KR20230159953A - Apparatus and method of anomaly detection using neural network - Google Patents

Abstract

An anomaly detection device and method using a neural network are disclosed.
An anomaly detection device according to an embodiment includes a receiver that receives data, and extracts a plurality of features corresponding to the data based on a distance between the data and a preset group for normal data, It may include a processor that calculates a plurality of Out Of Distribution (OOD) scores corresponding to the plurality of groups based on a plurality of characteristics, and detects whether the data is normal based on the plurality of OOD scores.

Description

Anomaly detection device and method using neural network {APPARATUS AND METHOD OF ANOMALY DETECTION USING NEURAL NETWORK}

The following embodiments relate to an anomaly detection device and method using a neural network.

Anomaly detection (or, anomaly detection) refers to a technology that detects outliers or rare events that are different from normal values. Anomaly detection means finding data that does not follow generally expected characteristics in a specific domain or data that has characteristics different from data defined as normal.

Since the conventional anomaly detection method uses a neural network trained only on normal samples, it is assumed that the error for normal samples is small and the error for abnormal samples is large. Therefore, the conventional abnormality detection method has the problem of not maximizing the error for abnormal samples.

Embodiments may provide anomaly detection technology using a neural network.

However, technical challenges are not limited to the above-mentioned technical challenges, and other technical challenges may exist.

An anomaly detection device using a neural network according to an embodiment includes a receiver for receiving data; and extracting a plurality of features corresponding to the data based on a distance between the data and a group preset for normal data, and extracting a plurality of Out Of Distribution (OOD) corresponding to the plurality of groups based on the plurality of features. ) It may include a processor that calculates a score and detects whether the data is normal based on the plurality of OOD scores.

The processor performs an attention operation based on the plurality of OOD scores, generates an auto-encoding output by inputting the data to an auto encoder, and generates the result of the attention operation and the auto-encoding output. Based on this, it is possible to detect whether the data is normal.

The processor may classify the plurality of features into normal classes and others classes, and calculate the OOD score based on the ratio of the other classes.

The processor generates a multiplication result by multiplying the result of the attention operation and the auto-encoding output, calculates a mean squared error loss based on the difference between the data and the multiplication result, and calculates the mean squared error loss. It is possible to detect whether the data is normal based on square error loss.

An anomaly detection method using a neural network according to an embodiment includes receiving data; extracting a plurality of features corresponding to the data based on a distance between the data and a preset group for normal data; calculating a plurality of OOD (Out Of Distribution) scores corresponding to the plurality of groups based on the plurality of characteristics; and detecting whether the data is normal based on the plurality of OOD scores.

Embodiments may minimize errors corresponding to normal samples and maximize errors corresponding to abnormal samples by assigning weights to all samples input to the neural network using Out Of Distribution (OOD) scores.

Embodiments may improve the performance of abnormality detection by maximizing the error for abnormal samples.

1 shows a schematic block diagram of an abnormality detection device according to an embodiment.
Figure 2 shows an example of implementation of the anomaly detection device shown in Figure 1.
Figure 3 shows the process of extracting features from data.
Figure 4 shows the process of calculating OOD scores.
Figure 5 is a diagram for explaining the learning and detection process.
FIG. 6 shows a flowchart of the operation of the abnormality detection device shown in FIG. 1.

Specific structural or functional descriptions of the embodiments according to the concept of the present invention disclosed in this specification are merely illustrative for the purpose of explaining the embodiments according to the concept of the present invention. They may be implemented in various forms and are not limited to the embodiments described herein.

Since the embodiments according to the concept of the present invention can make various changes and have various forms, the embodiments will be illustrated in the drawings and described in detail in this specification. However, this is not intended to limit the embodiments according to the concept of the present invention to specific disclosed forms, and includes changes, equivalents, or substitutes included in the spirit and technical scope of the present invention.

Terms such as first or second may be used to describe various components, but the components should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another component, for example, a first component may be named a second component, without departing from the scope of rights according to the concept of the present invention, Similarly, the second component may also be referred to as the first component.

When a component is said to be "connected" or "connected" to another component, it is understood that it may be directly connected to or connected to the other component, but that other components may exist in between. It should be. On the other hand, when it is mentioned that a component is “directly connected” or “directly connected” to another component, it should be understood that there are no other components in between. Expressions that describe the relationship between components, such as “between”, “immediately between” or “directly adjacent to”, should be interpreted similarly.

