Method and system for detecting anomalies in time series data using dynamic windows

Abstract

One embodiment provides a method for detecting anomalies in time series data using a dynamic window, wherein an anomaly detection application executed by at least one processor of a terminal provides an anomaly detection service, comprising the steps of: acquiring first time series data; performing preprocessing on the first time series data; training an anomaly detection model based on the preprocessed first time series data; and calculating a change value of an anomaly score for newly input second time series data and dynamically adjusting the size of a window for the second time series data according to the change value to perform anomaly detection based on the anomaly detection model.

Description

Technology Field

[0001] The present invention relates to a method and system for detecting anomalies in time-series data using a dynamic window. More specifically, the invention relates to a method and system for detecting anomalies in time-series data using a dynamic window that can dynamically perform global and local anomaly detection by dynamically adjusting the size of the window according to the variation value of the anomaly score of the time-series data. Background Technology

[0002] Anomaly detection technology for time-series data is utilized in various industrial sectors such as finance, manufacturing, healthcare, and security, and is considered a mature technological field.

[0003] However, existing anomaly detection systems are often designed and operated primarily by professional data scientists or machine learning experts. They feature complex interfaces and configuration processes that are not easily accessible to non-expert users, and most tasks—such as model training, parameter tuning, data preprocessing, and interpretation of anomaly detection results—rely on the judgment of experts.

[0004] In particular, non-expert users often find it difficult to understand the training process or detection basis of anomaly detection models, and frequently struggle to clearly determine why specific data is detected as an outlier.

[0005] As a result, existing anomaly detection systems lack transparency, leading to problems where users do not trust the system's detection results or the system's interpretability is low.

[0006] Meanwhile, another limitation of existing anomaly detection systems is that they regard the entire data as a single distribution without considering the characteristics of each interval of the time-series data.

[0007] Time series data generally often exhibits different data characteristics (e.g., mean, variance, patterns, etc.) depending on the interval. For instance, sensor data from manufacturing equipment may show relatively low variability during regular maintenance periods, but variability can increase during the initial stages of operation or when specific events occur.

[0008] If the entire dataset is detected using a single model without considering these segment-specific characteristics, there is a problem where detection performance can be significantly degraded. This is because the model fails to adapt to structural changes in the data, leading to excessive false positives in stable segments and a higher likelihood of false negatives in highly volatile segments.

[0009] Therefore, the need for the development and introduction of new technologies to solve the aforementioned problems is emerging. Prior art literature

[0010] (Patent Document 0001) US 10326787 B2 The problem to be solved

[0011] One embodiment of the present invention is devised to solve the problems of the prior art as described above, and aims to implement a method and system for providing an AIaaS-based anomaly detection service that automates the entire process from uploading time-series data to preprocessing, model training, anomaly detection, performance evaluation, and distribution, while simultaneously supporting continuous performance improvement by reflecting user feedback.

[0012] At this time, one embodiment of the present invention aims to provide a time series data anomaly detection method and system using a dynamic window that can dynamically perform global anomaly detection and local anomaly detection by dynamically adjusting the size of the window according to the variation value of the anomaly score of the time series data.

[0013] However, the technical problems that the present invention and the embodiments of the present invention aim to solve are not limited to the technical problems described above, and other technical problems may exist. means of solving the problem

[0014] One embodiment is,

[0015] A method for detecting anomalies in time series data using a dynamic window, wherein an anomaly detection application executed by at least one processor of a terminal provides an anomaly detection service, comprising the steps of: acquiring first time series data; performing preprocessing on the first time series data; training an anomaly detection model based on the preprocessed first time series data; and calculating a change value of an anomaly score for newly acquired second time series data and dynamically adjusting the size of a window for the second time series data according to the change value to perform anomaly detection based on the anomaly detection model.

[0016] In another aspect, when dynamically adjusting the size of the window during the step of performing the anomaly detection, if the variation value of the anomaly score is greater than the first threshold value, the size of the window can be reduced.

[0017] In another aspect, the first threshold value may be determined based on a linear combination of the mean and standard deviation of the anomaly score variation values ​​for the time series data within the window.

[0018] In another aspect, when dynamically adjusting the size of the window during the step of performing the anomaly detection, if the fluctuation value of the anomaly score is maintained at or below a second threshold value for a predetermined period of time, the size of the window may be increased.

[0019] In another aspect, the first threshold value may be greater than the second threshold value.

[0020] In another aspect, in the step of performing preprocessing on the first time series data, abnormal data can be removed from the first time series data using an LSTM-VAE model.

[0021] In another aspect, the above LSTM-VAE model is a model trained to generate a first latent variable based on normal data and a second latent variable based on abnormal data, and in removing abnormal data from the first time series data using the above LSTM-VAE model, a target latent variable is generated based on the first time series data using the above LSTM-VAE model, and if the shape of the distribution of the target latent variable is similar to the shape of the distribution of the second latent variable, the data is determined as abnormal data, and the determined abnormal data can be removed from the first time series data.

[0022] In another aspect, in the step of performing preprocessing on the first time series data, if it is determined that the first time series data falls below a predetermined threshold, additional time series data including at least one pattern parameter is generated, and in the step of performing preprocessing, the preprocessing is performed on the additional time series data, and in the step of training the anomaly detection model, the anomaly detection model can be trained based on the preprocessed additional time series data.

[0023] In another aspect, the additional time series data may include a plurality of pattern parameters, and the additional time series data may be generated according to a method of independently assigning probability values ​​to each of the plurality of pattern parameters.

[0024] In another aspect, in the step of performing preprocessing on the first time series data, a predetermined anomaly is injected into the first time series data to generate abnormal time series data, the distribution of the first anomaly score of the first time series data is compared with the distribution of the second anomaly score of the abnormal time series data, a threshold for the anomaly score is selected in the overlapping region of the distribution of the first anomaly score and the distribution of the second anomaly score, and in the step of training the anomaly detection model, the anomaly detection model can be trained based on the preprocessed first time series data and the threshold for the anomaly score.

[0025] One embodiment is,

[0026] The present invention provides a time series data anomaly detection system using a dynamic window, comprising at least one memory and at least one processor that reads at least one application stored in the memory and performs time series data anomaly detection using a dynamic window, wherein the instructions of the processor include the steps of acquiring first time series data, performing preprocessing on the first time series data, training an anomaly detection model based on the preprocessed first time series data, calculating a change value of an anomaly score for newly input second time series data, and dynamically adjusting the size of a window for the second time series data according to the change value to perform anomaly detection based on the anomaly detection model.

[0027] In another aspect, the instructions of the processor may further include instructions for performing a step of reducing the size of the window when the variation value of the anomaly score is greater than a first threshold value when dynamically adjusting the size of the window during the step of performing the anomaly detection.

[0028] In another aspect, the instruction of the processor may further include an instruction to increase the size of the window when the fluctuation value of the anomaly score is maintained at or below a second threshold value for a predetermined period of time, in dynamically adjusting the size of the window during the step of performing the anomaly detection.

[0029] In another aspect, the first threshold value may be greater than the second threshold value. Effects of the invention

[0030] The method and system for providing an AlaaS-based anomaly detection service according to one embodiment of the present invention automates the entire process from uploading time-series data to preprocessing, model training, anomaly detection, performance evaluation, and distribution, while simultaneously supporting continuous performance improvement by reflecting user feedback. This has the effect of enabling even users lacking specialized knowledge to easily optimize and utilize customized anomaly detection services through an intuitive interface.

[0031] Accordingly, the method and system for providing an AlaaS-based anomaly detection service according to one embodiment of the present invention have the effect of easily improving anomaly detection efficiency, accuracy, and reliability based on user needs.

[0032] In addition, the method and system for providing an AlaaS-based anomaly detection service according to one embodiment of the present invention can improve the accuracy of anomaly detection by appropriately performing anomaly detection suitable for various states of time series data by performing anomaly detection based on a dynamic window, wherein local anomaly detection is performed by reducing the window size when the variation value of the anomaly score of time series data is greater than a predetermined threshold, and global anomaly detection is performed by increasing the window size when it is less than a predetermined threshold.

[0033] In addition, the method and system for providing an AlaaS-based anomaly detection service according to one embodiment of the present invention can improve the anomaly detection performance of an anomaly detection model by using an LSTM-VAE model to detect anomalies from training data and training the anomaly detection model based on the data from which the anomalies have been removed.

[0034] In addition, the method and system for providing an AlaaS-based anomaly detection service according to one embodiment of the present invention can improve the performance of an anomaly detection model by combining various pattern parameters to synthesize normal data of various trends to supplement the training data when the training data is insufficient to meet a predetermined threshold, and by using this for the training of the anomaly detection model.

[0035] In addition, the method and system for providing an AlaaS-based anomaly detection service according to one embodiment of the present invention can set an appropriate threshold for anomaly detection by injecting anomalies into input normal data and selecting a threshold for anomaly scores from the overlapping area of ​​the distribution of anomaly scores of normal data and the distribution of anomaly scores of abnormal data into which anomalies have been injected, and accordingly, the performance of the anomaly detection model can be improved.

[0036] Consequently, the method and system for providing an AlaaS-based anomaly detection service according to one embodiment of the present invention have the effect of implementing and providing an anomaly detection system that is significantly improved compared to existing ones.

