WO2017155292A1

WO2017155292A1 - Anomaly detection method and detection program

Info

Publication number: WO2017155292A1
Application number: PCT/KR2017/002480
Authority: WO
Inventors: 최정렬
Original assignee: 주식회사 인피니그루
Priority date: 2016-03-08
Filing date: 2017-03-08
Publication date: 2017-09-14
Also published as: KR101720538B1

Abstract

The present invention relates to a method and a program for detecting anomalies. A method for detecting anomalies according to one embodiment of the present invention comprises: a collection data reception step (S100) for receiving one or more collection data by a computer; a step (S200) for calculating result data for each collection data through a deep neural network in the computer; a pattern information derivation step (S300) for deriving pattern information at the time of calculating the result data for each collection data; a group designation step (S400) for designating one or more collection data having the same pattern information as a specific group; a characteristic assignment step (S500) for assigning a characteristic of each group; and a step (S700) for calculating new result data after receiving new collection data, and extracting a group corresponding to the new result data. According to the present invention, it is possible to prevent a group corresponding to an anomaly from being mistaken as being included in a group corresponding to a normal behavior.

Description

Abnormal behavior search method and search program

The present invention relates to an abnormal behavior searching method and a search program, and more particularly, to a method and program for determining whether or not abnormal behavior of the collected data obtained through a computer through big data analysis.

Recently, due to the development of information and communication technology and semiconductor technology, the use of computers has increased in various fields.

The same is true of the financial sector. For example, it is possible to promptly process a financial transaction that a customer directly visited a bank branch using internet banking, mobile banking, and phone banking. Automatic payment and processing is now possible. On the other hand, with the introduction of the above computerization, new financial crimes through electronic financial fraud and illegal transactions have emerged, and in recent years, as the damages gradually spread, phishing and smishing (phishing and smishing) have been issued. Attention is drawn to smishing, farming, and the like. Phishing is a crime that pretends to be a trusted person (personal) or business (e-commerce company) and uses the e-mail or messenger to steal the recipient's personal information (such as passwords, credit information, or security card information).

However, these phishing attacks can only be detected by customers' reports or anti-malware malware analysis, so they can only be detected passively. If customers are not reported or infected by unknown phishing sites, it is difficult to respond quickly and track them. There is a problem.

As well as the financial field, many abnormal activities occur as a result of using a lot of computers, but they often go undetected.

By using a plurality of collected data (data acquired in a specific performing behavior process using a computer) to the deep learning algorithm, using a pattern information of each collected data has a value different from or corresponding to the normal behavior The aim of the present invention is to provide a method and a program for detecting abnormal behaviors.

In addition, by adjusting the weight for each situation data using a deep learning algorithm to visually distinguish a group with different pattern information, an abnormal behavior search method and program that allows an administrator to easily detect abnormal behavior. To provide.

In addition, by providing an identification mark of the new collection data on a diagram having each layer corresponding to each collection data group, it provides an abnormal behavior search method and program that allows the administrator to easily check the characteristics of the new collection data. I would like to.

Abnormal behavior search method according to an embodiment of the present invention, the computer receives one or more collection data, the collection data includes one or more situation data, collection data receiving step; Calculating result data for each collected data through the deep neural network in the computer; Deriving pattern information when calculating the result data for each collected data, wherein the pattern information corresponds to an order determined in the deep neural network; A group specifying step of designating one or more pieces of collected data having the same pattern information as a specific group; Characterization step of giving the characteristics of each group; And calculating new result data after receiving the new collection data, and extracting a group corresponding to the new result data.

The calculating of the result data may include calculating the result data by applying a weight to each situation data, wherein the weight is such that the separation distance between groups having different pattern information falls above a specific value. It may be to adjust.

In addition, if there is no group corresponding to the new collection data, generating a new group corresponding to the new collection data; And adjusting the interval between the groups by changing one or more of the weights.

In addition, an abnormal behavior determination diagram including a plurality of distinguishable layers is generated, wherein each layer is matched with each other, and the generation position of the abnormal behavior determination diagram is changed according to a numerical value of the result data. ; And displaying the identification mark on the layer of the group to which the new collection data corresponds, and providing the identification mark to the user client.