The terminology used herein is only used to describe specific embodiments and is not intended to limit the invention. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, terms such as "include" or "have" are intended to designate the presence of a described feature, number, step, operation, component, part, or combination thereof, and one or more other features or numbers, It should be understood that this does not exclude in advance the possibility of the presence or addition of steps, operations, components, parts, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the technical field to which the present invention pertains. Terms as defined in commonly used dictionaries should be interpreted as having meanings consistent with the meanings they have in the context of the related technology, and unless clearly defined in this specification, should not be interpreted in an idealized or overly formal sense. No.

A module in this specification may mean hardware that can perform functions and operations according to each name described in this specification, or it may mean computer program code that can perform specific functions and operations. , or it may mean an electronic recording medium loaded with computer program code that can perform specific functions and operations, for example, a processor or microprocessor.

In other words, a module may mean a functional and/or structural combination of hardware for carrying out the technical idea of the present invention and/or software for driving the hardware.

Hereinafter, embodiments will be described in detail with reference to the attached drawings. However, the scope of the patent application is not limited or limited by these examples. The same reference numerals in each drawing indicate the same members.

1 shows a schematic block diagram of an abnormality detection device according to an embodiment.

Referring to FIG. 1, the anomaly detection device 10 can detect anomalies in data. The abnormality detection device 10 can detect whether data is normal and/or abnormal.

Data may consist of information in a form that can be processed by a computer. Data can be in the form of letters, numbers, sounds, pictures, etc. that a computer can process. For example, data may include images. An image includes an image of an object created by refraction or reflection of light, and may mean representing the shape of the object using lines or colors. As an example, hyperspectral images (HSIs) may be used as the data, but those skilled in the art will understand that the data used is not limited thereto.

The anomaly detection device 10 can detect anomalies in data using a neural network. The anomaly detection device 10 can detect anomalies in data by training a neural network based on learning data and processing the data based on the learned neural network.

Neural networks (or artificial neural networks) can include statistical learning algorithms that mimic neurons in biology in machine learning and cognitive science. A neural network can refer to an overall model in which artificial neurons (nodes), which form a network through the combination of synapses, change the strength of the synapse connection through learning and have problem-solving capabilities.

Neurons in a neural network can contain combinations of weights or biases. A neural network may include one or more layers consisting of one or more neurons or nodes. Neural networks can infer the results they want to predict from arbitrary inputs by changing the weights of neurons through learning.

Neural networks may include deep neural networks. Neural networks include CNN (Convolutional Neural Network), RNN (Recurrent Neural Network), perceptron, multilayer perceptron, FF (Feed Forward), RBF (Radial Basis Network), DFF (Deep Feed Forward), and LSTM. (Long Short Term Memory), GRU (Gated Recurrent Unit), AE (Auto Encoder), VAE (Variational Auto Encoder), DAE (Denoising Auto Encoder), SAE (Sparse Auto Encoder), MC (Markov Chain), HN (Hopfield) Network), BM (Boltzmann Machine), RBM (Restricted Boltzmann Machine), DBN (Depp Belief Network), DCN (Deep Convolutional Network), DN (Deconvolutional Network), DCIGN (Deep Convolutional Inverse Graphics Network), GAN (Generative Adversarial Network) ), Liquid State Machine (LSM), Extreme Learning Machine (ELM), Echo State Network (ESN), Deep Residual Network (DRN), Differential Neural Computer (DNC), Neural Turning Machine (NTM), Capsule Network (CN), It may include Kohonen Network (KN) and Attention Network (AN).

The abnormality detection device 10 may be implemented with a printed circuit board (PCB) such as a motherboard, an integrated circuit (IC), or a system on chip (SoC). For example, the abnormality detection device 10 may be implemented as an application processor.

Additionally, the abnormality detection device 10 may be implemented in a personal computer (PC), a data server, or a portable device.

Portable devices include laptop computers, mobile phones, smart phones, tablet PCs, mobile internet devices (MIDs), personal digital assistants (PDAs), and enterprise digital assistants (EDAs). , digital still camera, digital video camera, portable multimedia player (PMP), personal navigation device or portable navigation device (PND), handheld game console, e-book ( It can be implemented as an e-book) or a smart device. A smart device may be implemented as a smart watch, smart band, or smart ring.