[0037] However, the effects obtainable from the present invention are not limited to those mentioned above, and other unmentioned effects can be clearly understood from the description below. Brief explanation of the drawing

[0038] FIG. 1 is a conceptual diagram of an AlaaS-based anomaly detection system according to one embodiment of the present invention. FIG. 2 is an internal block diagram of a terminal according to one embodiment of the present invention. FIG. 3 is a conceptual diagram illustrating an anomaly detection model according to one embodiment of the present invention. FIG. 4 is a flowchart illustrating a method for providing an AlaaS-based anomaly detection service according to an embodiment of the present invention. Figure 5 is intended to explain a method for distinguishing between normal data and abnormal data using an LSTM-VAE model according to an embodiment of the present invention. Figure 6 compares the distribution of latent variables of normal data and the distribution of latent variables of abnormal data according to one embodiment of the present invention. FIGS. 7 and 8 illustrate exemplary forms of virtual training time series data of various patterns according to an embodiment of the present invention. FIG. 9 illustrates various exemplary forms of abnormal data generated by injecting various anomaly values ​​into normal data according to one embodiment of the present invention. FIG. 10 is an illustrative diagram for explaining time series data with high variability according to one embodiment of the present invention. FIG. 11 is a flowchart illustrating a method for providing an anomaly detection service based on the variability and multi-scale characteristics of time series data according to an embodiment of the present invention. FIG. 12 is a conceptual diagram illustrating a method for providing an anomaly detection service based on the variability and multi-scale characteristics of time series data according to an embodiment of the present invention. FIG. 13 is a flowchart illustrating a method for providing a time-series data anomaly detection service based on anomaly score change according to an embodiment of the present invention. FIG. 14 is an illustrative diagram for explaining periodic data according to one embodiment of the present invention. FIG. 15 is an illustrative diagram for explaining an anomaly detection result information dashboard according to one embodiment of the present invention. FIG. 16 is a flowchart illustrating a method for providing a time series data anomaly detection service based on the calculation of an anomaly score for inversion data based on the detection of a decline in data trends according to an embodiment of the present invention. FIG. 17 illustrates the form of input data including a section where the trend is declining according to one embodiment of the present invention. FIG. 18 illustrates the form of data in which the trend of input data according to one embodiment of the present invention has reversed the downward section. Specific details for implementing the invention

[0039] The present invention is capable of various modifications and may have various embodiments; therefore, specific embodiments are illustrated in the drawings and described in detail in the detailed description. The effects and features of the present invention, and the methods for achieving them, will become clear by referring to the embodiments described in detail below together with the drawings. However, the present invention is not limited to the embodiments disclosed below but can be implemented in various forms. In the following embodiments, terms such as "first," "second," etc., are used not in a limiting sense but for the purpose of distinguishing one component from another. Furthermore, singular expressions include plural expressions unless the context clearly indicates otherwise. Also, terms such as "include" or "have" mean that the features or components described in the specification exist, and do not preclude the possibility that one or more other features or components may be added. Additionally, in the drawings, the size of components may be exaggerated or reduced for convenience of explanation. For example, the size and thickness of each component shown in the drawings are arbitrarily depicted for convenience of explanation, so the present invention is not necessarily limited to what is illustrated.

[0040] Hereinafter, embodiments of the present invention will be described in detail with reference to the attached drawings. When describing with reference to the drawings, identical or corresponding components are given the same reference numerals, and redundant descriptions thereof will be omitted.

[0042] FIG. 1 is a conceptual diagram of an AlaaS-based anomaly detection system according to one embodiment of the present invention.

[0043] Referring to FIG. 1, an AlaaS-based anomaly detection system (1000) according to an embodiment of the present invention automates the entire process from uploading time-series data to preprocessing, model training, anomaly detection, performance evaluation, and distribution, while simultaneously supporting continuous performance improvement that reflects user feedback. AIaaS-based anomaly detection service It can provide.

[0044] Here, according to the embodiment AIaaS-based anomaly detection service It analyzes the periodicity or variance of time series data and detects outliers by sensing changes in the anomaly score. Time-series data anomaly detection service based on anomaly score change (hereinafter, anomaly score-based anomaly detection service) It may include.

[0045] In addition, according to the embodiment AIaaS-based anomaly detection service It separates data intervals based on the points of change in time series data and detects outliers based on global and local characteristics. Anomaly detection service based on the volatility and multi-scale characteristics of time series data (hereinafter, volatility and scale-based anomaly detection service) It may include.

[0046] In addition, according to the embodiment AIaaS-based anomaly detection service ...for the time series data according to the result of comparing the variation value of the anomaly score of the time series data with a predetermined threshold Dynamically adjusting the window size to perform global and local anomaly detection depending on the situation It may include a time-series data anomaly detection service using a dynamic window.

[0047] In addition, according to the embodiment AIaaS-based anomaly detection service Is, Detect outliers from training time series data using an LSTM-VAE model, and train an anomaly detection model based on the training data from which outliers have been removed. It may include a time-series data anomaly detection service that can improve the anomaly detection performance of the anomaly detection model by doing so.

[0048] Meanwhile, in the embodiment, an AlaaS-based anomaly detection system (1000) implementing an AlaaS-based anomaly detection service may include a terminal (100), an anomaly detection server (200), and a network (300).

[0049] At this time, the terminal (100) and the anomaly detection server (200) can be connected through a network (300).

[0050] Here, the network (300) according to the embodiment refers to a connection structure capable of exchanging information between each node, such as a terminal (100) and / or an anomaly detection server (200).

[0051] Examples of networks (300) include, but are not limited to, 3GPP (3rd Generation Partnership Project) networks, LTE (Long Term Evolution) networks, WIMAX (World Interoperability for Microwave Access) networks, the Internet, LAN (Local Area Network), Wireless LAN (Wireless Local Area Network), WAN (Wide Area Network), PAN (Personal Area Network), Bluetooth networks, satellite broadcasting networks, analog broadcasting networks and / or DMB (Digital Multimedia Broadcasting) networks.

[0052] Hereinafter, a terminal (100) and an anomaly detection server (200) implementing an AlaaS-based anomaly detection system (1000) will be described in detail with reference to the attached drawings.

[0053] - Terminal (100: Terminal)

[0054] A terminal (100) according to an embodiment of the present invention provides an AlaaS-based anomaly detection service. Anomaly detection application (hereinafter, application)This may be a specified computing device installed.

[0055] Specifically, from a hardware perspective, the terminal (100) may include a mobile type computing device (100-1) and / or a desktop type computing device (100-2) on which an application is installed.

[0056] Here, the mobile type computing device (100-1) may be a mobile device with an application installed.

[0057] For example, a mobile type computing device (100-1) may include a smartphone, a mobile phone, a digital broadcasting device, a PDA (personal digital assistants), a PMP (portable multimedia player) and / or a tablet PC, etc.

[0058] Additionally, the desktop type computing device (100-2) may be a wired / wireless communication-based device with an application installed.

[0059] For example, a desktop type computing device (100-2) may include a personal computer such as a fixed desktop PC, a laptop computer and / or an ultrabook.

[0060] According to an embodiment, the terminal (100) may further include a predetermined server computing device that provides an AlaaS-based anomaly detection service environment.

[0061] FIG. 2 is an internal block diagram of a terminal (100) according to one embodiment of the present invention.

[0062] Meanwhile, referring to FIG. 2, from a functional perspective, the terminal (100) may include a memory (110), a processor assembly (120), a communication processor (130), an interface unit (140), an input system (150), a sensor system (160), and a display system (170). In an embodiment, the terminal (100) may include the above components within a housing.

[0063] In detail, Memory (110) It can store the application (111).

[0064] At this time, the application (111) can store one or more of various applications, data, and commands for providing an AlaaS-based anomaly detection service environment.

[0065] That is, the memory (110) can store commands and data that can be used to create an AlaaS-based anomaly detection service environment.

[0066] Additionally, the memory (110) may include a program area and a data area.

[0067] Here, the program area according to the embodiment can be linked between the operating system (OS) and functional elements that boot the terminal (100).

[0068] In addition, the data area according to the embodiment may store data generated by the use of the terminal (100).

[0069] Additionally, the memory (110) may include at least one non-transient computer-readable storage medium and a transient computer-readable storage medium.

[0070] For example, the memory (110) may be various storage devices such as ROM, EPROM, flash drive, hard drive, etc., and may include web storage that performs the storage function of the memory (110) on the internet.

[0071] processor assembly (120) It may include at least one processor capable of executing instructions of an application (111) stored in memory (110) to perform various tasks for creating an AlaaS-based anomaly detection service environment.

[0072] In an embodiment, the processor assembly (120) can control the overall operation of the components through an application (111) of the memory (110) to provide an AlaaS-based anomaly detection service.

[0073] Specifically, the processor assembly (120) may be a system-on-chip (SOC) suitable for a terminal (100) including a central processing unit (CPU) and / or a graphics processing unit (GPU), etc.

[0074] Additionally, the processor assembly (120) can execute an operating system (OS) and / or applications stored in memory (110).

[0075] Additionally, the processor assembly (120) can control each component mounted on the terminal (100).

[0076] Additionally, the processor assembly (120) can communicate internally with each component via a system bus and may include one or more predetermined bus structures, including a local bus.

[0077] Additionally, the processor assembly (120) may be implemented by including at least one of ASICs (application specific integrated circuits), DSPs (digital signal processors), DSPDs (digital signal processing devices), PLDs (programmable logic devices), FPGAs (field programmable gate arrays), controllers, microcontrollers, microprocessors, and / or other electrical units for performing functions.