In addition, when an acquisition order of at least one piece of situation data included in the collected data is determined, the deep neural network includes an abnormal behavior determination procedure that conforms to the acquisition sequence, and the abnormal behavior is performed step by step in the abnormal behavior determination procedure. It may be characterized by generating a determination diagram.

The method may further include providing type information of the abnormal behavior to an administrator client when the characteristic of the group corresponds to the abnormal behavior.

In addition, the characterizing step may be characterized in that for receiving the characteristic information determined based on the input value of the specific context data included in the collected data of the group from the administrator client.

In addition, the pattern information derivation step may perform an abnormal behavior determination procedure including one or more successive determination steps, and the pattern information may include the type and order of questions for each determination step in the abnormal behavior determination procedure. have.

In addition, the characterizing step may be characterized by determining the characteristics corresponding to the group through the reverse analysis of the pattern information.

The abnormal behavior search program according to another embodiment of the present invention is coupled to a computer which is hardware to execute the above-mentioned electronic device control method and is stored in a medium.

According to the present invention as described above, has the following various effects.

First, the collected data is classified using the pattern information, which is a flow determined in the deep learning algorithm of each collected data, rather than simply classifying the collected data into the result data calculated through the collected data. Accurately classify groups of collected data. Accordingly, it is possible to prevent the group corresponding to the abnormal behavior from being mistaken as being included in the group corresponding to the normal behavior.

Second, as the weight of each situation data is changed, the result data of each group can be adjusted to be visually distinguishable.

Third, by displaying the identification mark of the new collection data on the abnormal behavior search diagram and providing it to the administrator, the administrator can easily grasp the characteristics of the new collection data. That is, the manager can quickly check whether the new collection data corresponds to abnormal behavior by identifying which layer on the diagram the identification mark of the new collection data is displayed, and can also quickly identify the specific abnormal behavior type.

Fourth, as a new phishing scheme is applied, when there is no group to which new collection data belongs, a new group is generated, so that weight adjustment can be automatically performed to have a specific interval between groups. Through this, even when a new group type emerges, an administrator may provide an abnormal behavior search diagram that enables the administrator to easily check whether an abnormal behavior is applicable.

1 is a block diagram of an abnormal behavior determination system according to an embodiment of the present invention.

2 is a flowchart illustrating a method for determining abnormal behavior according to an embodiment of the present invention.

3 is an exemplary diagram of a deep learning algorithm showing a process of calculating pattern information using collected data according to an embodiment of the present invention.

4 is a flow chart of an abnormal behavior determination method further comprising the step of adjusting the weight after the creation of a new group corresponding to the new collection data according to an embodiment of the present invention.

5 is a flowchart illustrating an abnormal behavior determination method of displaying a group to which new collection data belongs using an abnormal behavior determination diagram according to an embodiment of the present invention.

6 is an exemplary diagram of an abnormal behavior determination diagram according to an embodiment of the present invention.

7 is a flowchart illustrating a method for determining abnormal behavior that provides a manager with a type of abnormal behavior corresponding to new collection data according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various forms, and only the embodiments are intended to complete the disclosure of the present invention, and the general knowledge in the art to which the present invention pertains. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

Unless otherwise defined, all terms (including technical and scientific terms) used in the present specification may be used in a sense that can be commonly understood by those skilled in the art. In addition, the terms defined in the commonly used dictionaries are not ideally or excessively interpreted unless they are specifically defined clearly.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, "comprises" and / or "comprising" does not exclude the presence or addition of one or more other components in addition to the mentioned components.

In this specification, a computer includes all of various devices capable of performing arithmetic processing and providing a result to a user. For example, a computer can be a desktop PC, a notebook, as well as a smartphone, a tablet PC, a cellular phone, a PCS phone (Personal Communication Service phone), synchronous / asynchronous The mobile terminal of the International Mobile Telecommunication-2000 (IMT-2000), a Palm Personal Computer (PC), a Personal Digital Assistant (PDA), and the like may also be applicable. Also, the computer may correspond to a server that receives a request from a client and performs information processing.