The abnormality detection device 10 includes a receiver 100 and a processor 200. The abnormality detection device 10 may further include a memory 300.

Receiver 100 can receive data. The receiver 100 may receive data from the outside or the memory 300. Receiver 100 may include a receiving interface. The receiver 100 may output the received image to the processor 200.

The processor 200 may process data stored in the memory 300. The processor 200 may execute computer-readable code (eg, software) stored in the memory 300 and instructions triggered by the processor 200 .

The “processor 200” may be a data processing device implemented in hardware that has a circuit with a physical structure for executing desired operations. For example, the intended operations may include code or instructions included in the program.

For example, data processing devices implemented in hardware include microprocessors, central processing units, processor cores, multi-core processors, and multiprocessors. , ASIC (Application-Specific Integrated Circuit), and FPGA (Field Programmable Gate Array).

The processor 200 may obtain a group label corresponding to the data by classifying the data into one of a plurality of groups based on the distribution of the data. The process of obtaining a group label will be described in detail with reference to FIG. 3.

The processor 200 can extract a plurality of features by converting data assigned to each group into low-dimensional data.

The processor 200 may calculate a plurality of Out Of Distribution (OOD) scores based on a plurality of characteristics.

The processor 200 may classify features assigned to each of the plurality of groups into normal classes and others classes. The processor 200 may calculate the OOD score based on the ratio of other classes in the class classification results.

The processor 200 may detect whether data is normal based on a plurality of OOD scores. The processor 200 may perform an attention operation based on a plurality of OOD scores.

The processor 200 may generate an OOD vector by concatenating a plurality of OOD scores. The processor 200 may perform an attention operation on the OOD vector.

The processor 200 may generate an auto-encoding output by inputting data into an auto encoder. Processor 200 is Encoded data can be created by performing encoding on the data. The processor 200 may extract latent features from encoded data. The processor 200 may generate an auto-encoding output by performing decoding on latent features.

The processor 200 can detect whether the data is normal based on the result of the attention operation and the auto-encoding output. The processor 200 may generate a multiplication result by multiplying the result of the attention operation and the auto-encoding output. The processor 200 may calculate a mean squared error loss based on the difference between the input data and the multiplication result. The processor 200 may detect whether the data is normal based on the mean square error loss.

The memory 300 may store instructions (or programs) executable by the processor 200. For example, the instructions may include instructions for executing the operation of the processor and/or the operation of each component of the processor.

The memory 300 may be implemented as a volatile memory device or a non-volatile memory device.

Volatile memory devices may be implemented as dynamic random access memory (DRAM), static random access memory (SRAM), thyristor RAM (T-RAM), zero capacitor RAM (Z-RAM), or twin transistor RAM (TTRAM).

Non-volatile memory devices include EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory, MRAM (Magnetic RAM), Spin-Transfer Torque (STT)-MRAM (MRAM), and Conductive Bridging RAM (CBRAM). , FeRAM (Ferroelectric RAM), PRAM (Phase change RAM), Resistive RAM (RRAM), Nanotube RRAM (Nanotube RRAM), Polymer RAM (PoRAM), Nano Floating Gate Memory (NFGM), holographic memory, molecular electronic memory device, or insulation resistance change memory.

Figure 2 shows an example of implementation of the anomaly detection device shown in Figure 1.

Referring to Figure 2, the processor (e.g., processor 200 in Figure 1) includes a class OOD module 220, an auto encoder 230, an attention operator 240, a multiplier 250, and an MSE operator 260. can do.

The class OOD module 220 includes a K-means clustering operator 221, a plurality of PCA (Principal Component Analysis) operators (222-1, 222-2, 222-3), and a plurality of encoders (223-1, 223-2, 223-3), an OOD detector 226, and a concatenator 227.

The example in FIG. 2 illustrates the case where there are three groups through clustering, but the number of groups may be smaller or larger than three depending on the distribution of the input data 210. Likewise, the number of PCA operators and the number of encoders can be decreased or increased to correspond to the number of groups.

The processor 200 may calculate OOD scores of all samples of the input data 210 input through the class OOD module 220. The processor 200 can minimize the error of normal samples and maximize the error of abnormal samples by assigning the calculated OOD score as a weight to the data (e.g., x') restored through the auto encoder 230.

