KR20200058161A - Method of generating normal band for abnormal data detecting based on time series data and using follower boundray setting and device implementing thereof - Google Patents

Abstract

The present invention relates to a method for generating a normal band based on boundary setting of followers and time series data and a normal band generating device implementing the same. The normal band generating device according to an embodiment of the present invention comprises: a database for storing data calculated in chronological order; a follower generator which receives anchor data that is preceded in chronological order, receives noise data that diversifies the anchor data to calculate U, L, and follower data, and calculates follower data to correspond to the noise data by applying a mathematical relationship established between the noise data; and a band generator which generates a normal band composed of follower data calculated by the follower generator.

Description

METHOD OF GENERATING NORMAL BAND FOR ABNORMAL DATA DETECTING BASED ON TIME SERIES DATA AND USING FOLLOWER BOUNDRAY SETTING AND DEVICE IMPLEMENTING THEREOF}

The present invention relates to a method for generating a normal band capable of detecting abnormal data based on a boundary setting of a follower and time series data, and a normal band generating apparatus implementing the same.

Recently, various algorithms and methodologies for machine learning have been proposed. What is needed in machine learning is to perform learning using more data than anything else. However, in order to secure data, it is necessary to select data suitable for learning from a large number of data and link it with the result of learning. Deep learning is a technology based on such learning, and there are convolutional neural networks (CNNs) and reccurrent neural networks (RNNs) as supervised learning methods based on numerous data.

Therefore, there is increasing interest in unsupervised learning technology that produces information from the data itself without a learning process through a large number of learning data. Recently, the GAN (Generative Adversarial Network) aims to generate real-life data without providing information about the correct answer.

However, in order to create data and make it indistinguishable from real data, it is necessary to be given the role of making data as a counterfeit (generator) and the role of discriminating whether or not this data is counterfeit. And, through the interaction between the generator and the discriminator, a large number of created data can be calculated based on a small number of data.

Hereinafter, a method and apparatus for constructing data on a time series based on a generator and a discriminator in new configurations such as GAN will be described. In particular, a method and apparatus for increasing the precision of the generation of the follower data by using the follower boundary setting in order to fine-tune the range or condition of the follower data will be described.

The present invention seeks to predict the subsequent data of the time series data by calculating the learned follower generator using the time series data.

The present invention makes it possible to determine whether the subsequently calculated time series data is normal data by generating a normal band that is a range of subsequent data of the time series data.

The present invention seeks to increase prediction accuracy and normal judgment accuracy of time-series data by calculating subsequent time-series data close to actual time-series data when the time-series data is input by a device learned based on time-series data.

The present invention seeks to increase the precision of the creation of the follower data by applying a cost function to fine-tune the range or condition of the follower data.

The problems to be solved by the present invention are not limited to the problems mentioned above, and other problems not mentioned herein will be clearly understood by those skilled in the art from the following description.

In the normal band generating apparatus according to an embodiment of the present invention, a database in which data calculated in chronological order is stored, and anchor data preceding in chronological order are input, and noise data for diversifying the anchor data is input to form a boundary. It includes U, L which are the boundary setting values, a follower generator for calculating follower data, and a band generator for generating a normal band composed of follower data calculated by the follower generator. The method of generating a normal band by the normal band generating apparatus according to an embodiment of the present invention includes storing data calculated in chronological order in a database of the normal band generating apparatus, and a follower generator of the normal band generating apparatus in chronological order. Receiving m data of preceding anchors, receiving noise data for diversifying the anchor data, and calculating U, L and follower data, which are two boundary set values, which are boundaries, and of the normal band generating apparatus. And a band generator generating a normal band composed of follower data calculated by the follower generator.

When implementing the present invention, a learned follower generator can be calculated using time series data to predict subsequent data of the time series data.

When implementing the present invention, it is possible to determine whether the subsequently calculated time series data is normal data by generating a normal band of subsequent data of the time series data to have a certain range, such as a band.

In the implementation of the present invention, when time-series data is input by a device trained based on time-series data, subsequent time-series data can be calculated close to actual time-series data to increase prediction accuracy and normal judgment accuracy of time-series data.

When implementing the present invention, the precision of the generation of the follower data can be increased by setting the boundary of the follower to fine-tune the range or condition of the follower data.

The effects provided by the present invention are not limited to the above-mentioned effects, and other effects not mentioned herein will be clearly understood by those skilled in the art from the following description.

1 is a view showing the operation process of the GAN.
2 is a view showing the configuration of a normal band generating apparatus according to an embodiment of the present invention.
3 is a view showing a process of discrimination by the discriminator according to an embodiment of the present invention.
4 is a diagram illustrating a process in which a follower generator according to an embodiment of the present invention generates a follower.
5 to 8 are views showing the position of the normal band and the measured follower data according to an embodiment of the present invention.
9 is a graph showing a form in which the time series data shown in FIG. 5 is continuously accumulated and located inside or outside a normal band according to an embodiment of the present invention.
10 and 11 are views showing a process of setting and operating anchor data and follower data in time series data according to an embodiment of the present invention.
12 is a diagram illustrating a process of generating a normal band corresponding to input anchor data based on a learned follower generator by the normal band generating apparatus according to an embodiment of the present invention.
13 is a diagram illustrating a process of performing learning between a discriminator and a follower generator according to an embodiment of the present invention.
14 is a diagram illustrating a process in which a follower generator according to an embodiment of the present invention generates a plurality of followers to generate a normal normal band.
15 is a view showing the configuration of a follower generator and a discriminator that calculates a follower and a boundary of a follower is set according to an embodiment of the present invention.
FIG. 16 is a view showing the relationship between the followers and U and L to which the embodiment of FIG. 15 is applied.
17 is a view showing a configuration of a normal band generating apparatus for outputting values between U, L and U, L, which are boundary setting values, according to an embodiment of the present invention.
18 is a view showing a process of discrimination by the discriminator according to an embodiment of the present invention.
19 is a diagram illustrating a process in which a follower generator according to an embodiment of the present invention generates a follower.
20 and 21 are diagrams to which follower data according to an embodiment of the present invention is applied.