[0078] The communication processor (130) It may include one or more devices for communicating with an external device. Such a communication processor (130) may communicate via a wireless network.

[0079] Specifically, the communication processor (130) can communicate with a terminal (100) that stores a content source for implementing an AlaaS-based anomaly detection service environment.

[0080] Additionally, the communication processor (130) can communicate with various user input components, such as a controller that receives user input.

[0081] In an embodiment, the communication processor (130) can transmit and receive various data related to an AlaaS-based anomaly detection service to other terminals (100) and / or external servers, etc.

[0082] This communication processor (130) can wirelessly transmit and receive data with at least one of a base station, an external terminal (100), and any server on a mobile communication network built through a communication device capable of performing technical standards or communication methods for mobile communication (e.g., LTE (Long Term Evolution), LTE-A (Long Term Evolution-Advanced), 5G NR (New Radio), WIFI) or short-range communication methods.

[0083] Sensor system (160) It may include various sensors such as an image sensor (161), a position sensor (IMU, 163), an audio sensor (165), a distance sensor, a proximity sensor, and a contact sensor.

[0084] Here, the image sensor (161) can capture an image (image and / or video, etc.) of the physical space around the terminal (100).

[0085] Specifically, the image sensor (161) can capture a predetermined physical space through a camera positioned facing the outside of the terminal (100).

[0086] In an example, the image sensor (161) is positioned on the front and / or rear of the terminal (100) and can capture the physical space on the side of the positioned direction.

[0087] In an embodiment, the image sensor (161) can capture and acquire various images related to an AlaaS-based anomaly detection service.

[0088] Such an image sensor (161) may include an image sensor device and an image processing module.

[0089] Specifically, the image sensor (161) can process still images or video obtained by an image sensor device (e.g., CMOS or CCD).

[0090] Additionally, the image sensor (161) can process a still image or video obtained through the image sensor device using an image processing module to extract necessary information and transmit the extracted information to a processor.

[0091] This image sensor (161) may be a camera assembly including at least one camera.

[0092] Here, the camera assembly may include a general camera that captures the visible light band, and may further include special cameras such as an infrared camera and a stereo camera.

[0093] Additionally, the above image sensor (161) may be included in and operated by the terminal (100) according to the embodiment, or it may be included in an external device (e.g., an external server, etc.) and operated through interlocking based on the communication processor (130) and / or interface unit (140) described above.

[0094] Position sensor (IMU, 163) It can detect at least one of the movement and acceleration of the terminal (100). For example, it can be made of a combination of various position sensors such as an accelerometer, a gyroscope and / or a magnetometer.

[0095] Additionally, the location sensor (IMU, 163) can recognize spatial information about the physical space around the terminal (100) by linking with a location communication processor (130), such as a GPS of the communication processor (130).

[0096] Audio sensor (165) It can recognize sounds around the terminal (100).

[0097] Specifically, the audio sensor (165) may include a microphone capable of detecting voice input from a user using the terminal (100).

[0098] In the embodiment, the audio sensor (165) can receive voice data required for an AlaaS-based anomaly detection service from the user.

[0099] Interface part (140) The terminal (100) can be connected to communicate with one or more other devices.

[0100] Specifically, the interface section (140) may include a wired and / or wireless communication device compatible with one or more different communication protocols.

[0101] Through this interface section (140), the terminal (100) can be connected to various input / output devices.

[0102] For example, the interface unit (140) can be connected to an audio output device, such as a headset port or a speaker, to output audio.

[0103] Although it has been described as an example in which an audio output device is connected through an interface unit (140), an embodiment in which it is installed inside a terminal (100) may also be included.

[0104] Additionally, for example, the interface unit (140) may be connected to an input device such as a keyboard and / or mouse to obtain user input.

[0105] This interface section (140) may be configured to include at least one of a wired / wireless headset port, an external charger port, a wired / wireless data port, a memory card port, a port for connecting a device equipped with an identification module, an audio I / O (Input / Output) port, a video I / O (Input / Output) port, an earphone port, a power amplifier, an RF circuit, a transceiver, and other communication circuits.

[0106] Input system (150) It can detect user input (e.g., gestures, voice commands, button operation, or other types of input) related to the AlaaS-based anomaly detection service.

[0107] Specifically, the input system (150) may include a predetermined button, a touch sensor and / or an image sensor (161) that receives user motion input.

[0108] Additionally, the input system (150) can be connected to an external controller through the interface unit (140) to receive user input.

[0109] Display system (170) It can output various information related to the AlaaS-based anomaly detection service as a graphic image.

[0110] In an example, the display system (170) can display various user interfaces, images and / or text, etc. for an AlaaS-based anomaly detection service.

[0111] Such displays may include, but are not limited to, at least one of a liquid crystal display (LCD), a thin film transistor-liquid crystal display (TFT LCD), an organic light-emitting diode (OLED), a flexible display, a 3D display, and / or an e-ink display.

[0112] In addition, according to the embodiments Display system (170) It may include a display (171) that outputs an image and a touch sensor (173) that detects user touch input.

[0113] For example, the display (171) can be implemented as a touch screen by forming a layered structure with the touch sensor (173) or by being formed integrally.

[0114] This touch screen functions as a user input unit that provides an input interface between the terminal (100) and the user, and at the same time can provide an output interface between the terminal (100) and the user.

[0115] Meanwhile, the terminal (100) according to an embodiment of the present invention can perform deep learning related to an AlaaS-based anomaly detection service based on a predetermined deep-learning neural network.

[0116] Here, the deep learning neural network according to the embodiment is Logistic Regression, Decision Tree, Random Forest, Gradient Boosting, DNN. Isolation Forest, K-means, One-Class SVM, Autoencoder, LSTM, LSTM-VAE, Semi-Supervised Anomaly Detection, Global-Local Hybrid Anomaly Detector, Label-Propagated Clustering Anomaly Detection, Hybrid Isolation Forest with Autoencoder, Supervised-Unsupservised Hybrid Model, Hybrid LSTM-VAE Anomaly Detector, CNN(Convolution Neural Network, CNN), DPSNet (Deep Plane Sweep Network, DPSNet), PSPNet (Pyramid Scene Parsing Network), AGN (Attention Guided Network, AGN), R-CNN (Regions with CNN features), Fast R-CNN, Faster R-CNN, Mask R-CNN, DualStyleGAN, DeepLab (v2, v3, v3+), SegNet, U-Net, AlexNet, VGGNet, It may include ResNet (Residual Network) and / or EfficientNet network, etc. It is not limited.

[0117] In the embodiment, the terminal (100) can perform deep learning, such as anomaly detection, by linking with a predetermined deep learning neural network as described above.

[0118] On the other hand, according to an embodiment, the terminal (100) may further perform at least some of the functional operations performed by the anomaly detection server (200) described later.

[0119] - Anomaly Detection Server (200: Anomaly Detection Server)

[0120] Meanwhile, the anomaly detection server (200) according to an embodiment of the present invention can perform a series of processes to provide an AlaaS-based anomaly detection service.

[0121] In detail, in the embodiment, the anomaly detection server (200) can provide an AlaaS-based anomaly detection service by exchanging data necessary to run an AlaaS-based anomaly detection service process with an external device, such as a terminal (100).

[0122] More specifically, in the embodiment, the outlier detection server (200) can provide an environment in which an application (111) can operate on an external device (in the embodiment, a mobile type computing device (100-1) and / or a desktop type computing device (100-2), etc.).

[0123] To this end, the anomaly detection server (200) may include an application program, data and / or commands, etc., for the application (111) to operate, and may transmit and receive various data based thereon with the external device.

[0124] In addition, in the embodiment, the anomaly detection server (200) can perform deep learning required for an AlaaS-based anomaly detection service based on a predetermined deep-learning neural network.

[0125] In an example, the anomaly detection server (200) can perform deep learning, such as anomaly detection, by linking with a predetermined deep learning neural network.

[0126] Specifically, in the embodiment, the outlier detection server (200) can read a predetermined deep learning neural network driving program built to perform the deep learning from the memory module (230).

[0127] And the anomaly detection server (200) can perform deep learning required for an AlaaS-based anomaly detection service according to a predetermined deep learning neural network system.

[0128] Here, the deep learning neural network according to the embodiment is Logistic Regression, Decision Tree, Random Forest, Gradient Boosting, DNN. Isolation Forest, K-means, One-Class SVM, Autoencoder, LSTM, LSTM-VAE, Semi-Supervised Anomaly Detection, Global-Local Hybrid Anomaly Detector, Label-Propagated Clustering Anomaly Detection, Hybrid Isolation Forest with Autoencoder, Supervised-Unsupservised Hybrid Model, Hybrid LSTM-VAE Anomaly Detector, CNN(Convolution Neural Network, CNN), DPSNet (Deep Plane Sweep Network, DPSNet), PSPNet (Pyramid Scene Parsing Network), AGN (Attention Guided Network, AGN), R-CNN (Regions with CNN features), Fast R-CNN, Faster R-CNN, Mask R-CNN, DualStyleGAN, DeepLab (v2, v3, v3+), SegNet, U-Net, AlexNet, VGGNet, It may include ResNet (Residual Network) and / or EfficientNet network, etc. It is not limited.

[0129] At this time, depending on the embodiment, the deep learning neural network may be directly included in the outlier detection server (200) or implemented as a separate device and / or server from the outlier detection server (200).