In this specification, the normal behavior refers to the behavior that is determined to be normal performance among specific performance behaviors (eg, financial transaction behavior, data detection behavior, etc.) using the user's client. On the other hand, in this specification, the abnormal behavior refers to the behavior that is determined to be abnormal performance among specific behaviors (eg, financial transaction behavior, data detection behavior, etc.) using the user's client. For example, with respect to certain financial transactions (e.g., account transfers), if performed in accordance with the procedures generally performed by users of a particular account, they may be classified as normal behavior, and existing procedures for users of a particular account. Is different from (e.g., when performing a transfer procedure to a client device other than the client for injection of the account holder user, the position corresponding to the IP currently connected to perform the transfer and the position corresponding to the recently accessed IP). If you include more than a certain distance, etc.) can be classified as abnormal behavior.

In the present specification, the collected data refers to data obtained during a specific performance of a user. In other words, the collected data is data obtained from a client of a user or acquired in an image and stored in a computer in a process for performing a specific performing action. In the present specification, the context data is one or more data included in the collected data, and means data obtained from a client in each situation during a procedure of performing a specific action. For example, in the case of a bank transfer during a financial transaction, a user accesses a financial institution application through a specific IP using a specific client device, performs a login, and enters a counterpart account. If performing, individual data acquired in each situation, such as 'type of client', 'access IP', 'login account', 'counter party account information' may be referred to as 'situation data', and one The above situation data set may be referred to as 'collection data'. One or more contextual data may be obtained sequentially or simultaneously in one occurrence.

In the present specification, a group may mean one or more sets generated through classification of a plurality of collected data. For example, by classifying based on pattern information or characteristics described below, a specific group may include collected data having the same pattern information or characteristics.

In the present specification, the pattern information refers to data that is a standard for classifying collected data into one or more groups. For example, the pattern information may correspond to a flow in which groups are classified by a computer with respect to specific collection data.

In the present specification, a characteristic means an attribute of collected data. For example, the characteristics of the collected data can be divided into normal, suspicious or abnormal by the computer. In addition, the abnormal characteristic may be classified using the basis (eg, status data that contributed to being determined abnormal) as classified as abnormal by the computer as the detailed characteristic.

In the present specification, the new collection data is data requiring determination of abnormal behavior. In the present specification, the new situation data means one or more situation data included in the new collection data. The new collection data may be added to existing collection data within a specific group after determining whether it is an abnormal behavior.

In the present specification, a user may mean a person who uses a client that provides collected data to a computer. In this specification, the manager refers to a person who is provided with data for determining whether an abnormal behavior of new collection data is applicable. That is, the manager may include not only a person who manages a specific system but also a person (eg, a service user) who checks the status of his / her account, account, and the like.

In the present specification, a deep neural network (DNN) refers to a system or a network that performs a determination based on a plurality of data by constructing one or more layers in one or more computers. For example, the deep neural network may be implemented as a set of layers including a convolutional pooling layer, a locally-connected layer, and a fully-connected layer. In some embodiments, the overall structure of the deep neural network may be formed of a spiral neural network (ie, a convolutional neural network (CNN)) structure in which a local connection layer is connected to a convolution pooling layer and a fully connected layer is connected to the local connection layer. . In addition, the deep neural network may be formed of a recurrent neural network (RNN) structure that is recursively connected, for example, as edges pointing to the nodes of each layer are included. The deep neural network may include various criteria (ie, parameters), and may add new criteria (ie, parameters) through an input image analysis. However, the structure of the deep neural network according to the embodiments of the present invention is not limited thereto, and may be formed of a neural network having various structures.

Embodiments of the present invention are an abnormal behavior detection system (hereinafter, abnormal behavior detection system) including a deep neural network, which may be implemented in one computer or a plurality of computers connected to each other. For example, as shown in FIG. 1, the abnormal behavior search system may be included in one or more computers 10. The one or more computers may include a database server 11 containing collected data. One or more computers 10 may receive new collection data from the user client 20 and compare and analyze the collected data 100 in the database server 11 to extract abnormal symptoms (that is, determine whether abnormal behavior is applicable). In addition, the type of abnormal behavior derived may be provided to the manager client 30. In addition, for example, the abnormal behavior search system may be implemented as one computer 10, so that the collection data 100 is stored in a memory (for example, a hard disk) in one computer and new collection data ( It is possible to calculate whether or not the abnormal behavior corresponding to the acquisition and comparison with the collected data (100).