Advantages and features of the present invention, and methods for achieving them will be clarified with reference to embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in various different forms, and only the present embodiments allow the disclosure of the present invention to be complete, and common knowledge in the art to which the present invention pertains. It is provided to completely inform the person having the scope of the invention, and the present invention is only defined by the scope of the claims. The same reference numerals refer to the same components throughout the specification.

In order to clearly describe the present invention, parts irrelevant to the description are omitted, and the same reference numerals are assigned to the same or similar elements throughout the specification. In addition, some embodiments of the present invention will be described in detail with reference to exemplary drawings. In adding reference numerals to the components of each drawing, the same components may have the same reference numerals as possible even though they are displayed on different drawings. In addition, in describing the present invention, when it is determined that detailed descriptions of related well-known structures or functions may obscure the subject matter of the present invention, detailed descriptions thereof may be omitted.

In addition, in describing the components of the present invention, terms such as first, second, A, B, (a), and (b) may be used. These terms are only for distinguishing the component from other components, and the essence, order, order, or number of the component is not limited by the term. When a component is described as being "connected", "coupled" or "connected" to another component, the component may be directly connected to or connected to the other component, but different components between each component It will be understood that the "intervenes" may be, or each component may be "connected", "coupled" or "connected" through other components.

The generator and discriminator described in the embodiment of the present invention are modules composed of software, but it is also an embodiment that these software modules are mounted in hardware. Therefore, the description of each module in this specification may be implemented in software or hardware.

As described above, in the case of deep learning, which is machine learning using a neural network, data of a pair of inputs and outputs is required for learning. However, much time is devoted to calculating such input-output data. For example, in order to learn images of cats and dogs, many images of cats, many images of dogs, and their labeling information are required.

For this, it became necessary to generate data necessary for learning.

1 is a view showing the operation process of the GAN. The discriminator 30 and the generator 10 are networks composed of neural networks. In addition, the database (DB) 20 is a component in which actual data (Data_real) is stored.

The discriminator 30 receives data from the database 20 or the generator 10. And, it is learned to determine the data (data_real) provided by the database 20 and the data (data_fake) provided from the generator 10 among these data.

On the other hand, the generator 10 learns to determine that the data (data_fake) provided to the discriminator 30 is data_real. That is, the generator 10 learns so that the discriminator 30 determines data_fake as data_real.

The learning directions of the two neural network learners (identifier and generator) are summarized as follows. The discriminator 30 learns to distinguish actual data from data generated by the generator 10, and the generator 10 learns to generate data that the discriminator 30 cannot distinguish. The repeated learning result generator 10 may generate data similar to actual data stored in the database 20.

1 has looked at the process of generating data that mimics normal data. The simulation of normal data can calculate the range that normal data can have. Accordingly, in this specification, a configuration for calculating a normal range of data based on normal data and data simulating normal data to predict a range of subsequent data, and to determine a normal and abnormal state in response thereto will be described.

Hereinafter, the configuration of the normal band generating apparatus according to an embodiment of the present invention and their operation process will be described. The normal band means indicating a normal range of data to be calculated later based on a part of the time series data. It indicates the range of the normal area, such as a tunnel or band of data. In order to generate a normal band, a learning process consisting of two data groups is required. The first data group is a group consisting of anchor data, and indicates preceding data among time series data. The second data group is a group consisting of follower data, and indicates subsequent data among time series data.

In order to generate a normal band, based on the measured or sensed data, the discriminator produces a lot of data that cannot be distinguished. In this process, the follower data is simulated and generated based on the anchor data, and then composed of these follower data or these Create a normal band defined by follower data.

As a result, errors of the time series data can be predicted in advance by predicting data of followers that will occur later using the time-series input data (anchor data) or by checking whether the follower data is normal or abnormal. In addition, it is possible to predict computer performance based on time-series data, predict stock prices, and predict abnormal conditions of devices.

In addition, hint data may be additionally provided to increase accuracy in generating bands of anchor data and follower data constituting time series data. The hint data means non-time-series data corresponding to the anchor data. For example, when extracting computer performance (CPU speed) information in time series to construct anchor data and follower data, non-time series data (type of CPU, special programs executed by CPU, etc.) ) As hint data. The hint data may include information describing the anchor data or capturing the characteristics of the anchor date.

2 is a view showing the configuration of a normal band generating apparatus according to an embodiment of the present invention. The normal band generator 100 is composed of a follower generator 110, a database 120, a discriminator 130, and a band generator 150. Here, when the follower generator 110 is sufficiently learned, the discriminator 130 may be removed from the normal band generator 100. Alternatively, the discriminator 130 may be configured separately from the normal band generating device 100.

The database 120 in which data calculated in chronological order is stored includes time series data and hint data. Time series data is divided into anchor data and follower data. In addition, the database may optionally include hint data, which indicates hint data applied to a pair of anchor data-follower data.