[0130] In the following description, it is explained that a deep learning neural network is included and implemented in the outlier detection server (200), but it is not limited thereto.

[0131] Additionally, in the embodiment, the anomaly detection server (200) can store and manage various applications, commands and / or data, etc., for implementing an AlaaS-based anomaly detection service.

[0132] However, in the embodiment of the present invention, the functional operations that the anomaly detection server (200) can perform are not limited to those described above, and other functional operations may also be performed.

[0133] Meanwhile, referring further to FIG. 1, in the embodiment, the anomaly detection server (200) may be implemented as a predetermined computing device comprising at least one processor module (210) for data processing, at least one communication module (220) for exchanging data with an external device, and at least one memory module (230) for storing various applications, data and / or instructions for providing an AlaaS-based anomaly detection service.

[0134] Here, memory module (230) It can store one or more of an operating system (OS), various applications, data, and commands to provide an AlaaS-based anomaly detection service.

[0135] Additionally, the memory module (230) may include a program area and a data area.

[0136] At this time, the program area according to the embodiment can be linked between the operating system (OS) that boots the server and functional elements.

[0137] In addition, the data area according to the embodiment may store data generated as a result of server usage.

[0138] Additionally, the memory module (230) may be various storage devices such as ROM, RAM, EPROM, flash drive, hard drive, etc., and may also be web storage that performs the storage function of the memory module (230) on the internet.

[0139] Additionally, the memory module (230) may be a recording medium that is detachable on the server.

[0140] one side, processor module (210) ...can control the overall operation of each of the aforementioned units to implement an AlaaS-based anomaly detection service.

[0141] Specifically, the processor module (210) may be a system-on-chip (SOC) suitable for a server including a central processing unit (CPU) and / or a graphics processing unit (GPU), etc.

[0142] Additionally, the processor module (210) can execute an operating system (OS) and / or applications stored in the memory module (230).

[0143] In addition, the processor module (210) can control each component mounted on the server.

[0144] Additionally, the processor module (210) can communicate internally with each component via a system bus and may include one or more predetermined bus structures, including a local bus.

[0145] Additionally, the processor module (210) may be implemented using at least one of ASICs (application specific integrated circuits), DSPs (digital signal processors), DSPDs (digital signal processing devices), PLDs (programmable logic devices), FPGAs (field programmable gate arrays), controllers, microcontrollers, microprocessors, and / or other electrical units for performing functions.

[0146] In the above description, it has been explained that the anomaly detection server (200) according to an embodiment of the present invention performs functional operations as described above. However, depending on the embodiment, at least a portion of the functional operations performed by the anomaly detection server (200) may be performed by an external device (e.g., a terminal (100), etc.), and at least a portion of the functional operations performed by the external device may be further performed by the anomaly detection server (200), and various other embodiments may be possible.

[0147] - Anomaly Detection Model (ADM)

[0148] According to an embodiment of the present invention Anomaly Detection Model (ADM) It may refer to a deep learning-based artificial intelligence (AI) model that automatically detects abnormal data patterns (i.e., outliers or anomalies) that differ from a predetermined normal data pattern.

[0149] For reference, outliers (or anomalies) here refer to observations that differ significantly from normal patterns or have a low statistical probability of occurrence.

[0150] In the embodiments, such anomaly detection models (ADM) may include, depending on the model learning method, a supervised learning-based anomaly detection model (SLM: hereinafter, supervised learning model), an unsupervised learning-based anomaly detection model (ULM: hereinafter, unsupervised learning model), and / or a supervised and unsupervised learning-based anomaly detection model (HBM: hereinafter, hybrid model), etc.

[0151] Here, the Supervised Learning Model (SLM) according to the embodiment may be a model that is trained based on labeled data to distinguish between normal and abnormal data.

[0152] For example, supervised learning models (SLMs) may include Logistic Regression, Decision Tree, Random Forest, Gradient Boosting, and / or DNN.

[0153] Meanwhile, the unsupervised learning model (ULM) according to the embodiment may be a model that is trained based on unlabeled data and detects outliers based on the distribution and / or density analysis of the data.

[0154] For example, unsupervised learning models (ULM) may include Isolation Forest, K-means, One-Class SVM, Autoencoder and / or LSTM-VAE, etc.

[0155] On the other hand, the hybrid model (HBM) according to the embodiment is a model that combines a supervised learning model (SLM) and an unsupervised learning model (ULM), and may be a model that is trained using supervised learning for some data that has labels and trained using unsupervised learning for some data that does not have labels.

[0156] This hybrid model (HBM) is trained in a form that combines supervised and unsupervised learning and can detect the aforementioned outliers.

[0157] For example, the hybrid model (HBM) may include Semi-Supervised Anomaly Detection, Global-Local Hybrid Anomaly Detector, Label-Propagated Clustering Anomaly Detection, Hybrid Isolation Forest with Autoencoder, Supervised-Unsupservised Hybrid Model and / or Hybrid LSTM-VAE Anomaly Detector.

[0158] In another aspect, the anomaly detection model (ADM) may include a relatively lightweight anomaly detection model (LM: hereinafter referred to as the light model) and / or a relatively high-performance anomaly detection model (HM: hereinafter referred to as the heavy model), depending on computational complexity, data characteristics (e.g., whether it is a time series, data size, number of features, etc.) and / or resource requirements (e.g., GPU and / or CPU usage, etc.).

[0159] Here, the Light Model (LM) according to the embodiment may be a model characterized by fast computation speed and low resource consumption based on a relatively simple algorithm. That is, the Light Model (LM) may be an efficient model in terms of cost.

[0160] For example, light models (LMs) may include Isolation Forest, Logistic Regression, K-means Clustering and / or Decision Tree, etc.

[0161] On the other hand, the Heavy Model (HM) according to the embodiment may be a model that supports relatively complex data pattern recognition, non-linear relationship learning, and high-dimensional data analysis. That is, the Heavy Model (HM) may be an effective model in terms of performance.

[0162] For example, a heavy model (HM) may include deep learning models based on LSTM, LSTM-VAE, Autoencoder and / or Transformer.

[0163] In the embodiments, the light model (LM) and heavy model (HM) described above may operate as a supervised learning model (SLM), an unsupervised learning model (ULM), or a hybrid model (HBM), depending on the characteristics of the given data and / or the purpose of the model.

[0164] In this case, depending on the embodiment, the light model (LM) and the heavy model (HM) may be combined in parallel or in series to operate in a hybrid model (HBM) manner, according to the characteristics of the given data and / or the purpose of the model.

[0166] - Method of providing AIaaS-based anomaly detection services

[0167] Hereinafter, a method for an application (111) executed by at least one processor of a terminal (100) according to an embodiment of the present invention to provide an AlaaS-based anomaly detection service will be described in detail with reference to the attached drawings.

[0168] In an embodiment of the present invention, at least one processor of the terminal (100) may execute at least one application (111) stored in at least one memory (110) or operate in a background state.

[0169] Hereinafter, at least one processor of the terminal (100) operates to execute the instructions of the application (111) to perform a method of providing an AlaaS-based anomaly detection service, which is described in a shortened manner as being performed by the application (111).

[0170] FIG. 4 is a flowchart illustrating a method for providing an AlaaS-based anomaly detection service according to an embodiment of the present invention.

[0171] Referring to FIG. 4, in the embodiment, an application (111) that is executed by at least one processor of the terminal (100) or operates in a background state is, Training data can be obtained. (S101)

[0172] Specifically, in the embodiment, the application (111) can obtain training data (hereinafter, training target data) that supports model learning for a target for which anomaly detection is to be performed.

[0173] In an example, the application (111) can obtain training target data through user input, cloud storage (e.g., AWS S3, GCP Storage, Azure Blob Storage, etc.) and / or database (e.g., API, RDBMS, etc.) integration.

[0174] In this case, in the embodiment, the application (111) supports various file formats (e.g., CSV, Excel, Parquet, JSON, etc.) so that various types of data sources can be used as training target data.

[0175] Additionally, in the embodiment, the application (111) can check the data type and content within the acquired training target data.

[0176] In an example, the application (111) can automatically recognize the column name, data type (e.g., int, float, string, etc.) and / or data distribution for each data in the acquired training target data.

[0177] According to an embodiment, the application (111) can automatically generate statistical information for each column of the data (e.g., minimum value, maximum value, average, median, missing value ratio, etc.) to more clearly identify the characteristics of the data.

[0178] In this case, in the embodiment, when the application (111) acquires training target data based on user input, it may provide a user interface (hereinafter referred to as a training data editing interface) that supports an editing function for the training target data uploaded through user input.

[0179] In detail, in an embodiment, the application (111) can output at least a portion of the training target data through a training data editing interface.

[0180] That is, the application (111) can visualize at least a portion of the training target data so that the user can easily recognize the structure and content of the entire data.

[0181] In an example, the application (111) can visualize and provide training target data using various visualization tools such as line charts, bar charts and / or histograms.

[0182] Additionally, in the embodiment, the application (111) can update training target data based on user input based on the training data editing interface.

[0183] For example, the application (111) can obtain user input through the training data editing interface to perform editing functions such as modifying data column values, converting data types, deleting unnecessary features (columns) and / or adding new features (columns), and can update the corresponding training target data accordingly.

[0184] As such, in the embodiment, the application (111) can acquire training target data in various ways and automatically analyze it, and can update the training target data in a form optimized for user needs according to user settings.