Hereinafter, a method and a program for detecting abnormal behavior according to embodiments of the present invention will be described with reference to the accompanying drawings.

2 is a flowchart illustrating a method for detecting abnormal behavior according to an embodiment of the present invention.

Referring to Figure 2, the abnormal behavior search method according to an embodiment of the present invention, the computer 10 receives the collection data receiving step (100) collected data (S100); Calculating result data (300) for each collected data (100) through the deep neural network in the computer (10) (S200); A pattern information derivation step (S300) for deriving pattern information when calculating the result data 300 for each collection data 100; A group specifying step (S400) of designating one or more pieces of collected data having the same pattern information as a specific group; Characterization step (S500) to give the characteristics of each group; And calculating new result data after receiving the new collection data 200, and extracting a group corresponding to the new result data (S700). The abnormal behavior search method according to an embodiment of the present invention will be described in order.

The computer 10 receives one or more pieces of collected data 100 (S100). The collected data 100 includes one or more situation data, and a specific user (that is, the user) logs in using a specific performing activity (for example, data searching, financial transaction such as account transfer, or a specific account). Etc.) may be data received from the user client 20 in the process of performing an account use act. One or more computers 10 may load specific collection data 100 stored therein. That is, when the collected data 100 for the existing (ie, previous) performing behavior is accumulated in the computer 10, the computer 10 loads the accumulated plurality of collected data 100 as described below. Can be entered into the deep neural network.

The computer 10 calculates the result data 300 for each of the collected data 100 through the deep neural network (S200). The computer 10 may calculate the result data 300 using a deep learning algorithm through a deep neural network. The result data 300 refers to data calculated by applying each situation data value in the collected data 100 to the deep learning algorithm. The computer 10 may input numerical values corresponding to the situation data into the deep learning algorithm to convert the respective situation data into numerical values (eg, binary data) to calculate the result data 300. Accordingly, the computer 10 may calculate different result data 300 according to the configuration of the situation data included in each collection data 100.

In the result data calculating step (S200), the result data 300 may be calculated by applying a weight to each situation data. The weight may be adjusted to reduce the separation distance between groups having different pattern information to a specific value or more (that is, to adjust the deviation between result data corresponding to groups having different pattern information to be greater than or equal to a specific value). When the situation data value included in each collection data 100 is input to the deep learning algorithm as it is without weighting, the result data 300 value calculated by the collection data 100 which is a different combination of situation data is close and specified. It may fall within the numerical range (ie, the deviation between the result data 300 corresponding to different groups may be smaller than a specific value and difficult to distinguish).

Specifically, as shown in FIG. 3, when there is a difference in the configuration of the situation data included in the first collection data and the second collection data, the first collection data is normal behavior, but the second collection data is abnormal. The first result data (ie, result data calculated by the first collection data) and the second result data (ie, result data calculated by the second collection data) may have close numerical values. Therefore, when the computer 10 displays the first result data and the second result data on a graph and visually provides them to the manager, the manager may not be able to distinguish the first result data and the second result data. As a result, a problem may occur in which the second result data corresponding to the abnormal behavior is mistaken for the first result data corresponding to the normal behavior.

Therefore, in order to solve this problem, the computer 10 reflects the weights of one or more contextual data constituting each of the collected data 100, and the result data of the collected data 100 having different configurations of the contextual data values. Numerical differences between the 300 can be more than a specific value. For example, the computer 10 may grasp the difference between the situation data items constituting the first result data and the second result data that are within a specific range (that is, the difference is equal to or less than the specific value), Weight can be given to the context data item. As a result, the computer 10 may increase the numerical difference (that is, the deviation) between the first result data and the second result data, and display the first result data and the second result data on a graph or diagram. The separation distance can be more than visually recognizable so that the manager can distinguish it.

The computer 10 derives the pattern information when calculating the result data for each of the collected data 100 (S300). The pattern information may correspond to an order (or flow) determined in the deep neural network.

In one embodiment, the pattern information derivation step S300 may perform an abnormal behavior determination procedure including one or more consecutive determination steps. That is, the computer 10 may include a plurality of determination steps to distinguish one or more collected data 100 in the deep learning algorithm, and each determination step may perform a determination based on one or more context data. For example, when each determination step in the deep learning algorithm includes a plurality of questions (eg, whether to determine whether a particular situation is based on the situation data), one or more included in each determination step As the status data value is input to any one of the questions, a question to be determined in the next determination step may be determined.