The K-means clustering operator 221 may perform clustering on the input data 210. K-means clustering operator 221 can perform clustering to minimize the variance of the distance difference between each of the plurality of clusters and the data. The K-means clustering operator 221 can repeatedly randomly designate the centroid of each cluster, calculate the distance difference between the centroid and the data, and then assign the data to a specific cluster. The K-means clustering operator 221 can repeatedly perform the clustering operation until the clusters of all data remain unchanged.

The K-means clustering operator 221 can generate a plurality of groups corresponding to normal data through pre-clustering learning based on normal data. The K-means clustering operator 221 may obtain a group label corresponding to the group corresponding to the input data among the plurality of groups determined based on the distribution of normal data. For example, the K-means clustering operator 221 predicts the group (e.g., the second group) closest to the input data x _i among the three groups generated based on normal data, thereby predicting the group corresponding to the input data. A group label (e.g., y _i = 2) can be obtained.

The plurality of PCA operators 222-1, 222-2, and 222-3 can extract a plurality of features by converting the input data into low-dimensional data. The output of the K-means clustering operator 221 may consist of high-dimensional data (for example, in the case of HSIs, about 200 feature data corresponding to about 200 wavelength bands). A plurality of PCA operators 222-1, 222-2, and 222-3 may convert input data into low-dimensional data (for example, convert about 200 feature data into about 100 feature data). A plurality of PCA operators 222-1, 222-2, and 222-3 can obtain components that maximize the variance of the data and decompose them into components that can well reveal sample differences. For example, the plurality of PCA operators 222-1, 222-2, and 222-3 acquire the component that maximizes the variance of the 224-dimensional data corresponding to the HSIs wavelength band included in each group and reduce it to 112 dimensions. You can do it.

A plurality of encoders 223-1, 223-2, and 223-3 may calculate a plurality of Out Of Distribution (OOD) scores corresponding to a plurality of groups based on a plurality of assigned features.

A plurality of encoders (223-1, 223-2, 223-3) classify each feature assigned to a plurality of groups into normal classes (225-1, 225-2, 225-3) and others. It can be learned in advance to classify into classes (224-1, 224-2, 224-3).

OOD data may refer to data having classes that are not included in the training data. A plurality of encoders (223-1, 223-2, 223-3) divide features assigned to corresponding groups into regular classes (225-1, 225-2, 225-3) and other classes (224-1, 224- 2, 224-3), and through the classification results, data not used for neural network learning can be determined as OOD data. Data having a different distribution from the training data used to learn the neural network through the operation of a plurality of encoders 223-1, 223-2, and 223-3 may be defined as OOD data, and the training data is within the distribution (in -distribution) can be defined as data.

OOD detector 226 may calculate the OOD score based on the proportion of other classes.

The connector 227 can generate an OOD vector by concatenating a plurality of OOD scores. The attention operator 240 can perform attention calculation on the OOD vector.

The processor 200 may detect whether data is normal based on a plurality of OOD scores. The attention calculator 240 may perform attention calculation based on a plurality of OOD scores.

The auto encoder 230 may generate an auto encoding output by performing encoding and decoding on the input data 210 (or data). The encoder 231 may generate encoded data by performing encoding on the data. The encoder 231 may extract latent features from encoded data. The decoder 233 may generate an auto-encoding output by performing decoding on the latent features.

The MSE operator 260 can detect whether the data is normal based on the result of the attention operation and the auto-encoding output. The multiplier 250 may generate a multiplication result by multiplying the result of the attention operation and the auto-encoding output.

The MSE operator 260 may calculate the mean squared error loss based on the difference between the data (x) and the multiplication result (x''). The MSE operator 260 can detect whether the data is normal based on the mean square error loss.

Figure 3 shows the process of extracting features from data.

Referring to FIG. 3, the k-means clustering operator 310 (e.g., the k-means clustering operator 221 in FIG. 2) can perform k-means clustering. As described above, the example of FIG. 3 illustrates the case where there are three clusters determined through normal data, but the number of clusters may vary depending on the embodiment.

The k-mean clustering operator 310 classifies the input data into one of a plurality of groups based on the distribution of the data, thereby creating a group label y corresponding to the input data x _i (i is the input data identification number). _i can be obtained. The k-means clustering operator 310 can extract group labels corresponding to input data by performing pseudo labeling through clustering learning using normal data. For example, if the number of clustering is 3, the k-mean clustering operator 310 can classify normal data into 3 groups. A plurality of group labels are the output of the input data of the k-means clustering operator 310 and can be expressed as yi={1,2,3}. For example, if input data x _i is predicted to correspond to the 3rd group, the group label y _i may be output as 3.