[0185] Therefore, the application (111) can implement user-customized training target data while simultaneously ensuring quality and reliability therefor.

[0186] In addition, an application (111) according to one embodiment of the present invention is, The acquired training data can be preprocessed. (S103)

[0187] Specifically, in the embodiment, the application (111) can perform various data preprocessing to improve the accuracy of model learning and improve data quality based on the training target data obtained as above.

[0188] More specifically, in the embodiment, the application (111) handles missing data values, data normalization / scaling, Data Outlier Processing , Data Feature Engineering Data preprocessing for training target data can be performed using various data preprocessing methods, including and / or data augmentation and synthesis.

[0189] As a specific embodiment, the application (111) can 1) perform data preprocessing based on missing value processing.

[0190] In detail, in the embodiment, the application (111) can detect missing values ​​in the training target data in a predetermined manner (e.g., by utilizing deep learning neural networks and / or statistical methodologies).

[0191] Additionally, the application (111) can provide the detected missing values ​​to the user in a predetermined manner.

[0192] In an example, the application (111) can generate and output data that visually displays missing values ​​(hereinafter, missing value visualization data) and provide the missing values ​​to the user.

[0193] For example, in the embodiment, missing value visualization data may be visualized and displayed in a predetermined format (e.g., heatmap, graph and / or chart, etc.), such as location information of missing values, column information containing missing values, and / or missing value ratio information.

[0194] Additionally, the application (111) may provide a user interface (hereinafter referred to as a missing value processing interface) that allows selecting a method for processing missing values.

[0195] In an example, the application (111) may provide a missing value processing interface that can select any one of various missing value processing methods, including missing value removal, mean replacement, median replacement, linear interpolation, forward / backward fill and / or prediction-based replacement (i.e., replacement with a predicted value using a deep learning model).

[0196] Additionally, the application (111) can perform data processing for the missing value according to the missing value processing method selected based on user input based on the missing value processing interface.

[0197] For example, the application (111) can perform data processing to delete columns and / or rows containing missing values ​​when a missing value removal method is selected by user input.

[0198] In another example, the application (111) can perform data processing to replace the missing value with the average value of the data in the column containing the missing value when an average replacement method is selected based on user input.

[0199] In this case, in the embodiment, the application (111) can record all work details of the missing value processing process as a change log.

[0200] Here, the change log according to the embodiment may include various data generated as a result of performing missing value processing, such as a missing value processing method, column names of processed data, processing time, applied replacement values ​​and / or ratios of removed data.

[0201] Through this, the application (111) can further support post-processing functions, such as restoring data to a previous state or tracking the processing history of the data as needed.

[0202] In addition, in the embodiment, the application (111) can provide training target data reflecting the missing value processing results as described above to the user according to a predetermined method.

[0203] In an example, the application (111) can generate and provide information (hereinafter, missing value processing summary report) that provides the results of missing value processing and the changes thereto.

[0204] In a specific embodiment, the application (111) can visualize various data according to the change log described above to generate a missing value processing summary report and provide the generated missing value processing summary report by displaying it.

[0205] Therefore, the application (111) can enable the user to more intuitively and clearly perceive the data preprocessing results and quality.

[0206] In another embodiment, the application (111) can perform 2) data preprocessing based on data normalization and scaling.

[0207] In detail, in the embodiment, the application (111) can perform normalization and scaling on all columns in the training target data in a predetermined manner (e.g., by combining a deep learning neural network and / or utilizing statistical methodologies).

[0208] In this case, in the embodiment, the application (111) may provide a user interface (hereinafter, normalization and scaling processing interface) that can select a predetermined normalization and scaling method.

[0209] In an example, the application (111) may provide a normalization and scaling processing interface that can select any one of various normalization and scaling methods, including Min-Max normalization, Z-score standardization and / or RobustScaler.

[0210] Additionally, the application (111) can perform normalization and scaling on all columns in the training target data according to the normalization and scaling method selected based on user input based on the normalization and scaling processing interface.

[0211] For example, the application (111) can perform data processing to convert the values ​​of all columns into a range between 0 and 1 when a Min-Max normalization method is selected by user input.

[0212] As another example, the application (111) can perform data processing by subtracting the mean according to all data from the value of each data in the training target data and dividing by the standard deviation when the Z-score standardization method is selected.

[0213] As another example, the application (111) can perform scaling processing that minimizes the impact of extreme outliers (anomaly) by utilizing the Interquartile Range (IQR) based on the median of the data within the training target data when the RobustScaler method is selected.

[0214] In this case, in the embodiment, the application (111) can record all work details of the normalization and scaling process as a change log.

[0215] Here, the change log according to the embodiment may include various data generated as a result of performing normalization and scaling processing, such as normalization / scaling method, processed column name, processing time, information on the minimum / maximum value of the converted data and / or the ratio of the value of the previous data to the changed data.

[0216] These change logs can be utilized as a tool to review data processing and, if necessary, can support functional operations such as data restoration and / or tracking of processing history.

[0217] In addition, in the embodiment, the application (111) can provide training target data reflecting the results of the normalization and scaling processing as described above to the user according to a predetermined method.

[0218] In an example, the application (111) can generate and provide information (hereinafter referred to as the normalization and scaling processing summary report) that provides the results of the normalization and scaling processing and the changes therefrom.

[0219] In a specific embodiment, the application (111) can visualize various data according to the change log described above to generate a normalization and scaling processing summary report, and provide the generated normalization and scaling processing summary report by displaying it.

[0220] Therefore, the application (111) can support the user's intuitive review of the data preprocessing results and improve the quality of the data preprocessing based on visual comparison.

[0221] In another embodiment, the application (111) can perform 3) data preprocessing based on data outlier processing.

[0222] Specifically, in the embodiment, the application (111) can improve the anomaly detection performance of the anomaly detection model by detecting anomalies from the acquired training data and removing them, thereby enabling the anomaly detection model to learn based on training data composed of normal data.

[0223] Since the data targeted for anomaly detection contains an overwhelmingly larger amount of normal data compared to anomaly data, there is often a severe imbalance between normal and anomaly data. In such situations, to ensure reliable anomaly detection performance, an approach is known that performs anomaly detection using an anomaly detection model trained on training data containing only normal data.

[0224] To this end, as a method for distinguishing abnormal data from normal data, there is a method of utilizing a restoration-based anomaly detection model (e.g., LSTM-Autoencoder) trained on an input dataset that includes both normal and abnormal data.

[0225] However, this method is based on a approach that removes data falling within a specific range by considering it abnormal based on the average of the restoration error and the standard deviation of the error change over the learning period (epoch). Since it uses data containing both normal and abnormal data as training data and repeats the learning process until the learning error converges to a specific value, it has the problem of significantly increasing the required time when the amount of data is large, such as with time series data.

[0226] One embodiment can provide a data outlier processing method that can distinguish between normal data and abnormal data from input data with only a relatively small number of training cycles, instead of aiming for convergence of the restoration error by utilizing an LSTM-VAE (Variational Autoencoder) model.

[0227] For example, the application (111) can distinguish between normal data and abnormal data included in the training data by using an LSTM-VAE model to compare the distribution of latent variables of normal data and abnormal data, respectively.

[0228] In this case, the LSTM-VAE model can be trained so that the latent variables of normal data follow a normal distribution, and the latent variables of abnormal data follow a distribution different from the normal distribution.

[0229] For example, referring to Fig. 5, the LSTM-VAE model can receive normal data and abnormal data as input and generate a latent variable (Z) that follows a predetermined distribution for each data.

[0230] The application (111) can distinguish between the two data by comparing the distribution shape of the latent variable for normal data and the distribution shape of the latent variable for abnormal data, and based on this, can remove the abnormal data from the training data.

[0231] For example, referring to (A) in Fig. 6, the shape of the first distribution (ND1) of the latent variable of the first normal data follows a normal distribution, but the shape of the second distribution (AD1) of the latent variable of the first abnormal data may deviate significantly from a normal distribution.

[0232] Additionally, referring to (B) of Fig. 6, the shape of the third distribution (ND2) of the latent variable of the second normal data follows a normal distribution, but the shape of the fourth distribution (AD2) of the latent variable of the second abnormal data may deviate significantly from a normal distribution.

[0233] As such, the distribution of latent variables generated by the LSTM-VAE model based on normal data and the distribution of latent variables generated based on abnormal data may have different forms.

[0234] Based on these characteristics, the application (111) can generate a target latent variable of the input time series data using an LSTM-VAE model, and if the shape of the distribution of the target latent variable is similar to the shape of the distribution of the latent variable generated based on the abnormal data, the time series data can be determined as abnormal data.

[0235] In this case, the application (111) can calculate the similarity between the shape of the distribution of the target latent variable and the shape of the distribution of the latent variable generated based on abnormal data, and if this similarity is greater than or equal to a predetermined threshold, it can determine that the shapes of the two distributions are similar.

[0236] Additionally, the application (111) can provide the detected abnormal data to the user in a predetermined manner.

[0237] In an example, the application (111) can generate and output data that visually displays abnormal data (hereinafter, anomaly visualization data) and provide the abnormal data to the user.

[0238] For example, in the embodiment, anomaly visualization data may be visualized and displayed in a predetermined format (e.g., heatmap, graph and / or chart, etc.), such as location information of the anomaly, column information containing the anomaly, and / or anomaly ratio information.

[0239] In this case, in the embodiment, the application (111) can record all work details of the processing process for distinguishing between normal data and abnormal data as a change log.