When the computer 10 performs an abnormal behavior determination procedure including a plurality of determination steps, the pattern information may include the type and order of questions for each determination step in the abnormal behavior determination procedure. That is, the computer 10 may go through each determination step, and according to the difference in the situation data values included in the collected data 100, the types of query items that pass through the same determination step may vary. Therefore, the type and order of the question items determined according to the collected data 100 may be pattern information.

The computer 10 designates one or more pieces of collected data 100 having the same pattern information into a specific group (S400). That is, the computer 10 may classify the plurality of collected data 100 based on the pattern information rather than the result data 300 value. Since the collected data 100 having different contextual data but having adjacent result data 300 values may be incorrectly classified into the same group, the computer 10 may be a type or value of the contextual data constituting the collected data 100. Groups can be created based on clearly distinguishable pattern information.

The computer 10 gives the characteristics of each group (S500). For example, the computer 10 may give each group a characteristic corresponding to each group, such as normal behavior, suspicious behavior or abnormal behavior. The computer 10 may give the details of each group in detail. For example, if the performance is abnormal, elements that can identify why each group is determined to be abnormal (for example, status data assigned to each type of abnormal behavior or status data that is determined to be abnormal) Information) can be given as a group property.

The computer 10 can give each group a characteristic in various ways. However, the method of imparting the characteristics of each group is not limited to the method described below, and various methods may be applied.

In one embodiment, the characteristic granting step S500 may receive the characteristic information determined based on an input value of specific context data included in the collection data 100 of the group from the manager client 30. That is, the administrator may look at the situation data constituting the collection data 100 included in each classified group, and determine and input characteristics of each group. The abnormal behavior search system may receive and set characteristic information for each group input to the manager client 30.

In another embodiment, the characterization step S500 may determine a characteristic corresponding to the group through reverse analysis of the pattern information. For example, the abnormal behavior search system may sequentially store questions determined in a storage space granted to a specific result data 300 in the process of calculating the result data 300. Thereafter, the abnormal behavior search system may analyze the type and order of the rough questions in the process of calculating each result data 300. That is, the abnormal behavior detection system is an abnormal behavior, each of the collected data 100 (or the result data 300 according to the collected data 100) is abnormal behavior based on the case data input by the service user or administrator. It can be determined whether or not to correspond to. For example, if the conduct is a financial transaction, the abnormal behavior detection system may obtain the reported financial transaction accident case data from the service user or manager of the financial transaction system, and the situation data within the case data of each financial transaction accident Data may be included. Therefore, the abnormal behavior search system compares the situation data of the financial transaction accident case data with the situation data of the collected data 100 in each group, and searches for a group corresponding to each financial transaction accident (or a financial transaction corresponding to each group). Matching state). Through this, the abnormal behavior search system can automatically assign the characteristics of each group using the accumulated case data. In addition, the abnormal behavior search system can clearly update the characteristics of the group based on the accumulated case data.

After receiving the new collection data 200, the computer 10 calculates new result data and extracts a group corresponding to the new result data (S700). According to an embodiment of the method for calculating the group to which the new collection data 200 corresponds, the computer 10 may determine the new result data as a group having a value corresponding to the new result data or a value within an error range. In particular, when a weight is given so that a difference value (i.e., a deviation) between each group is equal to or greater than a specific value (i.e., when the separation distance between each group is equal to or greater than a specific value), the new data is collected through the result data 300 value. The data 200 may accurately calculate a group to which the data 200 corresponds.

In another embodiment of the method of calculating the group to which the new collection data 200 corresponds, when the new collection data 200 requiring determination of abnormal behavior is input, the computer 10 (that is, abnormal behavior search system) is input. May calculate the result data 300 based on the new collection data 200, and extract a corresponding group through the pattern information grasped in the process of calculating the result data 300.