The discriminator 130 includes a neural network, receives time series data as input data, and optionally receives non-time series data called hint data. In receiving time-series data, learning is performed by dividing it into anchor data and follower data. The discriminator 130 can sufficiently perform learning using the information stored in the database 120.

The follower generator 110 also includes a neural network and receives an anchor data preceding in chronological order to calculate two or more follower data following the anchor data. Create follower data using the given anchor data.

In this process, hint data and noise data Z may be used. The generated follower data is input to the sufficiently learned discriminator 130. The follower data provided by the follower generator 110 and the hint / anchor data corresponding thereto are input to the discriminator 130, and the discriminator 110 determines the generated follower data. In this process, the follower generator 110 improves the neural network so that the generated follower data is determined by the discriminator 130 as real data (data calculated from the DB).

As a result, when the follower generator 110 is sufficiently learned, when anchor data is subsequently input to the follower generator 110, follower data corresponding thereto is calculated.

Further, the follower generator 110 may receive hint data corresponding to the received anchor data and calculate follower data.

The band generator 150 uses the follower data (follower data) calculated by the follower generator 110 to generate a normal band in a range in which the follower data can be arranged.

The anomaly detector 160 may then check whether the calculated data is located within the normal band generated by the band generator 150. Then, when the time series data that is subsequently input exceeds the normal band, the abnormality detector 160 detects the time series data that is subsequently input as abnormal data. The detected result can be output, displayed, or delivered to the user through an alarm.

The configuration of FIG. 2 is as follows. By dividing the leading part preceding the time series data into anchor data and the following part following the follower data, the discriminator 130 receives the anchor / follower and determines whether it is authentic.

On the other hand, the follower generator 110 puts the current measured / measured / sensed data as an anchor, and a range of data predicted to follow in response to this, that is, followers to be determined to be normal in response to the anchor data (calculated) Followers), which are input to the band generator 150 to generate a normal band. The band generator 150 generates a normal band composed of follower data calculated by the follower generator 110.

In addition, the abnormality detector 160 may predict whether the abnormal data is normal by checking whether data generated thereafter belongs to a normal band.

Let's look at this process in more detail.

3 is a view showing a process of discrimination by the discriminator according to an embodiment of the present invention. The discriminator 130 receives an anchor (A) as a front part of the time series data provided from the database 120, a follower (F) as a rear part, and hint data (H).

And the authenticity of the data is determined through the combination of these H, A, and F. The neural network in the discriminator 130 is improved so that it is determined to be real when real data (actually measured or sensed data) is received, and if it is received, it is determined to be fake.

When learning described in FIG. 3 is completed, the discriminator 130 may distinguish normal data and abnormal data, that is, the authenticity of data, using a combination of input anchor data, follower data, and optionally hint data.

This means that the discriminator 130 can determine whether the time series data composed of A-F is normal time series data or not through a combination of input A / F and optionally input H.

4 is a diagram illustrating a process in which a follower generator according to an embodiment of the present invention generates a follower. Hint data and anchor data previously input to the discriminator 130 are input to the follower generator 110.

And the random noise data Z is also input to the follower generator 110, and a fake follower, that is, a follower that is not measured or sensed, is calculated through the neural network constituting the follower generator 110. The calculated follower is input to the discriminator 130.

The noise data Z diversifies anchor data input to the follower generator 110, which may be stored in the database 120 or may be randomly calculated by the follower generator 110. Alternatively, the noise data Z may be generated in each processing process.

The discriminator 130 determines the authenticity of the input H / A / F and calculates the result of Real / Fake. And this result is provided to the follower generator 110 so that the follower generator 110 can learn. That is, the follower generator 110 improves the neural network so that the discriminator 130 discriminates as real data based on the authenticity determination of the discriminator 130.

As the learning of the follower generator 110 of FIG. 4 continues, the follower generator 110 improves the neural network so that the discriminator 130 determines that it is real data. As a result, the follower generator 110 may calculate follower data that enters a normal range when predetermined anchor data and hints are input. And you can make a normal range (normal tunnel, or normal band) using U and L close to the top.

This is provided to the band generator 150, and when time series data composed of a specific anchor-follower is input, a normal band corresponding to the input anchor is generated. When the anomaly detector 160 checks whether the follower data that follows is included in the normal band and includes the data, it is determined that the data is normal. On the other hand, the abnormality detector 160 determines that the data is abnormal when the follower data that follows is disposed outside the normal band.

2 to 4 are summarized as follows. In the present invention, while receiving and using time series data (anchor, follower) and non-time series data (hint) at the same time, it is possible to generate a normal band to understand the past pattern and predict the future based on the time series data. In addition, normal bands can be generated in N-dimensional based on the relationship between data using N-dimensional time-series data of the same time zone.

In the past, GAN focused only on concealing the authenticity of information using non-time series data such as pictures and text. On the other hand, in the present invention, a pattern of data to be followed can be predicted within a certain range based on time series data.

In addition, accuracy can be improved by using hint data, which is non-time series data indicating the state of data. Accuracy can be improved by inputting non-time series data that can affect the results such as product type, date, and variable into hint data.

That is, according to the embodiment of the present specification, a normal band is generated based on a lot of follower data calculated through the follower generator 120, and the normal follower data and the abnormal follower are determined through whether or not the normal band actually includes the measured follower data. It can be classified as data.