[0240] Here, the change log according to the embodiment may include various data generated as a result of performing abnormal data processing, such as the abnormal data processing method, the column name of the processed data, the processing time, and the ratio of removed abnormal data.

[0241] In addition, in the embodiment, the application (111) can provide training target data reflecting the abnormal data processing results as described above to the user according to a predetermined method.

[0242] In an example, the application (111) can generate and provide information (hereinafter referred to as an abnormal data processing summary report) that provides guidance on the abnormal data processing results and changes therefrom.

[0243] In a specific embodiment, the application (111) can generate an abnormal data processing summary report by visualizing various data according to the change log described above, and provide the generated abnormal data processing summary report by displaying it.

[0244] In another embodiment, the application (111) is 4 Data preprocessing based on data augmentation and synthesis can be performed.

[0245] In detail, in an embodiment, the application (111) can generate virtual training data when it is determined that the acquired training data is insufficient to meet a predetermined threshold.

[0246] Virtual training data can be generated to include normal data with various trends. This is because if an anomaly detection model is trained on data containing outliers, its anomaly detection performance may degrade.

[0247] In this case, the virtual training data can be generated to include normal data, such as patterns where trends do not change abruptly, or patterns that do not vary significantly globally or locally.

[0248] For example, usage fee data based on the billing policy for users of cloud services can be generated through simulation.

[0249] Referring to Fig. 7, various patterns of usage fee data can be generated by setting various patterns in which the user repeatedly uses or does not use the service.

[0250] In this case, when generating usage fee data, the user's service usage pattern can be formed by combining five parameters such as random, increase, decrease, maintenance, and non-use compared to the previous day, and virtual usage fee data can be generated by assigning various probability values ​​to each parameter.

[0251] For example, referring to Fig. 8, virtual usage fee data showing various patterns can be generated depending on the case where a probability value of [1, 0, 0, 0, 0] is assigned for random, increase, decrease, maintain, and non-use (A), the case where a probability value of [0, 0, 0, 0.5, 0.5] is assigned (B), and the case where a probability value of [0.2, 0.2, 0.2, 0.2, 0.2] is assigned (C).

[0252] At this time, in the embodiment, the application (111) can provide a user interface (hereinafter, a data generation interface) capable of generating various types of virtual training data.

[0253] In an example, the application (111) may provide a data generation interface that can input a plurality of data values ​​constituting virtual training data and input various probability values ​​for patterns of virtual training data.

[0254] Additionally, the application (111) can provide the generated virtual training data to the user in a predetermined manner.

[0255] In an example, the application (111) can generate and output data that visually displays the generated virtual training data (hereinafter, visualization data for virtual data) and provide the virtual training data to the user.

[0256] For example, in the embodiment, visualization data for virtual data can be displayed by visualizing it, such as a graph representing the pattern of the virtual data or a structured table of column information of the virtual data.

[0257] At this time, in the embodiment, the application (111) can record all work details of the process of generating virtual training data as a change log.

[0258] Here, the change log according to the embodiment may include various data generated as virtual training data is created, such as a method for creating virtual training data, a pattern of the created virtual training data, and a time of creation.

[0259] In another embodiment, the application (111) is 5 To find an appropriate threshold for calculating an anomaly score, data preprocessing based on anomaly injection into normal data can be performed.

[0260] The anomaly score is an indicator that contains information on how much a given data value deviates from normal data values.

[0261] The anomaly score can be determined based on the difference between the data value and the baseline. The baseline can be, for example, a statistical characteristic value of the data within the anomaly detection range (e.g., mean, median, etc.).

[0262] A data value is determined to be an anomaly based on whether its anomaly score exceeds a certain threshold.

[0263] In this case, if the threshold for determining anomalies is too small, false positives may occur where normal data is identified as anomalies; conversely, if the threshold is too large, missed detections may occur where abnormal data is not detected. Accordingly, it is necessary to set an appropriate threshold for the anomaly score to ensure accurate anomaly detection.

[0264] To this end, the application (111) can select an appropriate threshold by comparing the distribution of anomaly scores for normal data and the distribution of anomaly scores for abnormal data.

[0265] For example, an appropriate threshold can be selected in the overlapping region of the distribution of anomaly scores for normal data and the distribution of anomaly scores for abnormal data.

[0266] In this case, the abnormal data required to calculate the distribution of anomaly scores for abnormal data can be generated by injecting anomalies into normal data.

[0267] For example, referring to Fig. 9, global anomaly data can be generated by injecting anomaly values ​​that deviate significantly from the normal range in the entire time series of normal data into normal data (Origin), contextual anomaly data can be generated by injecting anomaly values ​​that have slight anomalies when considering adjacent time series data, or trend anomaly data can be generated by injecting anomaly values ​​that indicate changes in flow that increase or decrease over the long term into normal data.

[0268] As described above, in the embodiment, the application (111) provides a workflow that supports preprocessing of training target data based on user interaction, thereby enabling user-customized data preprocessing and simultaneously improving the quality of the training target data by reflecting human cognitive judgment.

[0269] In addition, an application (111) according to one embodiment of the present invention is, An anomaly detection model (ADM) can be determined. (S105)

[0270] Specifically, in an embodiment, the application (111) can determine an anomaly detection model (hereinafter, anomaly detection target model) that is trained based on training target data to perform anomaly detection.

[0271] More specifically, in the embodiment, the application (111) can determine an anomaly detection model (ADM) optimized for the characteristics of the given data among various types of anomaly detection models (ADM) as the anomaly detection target model.

[0272] In an example, the application (111) may determine an anomaly detection model (ADM) that is judged to be most suitable for a given data characteristic among various forms of anomaly detection models (ADM), such as the aforementioned supervised learning model (SLM), unsupervised learning model (ULM), hybrid model (HBM), light model (LM) and / or heavy model (HM), as the anomaly detection target model.

[0273] In a specific embodiment, the application (111) can determine an anomaly detection target model based on the characteristics of the training target data.

[0274] In detail, in an embodiment, the application (111) can automatically determine the most suitable anomaly detection target model for the corresponding characteristics based on data features, data variance, data patterns (e.g., whether it is time series data, seasonality, periodicity, etc.) and / or the presence or absence of data labels (i.e., whether supervised learning is possible), etc., according to the training target data.

[0275] More specifically, as an example, the application (111) can analyze data variables, data variance, data patterns and / or the presence or absence of data labels according to the training target data.

[0276] Additionally, in the embodiment, the application (111) can filter and determine applicable anomaly detection models (ADM) based on the analysis results.

[0277] For example, the application (111) can determine an anomaly detection target model using a meta-model trained to select either a light model (LM) or a heavy model (HM) based on the variance size and / or complexity of the pattern of the training target data.

[0278] A meta-model is a model that learns which anomaly detection model (ADM) performs well in anomaly detection for a given data type, and can determine the anomaly detection model (ADM) based on information regarding the variance size and / or complexity of the patterns of the input data.

[0279] Metamodels may include various neural network model structures, such as multilayer perceptrons (MLPs), graph neural networks (GNNs), LSTMs, and transformers.

[0280] For example, the application (111) can use a data analysis module (not shown) to calculate the variance size and / or complexity of the pattern of the training target data.

[0281] Data on the variance size and / or pattern complexity of the training target data can be input into the metamodel as training data.

[0282] If the variance of the training target data is greater than a predetermined threshold or the complexity of the pattern is greater than a predetermined threshold, the meta-model can be trained to determine the heavy model (HM) as the anomaly detection model (ADM). Here, the heavy model (HM) may include, for example, a Transformer-based 'Anomaly Transformer model'.

[0283] In addition, if the variance of the training target data is below a predetermined threshold or the complexity of the pattern is below a predetermined threshold, the meta-model can be trained to determine the light model (LM) as the anomaly detection model (ADM). Here, the light model (LM) may include, for example, an 'LTSF-Linear model'.

[0284] Additionally, for example, if the application (111) has data with clear labels for normal / abnormal, it may determine a specific supervised learning model (SLM), such as Logistic Regression, Decision Tree, Random Forest, Gradient Boosting and / or DNN, as an anomaly detection target model.

[0285] As another example, the application (111) may determine a certain unsupervised learning model (ULM), such as Isolation Forest, K-means Clustering, One-Class SVM, Autoencoder, LSTM-VAE, etc., as an anomaly detection target model when the data is unlabeled.

[0286] As another example, the application (111) may determine a specific light model (LM), such as Isolation Forest, Logistic Regression, K-means Clustering, and Decision Tree, as an anomaly detection target model when the data size is large or computation time is limited.

[0287] As another example, the application (111) can determine a specific heavy model (HM), such as LSTM (Long Short-Term Memory), LSTM-VAE (Variational Autoencoder), or Transformer, as an anomaly detection target model when it is determined to be time series data.

[0288] As another example, the application (111) can determine a hybrid model (HBM) that combines a certain supervised learning model (SLM) and an unsupervised learning model (ULM) as an anomaly detection target model when the data has only some labels.

[0289] In this way, in the embodiment, the application (111) can improve the accuracy and efficiency of anomaly detection based thereon and effectively reduce the computational resources and training time consumed by automatically selecting and utilizing the most suitable anomaly detection model (ADM) for the characteristics of the given data.

[0290] At this time, in the embodiment, the application (111) can generate and provide information guiding the characteristics of the determined anomaly detection target model (hereinafter, anomaly detection model determination information).