The k-mean clustering operator 310 may assign a weight to x _i by calculating the distance between the input data x _i and the center (c1, c2, c3) of each cluster. For example, when input data x _i is HSIs data, the k-mean clustering operator 310 may calculate the distance using Equation 1.

is the distance between the input data x _i and the center c _k of the cluster group _, x _i,band is the data corresponding to the wavelength corresponding to _{the band} among the data It may be data corresponding to the corresponding wavelength. d1, d2, d3, and dk in FIG. 3 calculated using Equation 1 are respectively d ₁ = (x _i , c ₁ ), d ₂ = (x _i , c ₂ ), d ₃ = (x _i , c ₃ ), d _k = (x _i , c _k ).

The plurality of PCA operators 330, 350, and 370 (e.g., the plurality of PCA operators 222-1, 222-2, and 222-3 in FIG. 2) convert the input data into low dimension data. Multiple features can be extracted.

A plurality of PCA operators 330, 350, and 370 calculate a plurality of features (x _i ^pca_1 , x _i ^pca_2 , x _i ^pca_3 ) through low-dimensional transformation of the product of the distance and data calculated using Equation 1. Can be extracted based on Equation 2.

x _i ^pca_k is a feature extracted from input x _i in relation to the kth group, and PCA _k may mean the operation result of the PCA operator corresponding to the kth group.

In the example of FIG. 3, the plurality of PCA operators 330, 350, and 370 can extract 112 features from 224 features (the number of wavelength bands included in the hyperspectral image) through PCA.

Figure 4 shows the process of calculating OOD scores.

Referring to FIG. 4, a processor (e.g., processor 200 of FIG. 1) may calculate a plurality of OOD scores corresponding to each of a plurality of groups based on a plurality of characteristics.

The processor 200 may train a plurality of encoders 411, 421, and 431 using group labels extracted through k-means clustering and features extracted from a PCA operator to calculate the OOD score.

The processor 200 may train the plurality of encoders 411, 421, and 431 to output OOD scores of input data based on cross entropy loss. For example, a plurality of encoders 411, 421, and 431 may use a plurality of input features (x _i ^pca_1 , x _i ^pca_2 , x _i ^pca_3 Each can be learned to output the probability of corresponding to a regular class and the probability of corresponding to other classes as OOD scores. Cross entropy loss may be the same as Equation 3.

Here, c refers to individual classes including regular classes (c = 1) and other classes (c = 0), and k may refer to each group. is a set of vectors representing the group label y _i as 0 and 1 with respect to the kth group, and x _i ^pca_k is generated for group k in response to the training data x _i (i is an identification number that identifies each training data) refers to the selected features, and N may refer to the total number of learning data. Vector set The 0th value of is a value indicating whether the group label y _i extracted for the training data x _i corresponds to other classes of the kth group (1 for other classes, 0 for normal classes), and the 1st value is It may be a value indicating whether the extracted group label y _i corresponds to the normal class of the kth group (0 for other classes, 1 for normal classes). for example, means a set of vectors belonging to group 1, and in the case of the group label y ₁ extracted because the training data x ₁ is predicted to be included in group 1, the vector set is determined as [0,1], , can be determined as [1, 0] and [1,0], respectively.

Processor 200 is can be calculated as in Equation 4.

here, means the output value output by the encoder of group k in response to class c, and c' may mean an individual class including a regular class (c' = 1) and other classes (c' = 0). for example, is the output value output by the encoder of group 1 for other classes (c'=0) in response to the input data, May be an output value output by the encoder of group 1 for the regular class (c'=1) in response to input data.

The group labels and classes of the example in FIG. 4 can be represented as Table 1. As shown in Table 1, when the prediction result (prediction about the cluster to which the input data x _i belongs through the k-means clustering operator) through the group label y ₁ corresponding to the input data (training data in the learning process) x _i is 1. , the input data x _i may belong to the regular class in group 1, and may belong to other classes in the remaining groups 2 and 3.

y _i prediction class 1 class 2 class 3 One-hot encoding y ₁ One One 0 0 [1,0,0] [0,1] [1,0] [1,0] y ₂ 2 0 One 0 [0,1,0] [1,0] [0,1] [1,0] y ₃ 3 0 0 One [0,0,1] [1,0] [1,0] [0,1]

A plurality of encoders 411, 421, and 431 included in a plurality of groups 410, 420, and 430 may share weights or parameters.