In addition, as shown in FIG. 4, when there is no group corresponding to the new collection data 200, generating a new group corresponding to the new collection data 200 (S800); And adjusting the interval between the groups by changing one or more of the weights (S900). If a group corresponding to the new collection data 200 is not found, the computer 10 may determine that a new type of performance has occurred. Therefore, a new group can be created based on new result data and new pattern information corresponding to the new collection data 200. Since the result data 300 of the new group may be located between the result data 300 of the existing group, the computer 10 adjusts the weight so that the difference between the result data 300 corresponding to the adjacent group is equal to or greater than a specific value. Can be performed.

In addition, as illustrated in FIG. 5, the method may further include generating an abnormal behavior determination diagram 400 including a plurality of distinguishable layers 410 (S600). That is, as shown in FIG. 6, the computer 10 may generate an abnormal behavior determination diagram 400 in which an administrator may visually distinguish a group by performance behavior. For example, the abnormal behavior determination diagram 400 may include one or more layers 410 indicating a generation position corresponding to a numerical value of the result data 300 corresponding to each group. That is, each layer 410 is matched to each group, and the generation position may vary according to the numerical value of the result data 300. In addition, each layer 410 may be displayed differently in color or combined with an identification mark (ie, a label) so as to be visually distinguishable.

In addition, as shown in FIG. 5, the new collection data 200 displays an identification mark on the layer 410 of the corresponding group, and provides the identification mark to the manager client 30 (S1000). . That is, the computer 10 may display the identification mark indicating the new collection data 200 on the layer 410 of the group corresponding to the new collection data 200 and provide it to the manager client 30. Through this, an abnormal behavior judgment diagram visually provided by an administrator who manages the occurrence of abnormal behavior or a service user who wants to check whether an illegal situation occurs (for example, performing a specific performance behavior using his or her account or account). Through the identification mark on 400, it is possible to visually check whether abnormal behavior has occurred or the type of abnormal behavior occurred simply and intuitively.

In addition, when an acquisition order of one or more contextual data included in the collected data 100 is determined, the deep neural network may include an abnormal behavior determination procedure in accordance with the acquisition order. In the course of performing financial transactions, one or more contextual data included in the collected data 100 may be sequentially obtained at time intervals. It is necessary to quickly identify abnormal behaviors (e.g. abnormal transactions (e.g. transactions that are expected of financial accidents)) such as financial transactions (e.g., bank transfers), and take countermeasures such as stopping transactions. In this case, if all the situation data of the collected data 100 is acquired or analyzed whether it corresponds to abnormal behavior, the response may be late.

Therefore, when the situation data is received in sequence, the computer 10 may generate a general notification of the specific performance behavior in order to notify the reception of the specific situation data that is likely to cause the collected data 100 to be classified as an abnormal behavior. This may include procedures for determining abnormal behavior in accordance with the order of obtaining situational data. For example, after the first stage situation data (that is, situation data acquired in the first stage (first)) is received, the second stage situation data (that is, situation data obtained in the second stage (second)) is received. If the computer 10, the first decision step to perform the determination as the first stage situation data on the deep learning algorithm first in the order of the algorithm, the second determination to perform the determination as the second stage situation data The steps may be arranged in the following order of the first judgment step.

In addition, the computer 10 may generate the abnormal behavior determination diagram 400 in stages within the abnormal behavior determination procedure in accordance with the order of acquiring the situation data. That is, in order to grasp the real-time situation based on the situation data in the abnormal behavior judgment procedure in accordance with the situation data acquisition order, the computer 10 for each judgment step that can predict the possibility of abnormal behavior at the time when the specific situation data is acquired. The abnormal behavior determination diagram 400 may be generated. Accordingly, as the manager provides the abnormal behavior determination diagram 400 of the current judgment stage displaying the current situation data acquired with the specific new collection data 200 and the identification mark of the collected data 100, the administrator may generate an abnormality. You can easily recognize and prepare for actions.

In addition, the computer 10 may rearrange the order of the layers 410 of the abnormal behavior determination diagram 400 arranged according to the numerical value of the result data 300, so that the administrator may intuitively determine whether the abnormal behavior has occurred. That is, the computer 10 generates a modified diagram in which the arrangement of each layer 410 of the abnormal behavior determination diagram 400 (hereinafter, referred to as the original diagram) according to the result data 300 is generated, and thus, the normal behavior layer and the abnormal behavior layer. Can be displayed as The manager can immediately check whether the abnormal behavior is visually based on the location where the new collection data 200 is included and match the specific layer 410 of the correction diagram when the correct group and the characteristics of the group are to be identified. The result data 300 or the modified diagram layer 410 and the original diagram layer 410 can be confirmed based on the matching relationship.