[0291] As an example, Anomaly detection model decision information It may include information such as the type of anomaly detection target model, the reason for the decision, data characteristics (e.g., number of features, presence of labels, presence of time series, variance size, data size, etc.), computational resource requirements (e.g., GPU requirements, CPU requirements, average training time, etc.) and / or performance evaluation metrics (e.g., Precision, Recall, F1 Score, ROC-AUC, etc.).

[0292] For example, the application (111) can generate and provide anomaly detection model decision information as follows.

[0293] [Example of Anomaly Detection Model Decision Information]

[0294] Determined Anomaly Detection Model (ADM) : LSTM-VAE

[0295] Model Type : Heavy Model (HM) / Unsupervised Learning Model (ULM)

[0296] Reason for decision This data was identified as time-series data, and since the long-term dependencies of the data need to be learned, the LSTM-VAE model is suitable.

[0297] Data characteristics information : Number of features: 12, Labels: Unlabeled, Time series characteristics: Determined as time series data, Variance: High, Data size: 1,000,000 records

[0298] Computational resource requirements : GPU (minimum 8GB memory) required, CPU core count: 4 cores or more, Average training time: 3 hours estimated

[0299] Performance evaluation metrics : Precision: 92.5%, Recall: 89.3%, F1 Score: 90.8%, ROC-AUC: 95.2%

[0300] Through this, in the embodiment, the application (111) can clearly present the basis for model selection, while ensuring transparency in the model selection process and improving reliability therefrom.

[0301] In another embodiment, the application (111) is, 2) An anomaly detection target model can be determined based on data variability and multi-scale characteristics.

[0302] Specifically, in the embodiment, the application (111) can determine an anomaly detection target model based on the variability of the given data and global and local characteristics.

[0303] For effective explanation, the following description is based on time series data, but is not limited thereto.

[0304] Generally, data distributions within time series data change very frequently, which can lead to anomaly detection models (ADM) failing to detect data variability or experiencing degraded performance if there are relatively under-trained data distributions.

[0305] Furthermore, since global and local characteristics of time series data occur in different forms, there may be limitations in learning and / or detecting all characteristics with a single model.

[0306] FIG. 10 is an illustrative diagram for explaining time series data with high variability according to one embodiment of the present invention.

[0307] For example, referring to the graph disclosed in FIG. 10, it can be seen that the data distribution changes significantly at 'step 50', indicated by the dotted line. At this time, according to the graph in FIG. 10, it can be seen that outliers (anomalies) occurred at 'step 19' and 'step 59', where the data increased rapidly.

[0308] In this situation, when the entire data according to Fig. 10 is input into a predetermined anomaly detection model (ADM), there is a very high possibility that only anomalies occurring in the data prior to the relatively large scale of '50 steps' will be detected.

[0309] Accordingly, an application (111) according to one embodiment of the present invention aims to implement anomaly detection based on the variability and multi-scale characteristics of time series data (hereinafter, variability and scale-based anomaly detection) by separating data intervals based on the timing of fluctuations in time series data and detecting outliers based on global and local characteristics.

[0310] To this end, the application (111) according to the embodiment can separate data intervals based on the time point of change of time series data and then determine an anomaly detection model (ADM) optimized for global and local characteristics as an anomaly detection target model.

[0311] FIG. 6 is a flowchart illustrating a method for providing an anomaly detection service based on the variability and multi-scale characteristics of time series data according to an embodiment of the present invention, and FIG. 7 is a conceptual diagram illustrating a method for providing anomaly detection service based on the variability and multi-scale characteristics of time series data according to an embodiment of the present invention.

[0312] Referring specifically to FIGS. 11 and FIGS. 12, in the embodiment, the application (111) is, It is possible to detect data change points within time series data. (S201)

[0313] Here, according to the embodiment Data change pointIran may refer to a point in time when the distribution, mean, variance, and / or pattern of the data changes rapidly beyond a certain standard.

[0314] That is, in the embodiment, the data change point may mean a point in time when the rate of change of data within the time series data is greater than or equal to a predetermined standard.

[0315] More specifically, in an embodiment, the application (111) can detect at least one data change point in time series data using a predetermined Change Point Detection (CPD) algorithm.

[0316] In an example, the application (111) can detect data change points based on various types of CPD algorithms, such as Bayesian Change Point Detection (BCPD), Ruptures Algorithm, Dynamic Programming-based CPD, Cumulative Sum (CUSUM) and / or Likelihood Ratio Test.

[0317] In addition, in the embodiment, the application (111) is, Time series data can be partitioned based on the detected data change point. (S203)

[0318] Specifically, in the embodiment, the application (111) can divide the time series data into multiple data intervals based on at least one data change point within the time series data.

[0319] In other words, the application (111) can divide time series data into predetermined intervals before and after data change based on at least one data change point, and manage each of these as an independent data interval.

[0320] More specifically, in an embodiment, the application (111) can divide time series data into multiple data intervals by applying a predetermined data splitting algorithm based on at least one data change point.

[0321] In an example, the application (111) can segment time series data using various types of data segmentation algorithms, such as Dynamic Programming-based Segmentation Algorithm, Minimal Cost Segmentation Algorithm, Gaussian Process-based Segmentation Algorithm, Mean-Shift Segmentation Algorithm and / or Kernel-based Change Point Detection Algorithm.

[0322] For example, the application (111) can divide the time series data X as follows when it detects a data change point T = [100, 250, 400].

[0323] [Example of splitting time series data X according to data change point T]

[0324] Interval 1: X[0:99] (data from index 0 to 99)

[0325] Interval 2: X[100:249] (Data from index 100 to 249)

[0326] Interval 3: X[250:399] (Data from index 250 to 399)

[0327] Interval 4: X[400:N] (from index 400 to the last data N)

[0328] In this case, in the embodiment, the application (111) can generate meta-information for each divided data segment.

[0329] In an example, the application (111) may generate meta-information for each of a plurality of data intervals, including information such as interval name, start index, end index, data distribution, mean, variance, pattern, scale characteristics (in the example, global or local characteristics) and / or number of data.

[0330] For example, the application (111) can generate first meta-information as follows for a first data interval within the time series data.

[0331] [Example of 1st Meta-information for 1st Data Section]

[0332] Interval Name: Interval 1 / Start Index: 0 / End Index: 99 / Data Count: 100 / Mean: μ1 / Variance: σ1^2 / Scale Feature: Local Feature

[0333] In addition, in this embodiment, the application (111) can visualize and provide each divided data segment in a predetermined manner.

[0334] In an example, the application (111) can generate and output data (hereinafter, time series segmentation information dashboard) that visually displays time series data divided into multiple data segments and provide it to the user.

[0335] For example, the application (111) can generate and output a time series segmentation information dashboard that displays time series data as a predetermined line chart and displays data change points as vertical lines.

[0336] At this time, depending on the embodiment, the application (111) may further include meta-information for each data segment in the time series segmentation information dashboard.

[0337] For example, the application (111) may further include and provide meta-information for each data segment in the form of text and / or tooltips on the time series segmentation information dashboard.

[0338] In addition, in the embodiment, the application (111) is, An anomaly detection target model (LCM: hereinafter, anomaly detection region model) for each segmented interval of time series data can be determined. (S205)

[0339] That is, the application (111) can determine an anomaly detection target model (i.e., an anomaly detection local model (LCM)) optimized for a specific local characteristic within the time series data.

[0340] Specifically, in the embodiment, the application (111) can obtain data characteristic information for multiple data intervals within the time series data.

[0341] Here, according to the embodiment Interval data characteristic information may mean information specifying the structural and / or statistical characteristics of a given data interval.

[0342] As an example, the interval data characteristic information may include data specifying the distribution, mean, variance and / or pattern of data for a predetermined data interval.

[0343] That is, in the embodiment, the application (111) can obtain the data characteristic information for each of the above-described intervals by analyzing the distribution, mean, variance and / or pattern of the data for each of the plurality of data intervals.

[0344] In addition, in the embodiment, the application (111) can filter and determine a suitable anomaly detection target model for each data segment based on the acquired segment-specific data characteristic information.

[0345] For example, if the application (111) determines that the first section is a stable section with low variability based on the data characteristic information of the first section, it can determine an anomaly detection model (ADM) suitable for stable data flow (e.g., Isolation Forest, etc.) as an anomaly detection region model (LCM) for the first section.

[0346] As another example, if the application (111) determines that the second section is an unstable section with high variability based on the data characteristic information of the second section, it can determine an anomaly detection model (ADM) suitable for unstable data flow (e.g., LSTM-VAE, etc.) as an anomaly detection region model (LCM) for the second section.

[0347] As another example, if the application (111) determines that the third section is a section with periodicity based on the data characteristic information of the third section, it can determine an anomaly detection model (ADM) suitable for periodic data flow (e.g., Autoencoder, etc.) as an anomaly detection region model (LCM) for the third section.

[0348] As another example, if the application (111) determines that the fourth section is a section with partial long-term dependency based on the data characteristic information of the fourth section, it can determine an anomaly detection model (ADM) suitable for data flow with partial long-term dependency (e.g., GRU model, etc.) as an anomaly detection region model (LCM) for the fourth section.

[0349] In this way, in the embodiment, the application (111) can perform sophisticated anomaly detection that takes into account different characteristics of each data segment in detail by independently applying an anomaly detection model (ADM) that is determined to be most suitable for each data segment within the time series data.

