

According to the embodiment, the data change trend may be determined based on a change pattern of the newly acquired data (N-DATA) for a predetermined time period.

According to the embodiment, the learning data size controller 130 can increase the reference size when the change pattern indicating the data change trend is longer than the reference value, that is, the data change trend is slow.

According to another embodiment, the learning data size controller 130 can reduce the reference size when the change pattern indicating the data change trend is shorter than the reference value, that is, the data change trend is fast.

The learning data updater 140 may update the learning data T-DATA using the newly acquired data (N-DATA) or the replaced data value transmitted from the outlier determination unit 120 (S50).

According to the embodiment, when the learning data size is maintained, the initial data value of the learning data (T-DATA) is discarded and the newly acquired data (N-DATA) or the replaced data Value may be included in the learning data (T-DATA). Details thereof will be described later with reference to FIG. 9 and FIG.

According to another embodiment, when the learning data size is changed to increase, the existing data values of the training data T-DATA are maintained and the newly acquired data (N-DATA) or substitution Data value can be included in the learning data (T-DATA). Details thereof will be described later with reference to Fig.

The fault determinator 150 can determine the fault condition of the apparatus that provided the newly acquired data (N-DATA) using the determination result of the outlier determination unit 120. [

According to the embodiment, the fault determinator 150 may calculate the point in time at which the fault condition occurs by calculating the point in time at which the data determined to be outliers are obtained.

According to the embodiment, the outlier detection apparatus 100 may receive collected data (O-DATA) and newly acquired data (N-DATA) from the same apparatus or from different apparatuses.

According to the embodiment, the functions of the respective components 110 to 150 of the outlier detection apparatus 100 can be performed by a combination of a processor and a memory.

FIG. 3 is a block diagram according to one embodiment of the outlier detector shown in FIG. 2. FIG. 4 is learning data used in an outlier detection method according to an embodiment of the present invention. 5 is change value data used in an outlier detection method according to an embodiment of the present invention. 6 is a graph illustrating the concept of a residual used in the method of detecting an outlier according to an embodiment of the present invention. 7 is residual value data used in an outlier detection method according to an embodiment of the present invention.

2 and 3, the outlier value determiner 120 may include a change value calculator 122, a regression value calculator 124, a residual value calculator 126, and an outlier determination module 128.

The change value calculator 122 receives the learning data T-DATA and the newly acquired data N-DATA and stores change value data for the learning data T-DATA and newly acquired data N-DATA, Can be calculated.

Referring to FIG. 4 and FIG. 5 together, learning data (T-DATA) including eight data values is shown as an example of learning data (T-DATA).

According to the embodiment, the change value calculator 122 calculates the target data (e.g., the second data value DV2a) for each of the data values DV1a to DV8a included in the learning data T- (E.g., the first data value DV1a) of the target data (e.g., the second data value DV2a) and the adjacent previous data value of the target data (e.g., the second data value DV2a).

For example, the change value calculator 122 calculates the difference between the second data value DV2a included in the learning data T-DATA and the first data value DV1a which is the adjacent previous data value of the second data value DV2a , And obtain the calculated difference value as the first data value DV1b of the change value data (V-DATA).

According to another embodiment, the change value calculator 122 calculates the target data (e.g., the third data value DV3a) for each of the data values DV1a to DV8a included in the learning data T- (V-DATA) by calculating the difference between the target data (e.g., the first data value DV1a) and the target data (e.g., the third data value DV3a) have.

For example, the change value calculator 122 calculates the difference value between the third data value DV3a included in the learning data T-DATA and the first data value DV1a, which is the previous data value not adjacent to the third data value DV3a, , And obtain the calculated difference value as the first data value DV1b of the change value data (V-DATA).

The change value calculator 122 may calculate a change value for the newly acquired data (N-DATA). According to the embodiment, the change value calculator 122 calculates the difference between the data value of the newly acquired data (N-DATA) and the last data value (e.g., DV8a) of the learning data (T-DATA) Value can be obtained as the change value.

The change value calculator 122 may transmit the change value data (V-DATA) and the change value for the newly acquired data (N-DATA) to the outlier determination module 128.

3, the regression value calculator 124 receives the learning data (T-DATA) and the newly acquired data (N-DATA) and stores the received learning data (T-DATA) ) Can be used to calculate a regression equation for the data values collected in a time-series manner.

The regression value calculator 124 may calculate a regression equation and a regression value based on the data values in the set window size for the data values included in the learning data T-DATA.

According to the embodiment, the window size used in the calculation of the regression equation and the regression value of the regression value calculator 124 may be determined according to the user setting or the data change trend.

The residual value calculator 126 may calculate a residual value indicating a difference between the regression value calculated by the regression value calculator 124 and the data value included in the learning data T-DATA.