The encoder 411 may classify data (x _i ^pca_1 ) input into group 1 410 into other classes 413 and regular classes 415. The encoder 421 may classify data (x _i ^pca_2 ) input into group 2 420 into other classes 423 and regular classes 425. The encoder 431 may classify data (x _i ^pca_3 ) input into group 3 (430) into other classes (433) and regular classes (435). For example, the encoders 411, 421, and 431 may be trained in advance to output the probability that the input data (features) will be included in other classes or regular classes.

The OOD detector can extract only the other classes from the group classes derived from the input data and calculate the OOD score based on the ratio of the other classes. In the example of FIG. 4, OOD scores corresponding to the plurality of groups 410, 420, and 430 may be 0.27, 0.7, and 0.15, respectively.

Connector 440 connects the OOD scores to the OOD vector can be created. In the example of Figure 4, the OOD vector may be [027, 0.7, 0.15].

Figure 5 is a diagram for explaining the learning and detection process.

Referring to FIG. 5, the operation of the class OOD module 520 may be the same as the operation of the class OOD module 220 of FIG. 2.

The attention calculator 540 may perform attention calculation based on a plurality of OOD scores. The attention operator 540 uses the OOD vector obtained based on the OOD score. The weight w can be extracted by inputting it into the attention (MLP (Multi-Layer Perceptron)) model using .

The auto encoder 530 may generate an auto encoding output by performing encoding and decoding on the input data 510 (or data). The encoder 531 may generate encoded data by performing encoding on the data.

The encoder 531 can extract latent features from encoded data. The encoder 531 may compress the input data 510. Key features of the data can be extracted from the latent representation layer, which is the midpoint between the encoder 531 and the decoder 533.

The decoder 533 may generate an auto-encoding output by performing decoding on the latent features. The decoder 533 can restore compressed data through encoding.

The multiplier 550 can generate a multiplication result x'' by multiplying the result w of the attention operation and the auto-encoding output x'. The processor 200 can train a neural network (more specifically, the autoencoder 530) using x''.

The MSE operator 560 can detect whether the data is normal based on the result of the attention operation and the auto-encoding output.

The MSE operator 560 may calculate the mean squared error loss based on the difference between the data and the multiplication result. The MSE operator 560 can detect whether the data is normal based on the mean square error loss.

The mean square error loss calculated by the MSE operator 260 may be equal to Equation 5.

here, , , It can be.

The processor 200 can train the autoencoder 530 by updating the weights in a direction that minimizes the mean square error loss through Equation 4 above. In the learning process, x may be learning data, and x'' may be the result of the previously described operation on the learning data.

The processor 200 can detect anomalies in data by calculating an anomaly score as shown in Equation 6 through the MSE operator 260. In the equation, bands may mean the number of wavelength bands.

For example, the processor 200 may detect an abnormality in data based on whether the abnormality score exceeds a predetermined threshold.

FIG. 6 shows a flowchart of the operation of the abnormality detection device shown in FIG. 1.

Referring to FIG. 6, a receiver (eg, receiver 100 of FIG. 1) may receive data (610).

A processor (e.g., processor 200 of FIG. 1) may extract a plurality of features corresponding to the data based on the distance between the data and a preset group for normal data (630). More specifically, the processor may obtain a group label corresponding to the received data by classifying the data into one of a plurality of groups based on the distribution of the data. Additionally, the processor 200 can extract a plurality of features by converting the received data into low-dimensional data. More specifically, the processor 200 performs low-dimensional analysis on the operation results (x _i* d _1, x _i* d _2, x _i* d ₃ ) for data x _i according to the method described in FIG. 3 above. Through this, multiple features (x _i ^pca_1 , x _i ^pca_2 , x _i ^pca_3 ) can be extracted.

The processor 200 may calculate a plurality of Out Of Distribution (OOD) scores corresponding to a plurality of groups through a plurality of previously acquired characteristics (650).