Because, when the follower generator 120 completes learning, in response to a given anchor data, the discriminator 130 can calculate a large number of follower data that can be determined as real data, and follower data composed of the follower data Creates one normal band.

5 to 8 are views showing the position of the normal band and the measured follower data according to an embodiment of the present invention.

Time series data that changes on the time axis t is displayed on the vertical axis y. The normal band 210 represents a range in which a myriad of follower data calculated by the follower generator 130 by previous time series data (anchor data) is arranged. Time-series data 220 measured at each time point are disposed in the normal band 210.

The normal band 210 creates a normal band at a time point that is trailing based on the newly measured time series data 220. That is, in FIG. 5, when the previously measured or sensed data is input to the follower generator 130 as anchor data based on each time point, a range of data to be followed (normal band composed of followers) is calculated.

In FIG. 5, when the sensed or measured time series data between t0 to t1 is input as an anchor to calculate a normal band at a time t1 to follow, a normal band 215 after t1 is generated as shown in FIG. 6. After the normal band 215 is calculated by the follower generator 130, when the measured or sensed time series data is included in the normal band 215, it is determined that these data operate normally or are in the normal range. 7 shows that the following data is located in the normal band. When 215a is enlarged, it can be confirmed that data 220a is disposed in the normal band 210a.

On the other hand, Fig. 8 shows that the following data is located outside the normal band. When 215b is enlarged, it can be seen that data 220b is disposed outside the normal band 210b. In this configuration, the abnormality detector 160 may determine that the data is outside the normal range.

Accordingly, when the time series data that is subsequently input after the output to the normal band deviates from the normal band, the subsequently input time series data is determined as abnormal data by the abnormality detector 160 and may be displayed as shown in FIG. 8. Of course, it can be displayed in different ways. In addition, a separate warning process may be provided for abnormal data. A warning message may be provided to a user who is the main administrator, such as an email, a text message, or a user's smartphone application, or a laptop, that an abnormal data has occurred.

When the flow 220b of data actually measured or sensed or calculated in a predetermined time series is out of the normal band 210b, the normal band generating apparatus 100 confirms that data out of the normal band is detected and alarms the same. It can be done.

9 is a graph showing a form in which the time series data shown in FIG. 5 is continuously accumulated and located inside or outside a normal band according to an embodiment of the present invention. In FIG. 9, the relationship between the normal band 210 and the actual data 220 is presented, and except for the region indicated by 217, the actual data 220 is disposed in the normal band 210 to thereby range the actual data 220 Shows that it is properly predicted.

When the band is out of the normal band as shown in 217, the abnormality detector 160 may be determined to be in an abnormal state, and an alert message may be provided to the outside.

In FIGS. 5 to 9, the band generator 150 outputs the set region of the follower data generated by the follower generator 110 to the normal band 210 after the anchor data, which is the actual data, ends. The abnormality detector 160 detects abnormality data by checking whether subsequently input time series data is included in the normal band 210.

Hereinafter, a detailed embodiment in which the follower generator 110 and the discriminator 130 are operated will be described.

10 and 11 are views showing a process of setting and operating anchor data and follower data in time series data according to an embodiment of the present invention. In FIG. 10, among the time series data in the DB 120, preceding data is configured as anchor data, and subsequent data is configured as follower data. In addition, the sensor name (Sensor1) and date (2018/04/20) are provided as hint data.

Examples of input data are as shown in 221. Data such as 221 is input to the discriminator 130 to be learned. The learning process is performed based on various time series data and hint information in the DB 120. In addition, 221 is an anchor follower from Time 0 to 9, and an anchor follower from Time 1 to 10 can be built based on the subsequent time series data, which is equal to 222. 221 and 222 become input data for training the discriminator 130. 10 repeats the process of learning the discriminator 130 based on the data obtained as much as possible.

In addition, as shown in FIG. 11, the follower generator 110 creates a new follower based on the given data. 11, anchor data, hint data, and noise data are input to the follower generator 110 to generate a follower (231, 232). The generated follower (Generated Follower) is input to the discriminator 130 as shown in 221, 222 of FIG.

The discriminator 130 discriminates whether the data input in the learned state is a fake (created follower) or a real (follower stored in the DB) since the learning has already been progressed through the process of FIG. 10. In this process, based on the results determined by the discriminator 130, the follower generator 110 learns to improve the neural network to generate a follower that the discriminator 130 can really discriminate.

10 and 11 show a learning process. In the discriminator 130, hint data is input to H, and anchor data (real data) and follower data are input. Here, the follower data may be actual data that is an anchor data and a set, or may be a follower generated by the follower generator 110. The set of H-A-Fs are combined into one set, such as 221 or 222, to form a data set, which can be input to the discriminator 130.

The discriminator 130 determines this according to whether the data conforms to the distribution of the actual data. Hint data and anchor data are input only from the actual data, so the discriminator 130 determines whether the follower data is real data or generated data. Discriminate.

The learning of the discriminator 130 is judged to be true for actual data (when the follower data is stored in the database together with anchor data), and false for the generated data (when the follower data is generated by the follower generator). Learning by adjusting the weight value of the network constituting (130).

11 shows learning of the follower generator 110. The follower generator 110 receives hint data, anchor of real time series data, and random “noise” as input. These three types of data can be combined to form one data set.

The follower generator 110 generates a follower of the "fake" halves through the network composing the internal learning module based on the received set. The size of the generated data can be set equal to the size of the follower.