6, the regression value calculator 124 calculates the regression value of the adjacent previous data (e.g., 4) within the set window size (for example, 4) with respect to the target data value (e.g., the fourth data value DV4a) included in the learning data It is possible to calculate the regression formula ri based on the values (e.g., the first data value DV1a to the fourth data value DV4a).

In this case, the residual value calculator 126 may calculate the residual value RES indicating the difference between the target data value (e.g., the fourth data value DV4a) and the regression value corresponding to the target data value.

Referring to FIGS. 4, 6 and 7, a target data value included in the learning data T-DATA, for example, a residual value for the fourth data value DV4a, 1 data value DV1c and the target data value such as the residual value for the fifth data value DV5a may be calculated as the second data value DV2c of the residual value data R-DATA. The target value data included in the learning data T-DATA, e.g., the sixth data value DV6a, the seventh data value DV7a, and the eighth data value DV8a, The third data value DV3c, the fourth data value DV4c, and the fifth data value DV5c of the data R-DATA.

The residual value calculator 126 may calculate the residual value for the newly acquired data (N-DATA). In this case, the residual value calculator 126 calculates the difference between the regression value based on the plurality of data values of the last n (n is a natural number) of the learning data (T-DATA) and the data value of the newly acquired data Can be calculated.

The residual value calculator 126 may transmit the residual value data (R-DATA) and the residual value of the newly acquired data (N-DATA) to the outlier determination module 128.

3, the outlier determination module 128 determines whether or not the change value data (V-DATA) received from the change value calculator 122 and the change value for the newly acquired data (N-DATA) (N-DATA) corresponds to an outlier by using the residual value data (R-DATA) transferred from the data acquisition unit (N-DATA) and the residual value for the newly acquired data .

According to the embodiment, the outlier determination module 128 can detect and determine whether the newly acquired data (N-DATA) corresponds to an outliers through an ESD (Extreme Studentized Deviate) test or a GESD .

The outlier determination module 128 may transmit different data values to the learning data updater 140 depending on whether the newly acquired data (N-DATA) corresponds to an outlier.

According to an embodiment, the outlier determination module 128 may determine that the change value for the newly acquired data (N-DATA) corresponds to an outliers or the residual value for newly acquired data (N-DATA) corresponds to an outliers , It is possible to determine the newly acquired data (N-DATA) as an outliers.

According to the embodiment, the outliers determination module 128 updates the data n-DATA newly obtained when the newly acquired data N-DATA corresponds to the outliers to the last n data n-DATA of the learning data N-DATA n is a natural number), and transmits the data value to the learning data updater 140.

According to another embodiment, the outlier determination module 128 may transmit the newly acquired data (N-DATA) to the learning data updater 140 when the newly acquired data (N-DATA) does not correspond to the outliers.

Detailed data processing of the outlier determination module 128 and the learning data updater 140 according to whether or not the newly acquired data (N-DATA) corresponds to an outliers will be described later with reference to FIG. 8 to FIG.

The outlier determination module 128 may pass information on whether the newly acquired data (N-DATA) corresponds to an outlier to the failure determiner 150. [

8 is a graph showing one embodiment of newly acquired data shown in FIG. FIG. 9 shows updated learning data according to the newly acquired data shown in FIG. 10 is a graph showing another embodiment of the newly acquired data shown in FIG. 11 is an example of learning data updated according to the newly acquired data shown in FIG. 12 is another embodiment of the learning data updated according to the newly acquired data shown in FIG.

8 and 9 show data processing of the outlier determination module 128 and the learning data updater 140 when the newly acquired data (N-DATA1) does not correspond to the outliers.

If the newly acquired data (N-DATA1) does not correspond to the outliers as a result of the determination by the outlier determination module 128, the outlier determination module 128 sends the newly acquired data (N-DATA1) to the learning data updater 140 .

In this case, the learning data updater 140 updates the learning data (T-DATA1) so that the newly acquired data (N-DATA1) is included in the learning data (T-DATA1) The initial data value DV1a can be discarded and the updated learning data T-DATA1 can be obtained.

10 to 12 show data processing of the outlier determination module 128 and the learning data updater 140 when the newly acquired data (N-DATA1) corresponds to an outlier.

If the newly acquired data (N-DATA2) corresponds to an outlier as a result of the determination by the outlier determination module 128, the outlier determination module 128 stores the newly acquired data (N-DATA2) (E.g., rDV8a) based on the last n data, e.g., three data values (e.g., DV6a to DV8a) of the data values (N-DATA2 ').

According to the embodiment, when replacing the data (N-DATA2) determined to be outliers with other data values, it is used to obtain a regression equation (ri ') for replacing the data (N-DATA2) In this case, the size of the window 'is smaller than the size of the window used for obtaining the regression equation (ri) in FIG. 6, 1 < / RTI >

According to another embodiment, when the data (N-DATA2) determined to be outliers is replaced with another data value, it is used to obtain a regression equation (ri ') for replacing the data (N-DATA2) (N-DATA2), which is determined to be outliers, is excluded from the window 'window', and the size of the window 'is maintained to be the same as the window used to obtain the regression equation (ri) And may be set to be shifted while maintaining a constant value.