The processor 200 may classify a plurality of features (x _i ^pca_1 , x _i ^pca_2 , x _i ^pca_3 ) assigned to each of the plurality of groups into a normal class and an others class. The processor 200 may classify a plurality of features (x _i ^pca_1 , x _i ^pca_2 , x _i ^pca_3 ) into regular classes and other classes through encoders corresponding to each group described above with reference to FIG. 4. Processor 200 may calculate the OOD score based on the ratio of other classes.

The processor 200 may detect whether data is normal based on a plurality of OOD scores (690). The processor 200 may perform an attention operation based on a plurality of OOD scores.

The processor 200 may generate an OOD vector by concatenating a plurality of OOD scores. The processor 200 may perform an attention operation on the OOD vector.

The processor 200 may generate an auto-encoding output by inputting data into an auto encoder. Processor 200 is Encoded data can be created by performing encoding on the data. The processor 200 may extract latent features from encoded data. The processor 200 may generate an auto-encoding output by performing decoding on latent features.

The processor 200 can detect whether the data is normal based on the result of the attention operation and the auto-encoding output. The processor 200 may generate a multiplication result by multiplying the result of the attention operation and the auto-encoding output. The processor 200 may calculate a mean squared error loss based on the difference between the data and the multiplication result. The processor 200 may detect whether the data is normal based on the mean square error loss (670).

The device described above may be implemented with hardware components, software components, and/or a combination of hardware components and software components. For example, devices and components described in embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), etc. , may be implemented using one or more general-purpose or special-purpose computers, such as a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. A processing device may execute an operating system (OS) and one or more software applications that run on the operating system. Additionally, a processing device may access, store, manipulate, process, and generate data in response to the execution of software. For ease of understanding, a single processing device may be described as being used; however, those skilled in the art will understand that a processing device includes multiple processing elements and/or multiple types of processing elements. It can be seen that it may include. For example, a processing device may include a plurality of processors or one processor and one controller. Additionally, other processing configurations, such as parallel processors, are possible.

Software may include a computer program, code, instructions, or a combination of one or more of these, which may configure a processing unit to operate as desired, or may be processed independently or collectively. You can command the device. Software and/or data may be used on any type of machine, component, physical device, virtual equipment, computer storage medium or device to be interpreted by or to provide instructions or data to a processing device. , or may be permanently or temporarily embodied in a transmitted signal wave. Software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc., singly or in combination. Program instructions recorded on the medium may be specially designed and configured for the embodiment or may be known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -Includes optical media (magneto-optical media) and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include machine language code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with limited examples and drawings, various modifications and variations can be made by those skilled in the art from the above description. For example, the described techniques are performed in a different order than the described method, and/or components of the described system, structure, device, circuit, etc. are combined or combined in a different form than the described method, or other components are used. Alternatively, appropriate results may be achieved even if substituted or substituted by an equivalent.

Therefore, other implementations, other embodiments, and equivalents of the claims also fall within the scope of the claims described below.

Claims (5)

In an anomaly detection device using a neural network,
a receiver that receives data; and
Extracting a plurality of features corresponding to the data based on a distance between the data and a preset group for normal data,
Calculate a plurality of OOD (Out Of Distribution) scores corresponding to the plurality of groups based on the plurality of characteristics,
A processor that detects whether the data is normal based on the plurality of OOD scores
An abnormality detection device comprising a.
According to paragraph 1,
The processor,
Perform an attention calculation based on the plurality of OOD scores,
Generating an auto-encoding output by inputting the data into an auto encoder,
Detecting whether the data is normal based on the result of the attention operation and the auto-encoding output,
Anomaly detection device.
According to paragraph 1,
The processor,
Classifying the plurality of features into normal classes and others classes,
Calculating the OOD score based on the ratio of the other classes,
Anomaly detection device.
According to paragraph 2,
The processor,
Generating a multiplication result by multiplying the result of the attention operation and the auto-encoding output,
Calculating a mean squared error loss based on the difference between the data and the multiplication result,
Detecting whether the data is normal based on the mean square error loss,
Anomaly detection device.
In an anomaly detection method using a neural network,
receiving data;
extracting a plurality of features corresponding to the data based on a distance between the data and a preset group for normal data;
calculating a plurality of OOD (Out Of Distribution) scores corresponding to the plurality of groups based on the plurality of characteristics; and
Detecting whether the data is normal based on the plurality of OOD scores
An abnormality detection method including.