In the process of generating the input values, the values change according to the weights through the network, so that the data such as the size of the “follower” is finally created. In the initial follower generator 110, since the values of the weights of the network are not adjusted well, “ The "follower" data created may not be really discernible.

Adjustment of the weight value is gradually progressed in a direction that simulates to follow the distribution of the real follower data in order to make the discriminator 130 really discriminate. Learning progresses in this process, and the follower generator 110 can closely simulate the distribution of real follower data.

As a result, the follower generator 110 may generate authentic follower data corresponding to hint data and anchor data, that is, it can be determined as normal. At this time, the random “noise” acts as a function that can make the follower data "belonging to the real range, but a little different", so that a data band can be generated.

The follower generator 110 and the discriminator 130 may have a convolutional neural network (CNN) structure, and in each learning process, the discriminator 130 described above adjusts the weight of the learning network and discriminates the follower generator ( 110) performs deep learning by repeating weight adjustment so that the discriminator 130 generates a follower that is not distinguishable.

12 is a diagram illustrating a process of generating a normal band corresponding to input anchor data based on a learned follower generator by a normal band generator according to an embodiment of the present invention.

10 and 11 learned the discriminator 130 and the follower generator 110 using the accumulated data based on the time point when the time is 0. After sufficiently learned, a follower may be generated using the follower generator 110.

For example, when the measured or sensed or calculated data is the same as the anchor data at the time when the time is 101 to 105, it is input to the follower generator 110. In addition, when various noise data are input, a number of generated followers are calculated as 241, and the normal data pattern is calculated as 242.

That is, when the time points from 101 to 105 are input, a pattern of normal data that can occur at the time from time 106 is calculated, which is input to the band generator 150 to generate a normal band. In addition, it is possible to check whether the data calculated in Time 106 is normal data or abnormal data according to whether or not it is included in the normal band.

Time series data in the present specification is an embodiment of a variety of data calculated in the industrial field. A variety of data produced by tools or machines in the manufacturing field may be time series data. For example, sensor data including a drill is calculated every time to check the wear degree of the drill or the normal state of the drill, and this is time series data having a one-dimensional value corresponding to the time axis.

This time series data becomes data for learning the discriminator 130 and the follower generator 110 as shown in FIG. 2, and after constant learning is performed, the drill sensed information (sensor data) input to the follower generator 110 Correspondingly, a range (normal band) of data to be calculated later is output from the band generator 150. Also, the band generator 150 may generate a warning message for a value outside the normal band when it is sensed. In the case of a drill, examples of time series data may be a speed of a drill, an angle, and a current value.

In manufacturing facilities, sensor values (current, velocity, pressure, temperature, etc.) measured over time become time-series data, and some of these time-series data become anchor data, and subsequent data is required to learn the discriminator 130. It becomes follower data.

In addition, in the server performance monitoring, performance values periodically collected (CPU / memory usage, data input / output, etc.) can also be time series data.

The various sensed values (measured values) generate a normal band of normal data as described above, and when a value outside the normal band is sensed, it is possible to detect and predict an abnormality.

For example, a normal band for “CPU” usage can be generated, and if the “actual” CPU ”usage value is out of band, it can be determined as abnormal (for example, excessive use of CPU) to warn the user. In addition, information that fluctuates on the system, for example, stock price or exchange rate in the case of stock price, temperature and humidity in case of weather, may be input as time series data.

The normal band consisting of values that subsequent data can have for the input time series data based on GAN applied to the discriminator 130 and the follower generator 110 is a follower generator 110 and a band generator 150 ), It can be used to check the trend of data and can be used to predict future data. In addition, when a value out of the band, for example, abnormal data is sensed by the abnormality detector 160, an appropriate warning may be performed. That is, after the normal band is generated, when the subsequently input time series data deviates from the normal band, the abnormality detector 160 may check it as abnormal data.

In addition, hint data, which is non-time series data, is also input to the follower generator 110 and the discriminator 130 so that non-time series data can be applied to normal band generation.

The hint data is "information" associated with the time series data, and even the time series data of the same pattern (even the same value) can be distinguished more precisely by means of different kinds of hint data. Season, day of the week, and type of equipment can be hint data. In the case of stock price data, hint data may be a business type of the corresponding company, and “hint data” of sales volume-inventory time series data according to time may be a product type, “day of the week”, and public holiday.

The hint data may serve as a label corresponding to the time series data abstractly, and is input by being combined with the time series data. To this end, the discriminator 130 and the follower generator 110 may apply “Conditional GAN”. This is an embodiment of the GAN that makes the desired value to be generated by inputting an additional value (condition) with the noise. This may be a reference or a reference value when creating a follower.

As shown in FIG. 8, when one time series data is given, a normal normal band of time series data may be generated in a two-dimensional plane. When a plurality of time series data is used, a normal normal band of the time series data may be generated in three or more dimensions.

The follower generator 110 according to an embodiment of the present invention does not actually exist, but may generate data imitating it. In addition, it is possible to infinitely generate fake data similar to real data, and thus a normal band can be generated. Data can be generated by inputting random noise. The normal band is an example of a range of data belonging to the normal category.

13 is a diagram illustrating a process of performing learning between a discriminator and a follower generator according to an embodiment of the present invention. For learning, a certain amount of learning data is prepared (S310). The learning data of S310 may be time series data, anchor data (A), follower data (F), and hint data (H). Here, H, A, and F are all actual data, and these data are stored in the database 120. And both the discriminator 130 and the follower generator 110 initially construct a neural network for learning (S312, S314).