11, when the size of the learning data is kept the same, the learning data updater 140 performs update so that the replaced data value (N-DATA2 ') is included in the learning data (T-DATA2) DATA2 from the data values included in the training data T-DATA of the training data T-DATA.

12, when the size of the learning data is changed to increase, the learning data updater 140 maintains the existing data values of the learning data (T-DATA) and stores the replaced data values (N-DATA2 ' (T-DATA2 ') by including the updated training data (T-DATA2').

13 is a block diagram of an outlier detection system according to an embodiment of the present invention.

1 to 3 and 13, the outlier detection system 300 according to an embodiment of the present invention may include the outlier detection apparatus 100 and the server 200. [

The outlier detection apparatus 100 of Fig. 13 is substantially the same as the outlier detection apparatus 100 of Fig.

13, the outlier detection apparatus 100 is illustrated as being implemented outside the server 200, but the present invention is not limited thereto. The outliers detection apparatus 100 may be included in the server 200 .

According to the embodiment, the outlier detection apparatus 100 can detect an abnormal value included in the data based on the data provided from the server 200. [

According to an embodiment, the outlier detection apparatus 100 receives data (e.g., a server response time) indicative of a performance index of the server 200, and transmits the data to the server 200 It is possible to judge whether an error or a failure has occurred.

According to an embodiment, the outlier detection system 300 may be implemented as an application performance management (APM) system.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, Various modifications and variations are possible.

100: Outlier detection device
200: Server
300: Outlier Detection System

Claims (15)

Obtaining change value data and residual value data for learning data of a reference size;
Determining whether the newly acquired data corresponds to an outlier by using the obtained change value data, the residual value data, a change value and a residual value of newly acquired data; And
And replacing the data judged to be outliers by a regression value based on a plurality of data values of the last n (n is a natural number) of the learning data.
The method according to claim 1,
The change-
For each of the data values included in the learning data collected in a time series, a difference between a target data value and an adjacent previous data value of the target data value.
The method according to claim 1,
The change-
For each of the data values included in the learning data collected in a time-series manner, a difference between a target data value and a previous data value that is not adjacent to the target data value.
The method according to claim 1,
The residual value data may include:
For each of the data values contained in the training data collected in a time series, a difference between the target data value and a regression value based on a plurality of previous data values adjacent to the target data value.
5. The method of claim 4,
Wherein the number of previous data values adjacent to the target data value,
The method of detecting an outlier is determined by user setting or trend of data change.
The method according to claim 1,
Wherein the step of determining whether the newly acquired data corresponds to an outlier comprises:
When the change value of the newly acquired data corresponds to an outlier value or when the residual value of the newly acquired data corresponds to an outlier value, the newly acquired data is determined as an outlier.
The method according to claim 1,
Wherein the step of detecting whether the newly acquired data corresponds to an outlier comprises:
And detecting whether the newly acquired data corresponds to an anomaly through an ESD (Extreme Studentized Deviate) test or a GESD (Generalized ESD) test.
The method according to claim 1,
The newly acquired data is,
Real-time or non-real-time acquisition of anomaly detection method.
The method according to claim 1,
The abnormal value detection method includes:
Further comprising changing the reference size of the training data in accordance with a user setting or a data change trend.
10. The method of claim 9,
When the reference size is increased according to the step of changing the reference size,
Wherein the learning data includes data replaced with the regression value while maintaining existing data values of the learning data.
And acquiring change value data and residual value data for the learning data of the reference size and using the obtained change value data and the residual value data and a change value and a residual value for newly acquired data, An outlier determining unit for determining whether newly acquired data corresponds to an outlier; And
And a learning data updater for replacing the data detected as an outlier with a regression value based on a plurality of data values of last n (n is a natural number) of the learning data.
12. The method of claim 11,
The abnormal-
And determines the newly acquired data as an outlier when the change value for the newly acquired data corresponds to an outlier or when the residual value for the newly acquired data corresponds to an outlier.
12. The method of claim 11,
Further comprising a learning data size controller for changing the reference size of the learning data in accordance with a user setting or a data change trend.
12. The method of claim 11,
Further comprising a failure judgment unit for judging a failure situation of the device which has provided the data newly acquired by the above-mentioned abnormal value detection device, based on the judgment result of the above-mentioned outliers value judging device.
server; And
And an abnormal value detection device for detecting an abnormal value included in the data based on data provided from the server,
The above-
And acquiring change value data and residual value data for the learning data of the reference size and using the obtained change value data and the residual value data and a change value and a residual value for newly acquired data, An outlier determining unit for determining whether newly acquired data corresponds to an outlier; And
And a learning data updater for replacing the data detected as an outlier with a regression value based on a plurality of data values of the last n (n is a natural number) of the learning data.

Images