In addition, as shown in FIG. 7, when the characteristic of the group corresponds to abnormal behavior, providing the manager client 30 with type information of the abnormal behavior (S1100). That is, when the new collection data 200 is determined to be an abnormal behavior through the comparison of the pattern information or the comparison of the result data 300, the computer 10 sets the abnormal behavior type of the group to which the new collection data 200 belongs. Can be identified and provided to the administrator.

The abnormal behavior search method according to the above-described embodiment of the present invention may be implemented as a program (or an application) and stored in a medium to be executed in combination with the computer 10 which is hardware.

The above-described program includes C, C ++, JAVA, machine language, etc. which can be read by the computer's processor (CPU) through the computer's device interface so that the computer reads the program and executes the methods implemented as the program. Code may be coded in the computer language of. Such code may include functional code associated with a function or the like that defines the necessary functions for executing the methods, and includes control procedures related to execution procedures necessary for the computer's processor to execute the functions according to a predetermined procedure. can do. In addition, the code may further include memory reference code for additional information or media required for the computer's processor to execute the functions at which location (address address) of the computer's internal or external memory should be referenced. have. Also, if the processor of the computer needs to communicate with any other computer or server remotely in order to execute the functions, the code may be used to communicate with any other computer or server remotely using the communication module of the computer. It may further include a communication related code for whether to communicate, what information or media should be transmitted and received during communication.

The stored medium is not a medium for storing data for a short time such as a register, a cache, a memory, but semi-permanently, and means a medium that can be read by the device. Specifically, examples of the storage medium include, but are not limited to, a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like. That is, the program may be stored in various recording media on various servers to which the computer can access or various recording media on the computer of the user. The media may also be distributed over network coupled computer systems so that the computer readable code is stored in a distributed fashion.

Although embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. I can understand that. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive.

Claims

A computer receiving one or more collection data, wherein the collection data includes one or more situation data;

Calculating result data for each collected data through the deep neural network in the computer;

Deriving pattern information when calculating the result data for each collected data, wherein the pattern information corresponds to an order determined in the deep neural network;

A group specifying step of designating one or more pieces of collected data having the same pattern information as a specific group;

Characterization step of giving the characteristics of each group; And

And calculating new result data after receiving the new collection data, and extracting a group corresponding to the new result data.
The method of claim 1,

The result data calculating step,

It is characterized in that for calculating the result data by applying a weight for each situation data,

The weight is,

The pattern information is to adjust the separation distance between different groups to fall above a specific value, abnormal behavior detection method.
The method of claim 2,

If there is no group corresponding to the newly collected data,

Creating a new group corresponding to the new collection data; And

And adjusting the interval between the groups by changing one or more of the weights.
The method of claim 1,

Generating an abnormal behavior determination diagram including a plurality of distinguishable layers, wherein the layers match each group, and a generation position of the abnormal behavior determination diagram varies according to a numerical value of the result data; And

And displaying the identification mark on the layer of the group to which the new collection data corresponds, and providing the identification mark to the user client.
The method of claim 4, wherein

When the acquisition order of one or more contextual data included in the collected data is determined,

The deep neural network,

Including abnormality judgment procedure in accordance with the acquisition order,

And generating the abnormal behavior determination diagram in stages within the abnormal behavior determination procedure.
The method of claim 1,

If the characteristics of the group correspond to abnormal behavior,

Providing the type information of the abnormal behavior to the client client; abnormality detection method further comprising.
The method of claim 1,

The characterizing step,

And receiving characteristic information determined based on an input value of specific context data included in the group's collected data from an administrator client.
The method of claim 1,

The pattern information derivation step,

Perform an abnormal behavior determination procedure that includes one or more successive judgments,

The pattern information,

The abnormal behavior detection method, including the type and order of questions in each determination step in the abnormal behavior determination procedure.
The method of claim 8,

The characterizing step,

And determining a characteristic corresponding to the group by performing reverse analysis of the pattern information.
10. An abnormality detection program, stored in a medium for carrying out the method of any one of claims 1 to 9, coupled with a computer that is hardware.