The discriminator 130 receives learning data (H, A, F) (S316). Then, it is determined whether the input data is real data or fake data (provided by the generator) (S322), and the neural network is updated and learned to be accurate (S326). According to another embodiment, in the initial learning process, the discriminator 130 may learn by receiving instruction data (H, A, F) without step S322 and instructing that this is real data.

On the other hand, some of the data (H, A) input to the discriminator 130 in S316 is provided to the follower generator 110 (S317), and the follower generator 110 receives random noise Z, and the received H, Input A to generate data (Generated Follower) (S318). The follower generator 110 aims to make this generated data (Generated Follower) really discriminate in S322 by simulating "F" of S310.

The follower generator 110 inputs (H, A, Generated Follwer) to the discriminator 130 (S320). H and A are received, from which the "Generated Follower" generated by the follower generator 110 is input to the discriminator 130. Thereafter, the discriminator 130 determines whether the input data is real data or fake data (provided by a discriminator) (S322), and updates and learns the neural network so that the discrimination result is correct (S326). The result determined in this process is transmitted to the follower generator 110 again, and the follower generator 110 updates and learns the neural network so that the determiner 110 determines that the determiner is real.

In the process of repeating S310 to S324, when the discriminator 130 is learned, and the follower generator 110 is also learned, the follower generator 110 is learned to generate a normal normal band, and the follower generator 110 ) May operate independently of the discriminator 130.

The learning of the discriminator 130 includes actual data stored in the database 120 (first anchor data and first follower data following the first anchor data) and actual and virtual data stored in the database (first stored in the database). The second anchor data and the second anchor data generated by the follower generator corresponding to the second anchor data) may be input, and the discriminator 130 may receive the first follower data and the second follower data from the first anchor Learn to discriminate in response to data and the second anchor data.

That is, the discriminator 130 may continue learning to discriminate the first follower data as actual data and the second follower data as data generated by the follower generator 110. Of course, the initial network may be configured by inputting only actual data for initial learning of the discriminator 130.

And when the discriminator 130 determines the second follower data as the data generated by the follower generator, the result of the determination is transmitted to the follower generator 110 and the follower generator 110 learns in response to the determination result (S322) ~ S324). As a result of learning, the follower generator 110 may generate follower data that the discriminator does not distinguish from the actual data.

14 is a view showing a process in which a follower generator according to an embodiment of the present invention generates a plurality of followers to generate a normal normal band and a process in which the band generator determines normal / abnormal data based on this. The follower generator 110 puts the currently generated data as an anchor (S330). Hint data is optionally given here. Then, the follower generator 110 receives random noise Z and the given hint data to generate follower data, U, and L (S334). The band generator 150 configures a normal band with U and L generated by the follower generator 110 (S342).

In addition, whether the data actually generated after the anchor data is included in the normal band, that is, the abnormality detector 160 checks whether actual data (ie, time series data that is subsequently input) passes the normal band (S346). As a result, when it is out of the band (S350), the abnormality detector 160 confirms the abnormality detection and notifies it to the outside (S354). When data generated in the band is located, S342 to S354 may be performed using the next generated data. Anomaly detection indicates that abnormal data has occurred.

In FIG. 14, the whole may be configured as one loop to continuously detect abnormal data.

As another embodiment, the detection of abnormal data may be continuously performed by configuring S346 to S354 as one loop and the whole as one loop. This means that a follower for generating a normal band based on current data is repeatedly generated in the first order.

Then, after generation of the normal band, it is confirmed whether subsequently input time series data is placed in the normal band.

Here, if a normal band is generated each time based on the current data, S342 and S346 and S354 are performed after S334, but S346 to S354 are performed once and the process immediately proceeds to step S330.

If a normal band is generated based on the current data and it is confirmed that the normal band is included twice or more with respect to the actually generated data, the loops of S346 to S354 may be repeated two or more times. Phosphorus normal bands can be created every moment. In this case, data actually generated after step S354 may be input again as anchor data, or may proceed to step S330.

In addition, normal data can be determined by receiving K time-series data after generating it once. In this case, steps S346 to S354 may be repeated K times.

13 and 14 are summarized as follows.

Data calculated in chronological order is stored in the database 120 of the normal band generating apparatus 100. This is provided as learning data of S310. When the neural network of the follower generator 110 and the discriminator 130 is updated through learning (FIG. 13), the follower generator 110 receives U anchor data in chronological order and subsequently follows U in response to the anchor data. , L data is calculated (S334). Then, the band generator 150 generates normal bands using U and L in the follower generator (S342). The abnormality detector 160 may detect the abnormality by determining whether actual data generated after the result are located in the band.

15 is a view showing a configuration of a follower generator and a discriminator that calculates a follower and a follower boundary is set according to an embodiment of the present invention.

As a further embodiment of the present invention, the follower generator 510 may be implemented to output the followers U and L corresponding to a special result of the upper and lower boundaries of the follower together with one or more other followers f. In one embodiment, the follower generator 510 outputs a valid maximum value U, a minimum valid value L, and one or more followers f in response to the inputted H, A, z, and the like. And these (U, f, L) are respectively input to the discriminator 530.

This means that U is the upper limit of the band and L is the lower limit of the band.

The relationship between the three values may have the relationship of Equation 1.

[Equation 1]

L <f, f <U

The cost function 515 may include constraint information so that the followers U, f, and L are output. Also, the constraint that the difference (interval) between U and L is the maximum may also be included in the cost function 515.

That is, in response to the inputted H, A, and z, the follower generator 510 reflects the constraints such as Equation 1 set in the coast function 515 and the constraints that increase the interval between U and L, which is the follower U, f and L are output.

Of course, U, f, and L are all values that satisfy the discriminator 530.

When the constraints included in the cost function 515 are further subdivided, Equation 2 is given.

[Equation 2]

Max (0, f-U) + max (0, L-f)

1 / (U-L) ^ 2

This allows a large number of followers to be output, and not the maximum and minimum values for the output followers, but allows the follower generator 510 to output the maximum and minimum values separately in U and L. And the gap between U and L is maximized.

As shown in FIG. 15, hint data H and anchor data A are input as in the above-described embodiment. And noise data z is input. The generated followers U, f, and L are individually input to the discriminator 530. And the follower generator 510 through the discriminator 530 is also updated through the learning process.

In FIG. 15, a number of followers may be calculated with f.

FIG. 16 is a view showing the relationship between the followers and U and L to which the embodiment of FIG. 15 is applied. One or more f values are output between the maximum value U and the minimum value L. And these are all input to the discriminator 530, respectively.

16, the follower generator 530 outputs the distance between U and L to be the maximum.

15 and 16 are summarized as follows. The follower generator 510 receives leading anchor data in chronological order, receives noise data for diversifying the anchor data, and calculates two boundary setting values U, L, and follower data that become the boundary.

Further, U is also follower data, and the follower data has a value smaller than U. L is also follower data, and the follower data has a value greater than L.

In addition, the follower generator 510 includes a cost function 515 that controls only follower data smaller than U and greater than L to be output from the follower generator.

Additionally, the cost function 515 may output U and L so that the difference between U and L is the largest.

The configuration in the case where the follower generator outputting the boundary setting value is applied to the aforementioned FIGS. 2, 3, and 4 will be described.

17 is a view showing a configuration of a normal band generating apparatus for outputting values between U, L and U, L, which are boundary setting values, according to an embodiment of the present invention. The difference is that the follower generator 510 outputs special followers U and L. The discriminator 530 basically operates with the same mechanism as the discriminator 130 of FIG. 2.

The follower generator 510 includes a neural network and receives the anchor data that precedes the time and optionally noise data z, and calculates follower data that follows the anchor data in response. At this time, the follower data is output with the maximum set value U and the minimum set value L, and the follower data f between U and L.

Hint data and noise data z may be used, and the generated follower data U, f, and L are input to the sufficiently learned discriminator 530. The follower data (U, f, L) provided by the follower generator 510 and hint / anchor data corresponding thereto are input to the discriminator 530, and the discriminator 510 discriminates the generated follower data. In this process, the follower generator 510 improves the neural network so that the generated follower data is determined by the discriminator 530 as real data (data calculated from the DB).

As a result, when the follower generator 510 is sufficiently learned, when anchor data is subsequently input to the follower generator 510, corresponding follower data is calculated.

In addition, the follower generator 510 may receive hint data corresponding to the received anchor data and calculate follower data. In addition, the follower generator 510 may receive the above-described noise data and calculate follower data.

18 is a view showing a process of discrimination by the discriminator according to an embodiment of the present invention. The discriminator 530 receives the anchor A, which is the front part of the time series data provided from the database 120, the follower F, and the hint data H that is the rear part.

And the authenticity of the data is determined through the combination of these H, A, and F. The neural network in the discriminator 530 is improved to determine that real data (actually measured or sensed data) is received, and fake data is received.

When learning described in FIG. 10 is completed, the discriminator 530 may distinguish normal data from abnormal data, that is, the authenticity of data, using a combination of input anchor data, follower data, and optionally hint data.

This means that the discriminator 530 can determine whether the time series data composed of AF is normal time series data or not through the combination of input A / F and optionally input H, as described above. .

19 is a diagram illustrating a process in which a follower generator according to an embodiment of the present invention generates a follower. FIG. 19 differs from FIG. 4 in that it outputs three types of follower data (U, f, L).

Hint data and anchor data previously input to the discriminator 530 are input to the follower generator 510.

In addition, random noise data z is also input to the follower generator 510. Through the neural network constituting the follower generator 510, a fake follower, that is, a follower that is not measured or sensed, is calculated. These followers (U, f, L) are output to satisfy Equation (1). The calculated followers U, f, and L are input to the discriminator 130.

The cost function 515 diversifies the follower data so that the follower data U, f, and L output by the follower generator 510 satisfy Equation 1 and also increase the interval between U and L. However, the interval between U and L may be input as a constraint to the cost function 515 so as not to exceed a preset criterion. The follower generator 510 may train a neural network to satisfy mathematical relationships of U, f, and L, such as Equation 1 or Equation 2, and provide the learned results.

The operation and discrimination process and learning of the other discriminator 530 are as described in FIG. 4.

20 and 21 are diagrams to which follower data according to an embodiment of the present invention is applied.

The follower generator 510 creates a new follower based on the given data. In FIG. 21, anchor data, hint data, and noise data are input to the follower generator 510 to generate a follower (601, 602). The generated follower (Generated Follower) is previously input to the discriminator 130 as shown in 221, 222 of FIG. Alternatively, reference may be made to FIG. 21.

As shown in 601, the generated follower has a boundary setting value and values therebetween, such as U and L. At 601, five followers are generated corresponding to the anchor data 10, of which U is 20.1, L is 16.2, and three followers between U and L have values of 19.9, 18.5, and 16.5, respectively. This also confirms that the followers have a value between U / L in the anchor data 12 even at 602.

21 is a diagram illustrating a process of generating a normal band corresponding to input anchor data based on a learned follower generator by the normal band generating apparatus according to an embodiment of the present invention.

10 and 20 learned the discriminators 130 and 530 and the follower generator 510 by using the accumulated data based on the time when the time is 0. After sufficiently learned, a follower may be generated using the follower generator 510.

For example, when the measured or sensed or calculated data is the same as the anchor data at the time when Time is 101 to 105, it is input to the follower generator 510. And a number of noise data (Noise Data) is input.

The follower generator 510 outputs followers between U / L and U and L, which are the boundary setting values of the follower, in response to the inputted value.

The noise data input first in FIG. 21 is 0.6, 1.3, 0.8, and is sequentially input. In addition, followers calculated in response to anchor data, hint data, and noise data are presented at 642, and among them, followers having L and U as a lower limit and an upper limit as 641 are output.

Generated followers are composed of 5 pairs of follower data, such as 641. Among them, a large number of U.L are calculated, and the normal data pattern is calculated as 642.

That is, when the time points from 101 to 105 are input, a pattern of normal data that can occur at the time from time 106 is calculated, which is input to the band generator 150 to generate a normal band. In addition, it is possible to check whether the data calculated in Time 106 is normal data or abnormal data according to whether or not it is included in the normal band.

Although all components constituting the embodiments of the present invention are described as being combined or operated as one, the present invention is not necessarily limited to these embodiments, and all elements within the scope of the present invention are one or more. It can also be operated by selectively combining. In addition, although all of the components may be implemented by one independent hardware, a part or all of the components are selectively combined to perform a part or all of functions combined in one or a plurality of hardware. It may be implemented as a computer program having a. The codes and code segments constituting the computer program can be easily deduced by those skilled in the art of the present invention. Such a computer program is stored in a computer readable storage medium (Computer Readable Media) to be read and executed by a computer, thereby implementing an embodiment of the present invention. The storage medium of the computer program includes a magnetic recording medium, an optical recording medium, and a storage medium including a semiconductor recording element. In addition, the computer program implementing the embodiment of the present invention includes a program module that is transmitted in real time through an external device.

It should be understood that the above-described embodiments are illustrative in all respects and not restrictive, and the scope of the present invention will be indicated by the claims below, rather than the detailed description above. And it should be interpreted that the meaning and scope of the claims, as well as all transformable and deformable forms derived from the equivalent concept, are included in the scope of the present invention.

100: normal band generating device
110, 510, 610: follower generator
120: database
130, 530: discriminator
150: band generator
160: anomaly detector
515: cost function

Claims (14)

A database storing data calculated in chronological order;
A follower generator that receives anchor data preceding in time order, receives noise data for diversifying the anchor data, and calculates two boundary set values U, L, and follower data as a boundary; And
And a band generator for generating a normal band composed of follower data calculated by the follower generator, wherein a follower boundary is set.
According to claim 1,
The U is follower data, and the follower data is smaller than the U, characterized in that the follower boundary is set normal band generating device.
According to claim 1,
The L is follower data, and the follower data is greater than the L, characterized in that the normal band generation device with a follower boundary is set.
According to claim 1,
The follower generator further includes a cost function that controls only the follower data smaller than the U and greater than the L to be output from the follower generator, and the normal band generating apparatus having a follower boundary set.
The method of claim 4,
The cost function outputs the U and the L so that the difference between the U and the L is the largest, a normal band generating apparatus with a follower boundary set.
According to claim 1,
The first anchor data stored in the database and the first follower data following the first anchor data are received,
The second anchor data stored in the database and the second follower data generated by the follower generator corresponding to the second anchor data are received,
And a discriminator trained to discriminate the first follower data and the second follower data corresponding to the first anchor data and the second anchor data, wherein a follower boundary is set.
The method of claim 6,
When the discriminator determines the second follower data as data generated by the follower generator,
The follower generator learns in response to the determination result, a normal band generating device with a follower boundary set.
According to claim 1,
The band generator outputs a set region of the follower data generated by the follower generator as a normal band after the anchor data ends, a normal band generating apparatus having a follower boundary set.
The method of claim 8,
When the time-series data that is subsequently input is outside the normal band, the time-series data that is subsequently input further includes an abnormality detector that detects abnormal data as a normal band generating device with a follower boundary set.
Storing data calculated in chronological order in a database of the normal band generating device;
The follower generator of the normal band generating device receives the anchor data that precedes the chronological order, receives the noise data that diversifies the anchor data, and calculates two boundary set values U, L, and follower data that become the boundary. step; And
And a step in which the band generator of the normal band generating device generates a normal band composed of follower data calculated by the follower generator, and generates a normal band with a follower boundary set.
The method of claim 10,
The U is follower data, characterized in that the follower data is less than the U, method of generating a normal band with a follower boundary.
The method of claim 10,
Wherein L is the follower data, characterized in that the follower data is greater than the L, the method of generating a normal band is set the boundary of the follower.
The method of claim 10,
The follower generator further includes a cost function,
And controlling that only the follower data whose cost function is smaller than U and larger than L is output from the follower generator.
The method of claim 13,
The controlling step
The cost function further comprises the step of outputting the U and the L so that the difference between the U and the L is the largest, a method of generating a normal band with a follower boundary.

Images