[0350] Through this, the application (111) can reduce the possibility of missing detections and false detections that occur when performing anomaly detection using an anomaly detection model (ADM) that is unsuitable for the characteristics of a given data interval, and improve the precision and sensitivity of anomaly detection.

[0351] In addition, the application (111) can flexibly select a light model (LM) and a heavy model (HM) for each data section, thereby increasing the efficiency of computational resources and improving detection speed.

[0352] In addition, in the embodiment, the application (111) is, An anomaly detection target model (GBM: hereinafter, global anomaly detection model) can be determined for the entire data interval of the time series data. (S207)

[0353] That is, the application (111) can determine an anomaly detection target model (i.e., an anomaly detection global model (GBM)) optimized for the global characteristics of the time series data.

[0354] Specifically, in the embodiment, the application (111) can obtain data characteristic information (hereinafter, overall data characteristic information) for the entire time series data.

[0355] Here, according to the embodiment Overall data characteristic information This may refer to information that specifies the structural and / or statistical characteristics of the entire data contained in the time series data.

[0356] As an example, the overall data characteristic information may include data specifying the periodicity of the data (i.e., whether it changes with a constant period), long-term dependency (i.e., whether a constant trend or pattern exists over the long term), number (i.e., the total size of the time series data), distribution, mean, variance, and / or pattern, etc., for the entire time series data.

[0357] That is, in the embodiment, the application (111) can obtain the above-described overall data characteristic information by analyzing the periodicity, long-term dependency, number, distribution, mean, variance and / or pattern of the data for the entire time series data.

[0358] In addition, in the embodiment, the application (111) can filter and determine an anomaly detection target model suitable for the entire time series data based on the acquired total data characteristic information.

[0359] For example, if the application (111) determines that the time series data is highly periodic based on the overall data characteristic information, it can determine an anomaly detection model (ADM) suitable for periodic data flow (e.g., LSTM, GRU, etc.) as a global anomaly detection model (GBM) for the time series data.

[0360] In another example, if the application (111) determines that the time series data is data with high long-term dependency based on the overall data characteristic information, it can determine an anomaly detection model (ADM) suitable for the long-term dependent data flow (e.g., Transformer, etc.) as the global anomaly detection model (GBM) for the time series data.

[0361] Thus, in the embodiment, the application (111) can perform reliable anomaly detection that reflects the overall structure and long-term patterns of the data by applying an anomaly detection model (ADM) optimized for global characteristics to the entire time series data.

[0362] Through this, the application (111) can implement a complex hybrid detection that utilizes an anomaly detection model (ADM) applied to each data segment within the time series data (i.e., an anomaly detection local model (LCM)) and an anomaly detection model (ADM) applied to the entire time series data (i.e., anomaly detection global model (GBM)).

[0363] Therefore, the application (111) can further improve the sensitivity and accuracy of anomaly detection and at the same time secure greater reliability.

[0364] In addition, in the embodiment, the application (111) is, An integrated anomaly detection model (ITM) can be determined based on the determined Local Anomaly Detection Model (LCM) and Global Anomaly Detection Model (GBM). (S209)

[0365] Herein, referring further to FIG. 12, according to an embodiment Integrated Anomaly Detection Model (ITM) This may refer to a hybrid anomaly detection model (ADM) that performs complex multi-anomaly detection by considering both local and global characteristics of specified data.

[0366] In an embodiment, this integrated anomaly detection model (ITM) may be implemented by including at least one local anomaly detection model (LCM) and a global anomaly detection model (GBM).

[0367] In detail, in the embodiment, the application (111) can determine integrated logic between at least one anomaly detection local model (LCM) and anomaly detection global model (GBM) determined as described above.

[0368] As an example, the application (111) can determine the integrated logic between at least one local anomaly detection model (LCM) and a global anomaly detection model (GBM) in at least one of a parallel integration method or a serial integration method.

[0369] Here, according to the embodiment Parallel integration method This may be a method of collecting detection results from the Local Anomaly Detection Model (LCM) and the Global Anomaly Detection Model (GBM) in parallel, and then combining the collected detection results.

[0370] For example, in a parallel integration method, if either the Local Anomaly Detection Model (LCM) or the Global Anomaly Detection Model (GBM) detects specific data as an outlier, that data can be considered an outlier.

[0371] Meanwhile, according to the embodiment Serial integration method This may be a method for determining whether to activate the Local Anomaly Detection Model (LCM) based on the detection results of the Global Anomaly Detection Model (GBM).

[0372] For example, in the serial integration method, if the Global Anomaly Detection Model (GBM) determines a specific data segment as a 'suspected anomaly segment,' the Local Anomaly Detection Model (LCM) can be activated for that data segment to perform precise detection.

[0373] Returning to the above, the application (111) that determined the integration logic can combine at least one local anomaly detection model (LCM) and a global anomaly detection model (GBM) according to the determined integration logic.

[0374] Thus, in the embodiment, the application (111) can determine an anomaly detection integration model (ITM) that performs complex anomaly detection by considering both local and global characteristics of a given data.

[0375] In this way, in the embodiment, the application (111) can simultaneously detect overall changes in time series data and local anomalies by determining an anomaly detection model (ADM) that considers both global and local characteristics.

[0376] Through this, the application (111) can support higher anomaly detection accuracy and sensitivity by combining the advantages of a global anomaly detection model (GBM) that reflects the characteristics of the entire time series data and a local anomaly detection model (LCM) that reflects the characteristics of each data segment within the time series data.

[0377] In addition, in the embodiment, the application (111) can more effectively optimize computational resources and detection performance by selectively applying a parallel or serial integration method.

[0378] Thus, in the embodiment, the application (111) can implement a hybrid detection that more efficiently and precisely detects multiple patterns of outliers, thereby providing high-quality outlier detection with efficiently improved detection flexibility, accuracy, and sensitivity.

[0379] In addition, in the embodiment, the application (111) is, The determined Integrated Anomaly Detection Model (ITM) can be determined as the anomaly detection target model for time series data. (S211)

[0380] That is, in the embodiment, the application (111) can determine the anomaly detection integrated model (ITM) described above as the final anomaly detection model (ADM) (i.e., anomaly detection target model) to perform anomaly detection by training the target data based on time-series data.

[0381] At this time, in the embodiment, the application (111) can generate and provide information that guides the characteristics of the determined anomaly detection target model (i.e., anomaly detection model determination information).

[0382] Here, as an example Anomaly detection model decision information It may include information such as the type of anomaly detection model (ADM) included in the anomaly detection integration model (ITM), integration logic, reason for decision, data characteristics (e.g., number of features, presence of labels, presence of time series, variance size, data size, etc.), computational resource requirements (e.g., GPU requirements, CPU requirements, average training time, etc.) and / or performance evaluation metrics (e.g., Precision, Recall, F1 Score, ROC-AUC, etc.).

[0383] For example, the application (111) can generate and provide anomaly detection model decision information as follows.

[0384] [Example of Anomaly Detection Model Decision Information]

[0385] Global Anomaly Detection Model (GBM) : LSTM (Long-term pattern detection)

[0386] Model Type: … / Reason for Decision: … / Data Characteristics: … / Computational Resource Requirements: … / Performance Metrics: …

[0387] Anomaly Detection Region Model (LCM) : Isolation Forest (Outlier detection within Section 1)

[0388] Model Type: … / Reason for Decision: … / Data Characteristics: … / Computational Resource Requirements: … / Performance Metrics: …

[0389] Integrated logic Parallel integration method

[0390] Through this, in the embodiment, the application (111) can provide clear information about the basis and process of model selection to improve detection transparency and reliability, while enabling the user to understand the information more accurately and intuitively.

[0391] Meanwhile, in the embodiment, the application (111) can perform anomaly detection using the anomaly detection target model (i.e., anomaly detection integration model (ITM)) determined as above.

[0392] That is, in the embodiment, the application (111) can perform variability and scale-based anomaly detection based on an anomaly detection integration model (ITM).

[0393] In this way, in the embodiment, the application (111) can implement variability and scale-based anomaly detection by dividing the time series data based on the timing of the change in the time series data and using an anomaly detection model (ADM) optimized for each divided data segment and the entire data segment to perform anomaly detection.

[0394] Through this, the application (111) can simultaneously support sophisticated anomaly detection that takes into account different characteristics of each data segment in detail, and reliable anomaly detection that reflects the overall structure and long-term patterns of the data.

[0395] In other words, in the embodiment, the application (111) can simultaneously detect overall changes and local anomalies in the data by combining a model that performs anomaly detection considering the global characteristics of the data (i.e., a global anomaly detection model (GBM)) and a model that performs anomaly detection considering the local characteristics of the data (i.e., a local anomaly detection model (LCM)), thereby preventing degradation of anomaly detection performance due to data fluctuations and increasing detection precision and sensitivity, and thus performing more accurate and reliable anomaly detection.

[0396] In addition, an application (111) according to one embodiment of the present invention is, A determined anomaly detection model (ADM) can be trained. (S107)

[0397] Specifically, in the embodiment, the application (111) can train an anomaly detection target model using training target data.

[0398] More specifically, in an embodiment, the application (111) can perform learning on an anomaly detection target model according to a learning method corresponding to the anomaly detection target model (e.g., supervised learning, unsupervised learning, or hybrid learning).

[0399] At this time, in the embodiment, the application (111) can provide a user interface (hereinafter, dashboard interface) that can monitor the learning process in real time.

[0400] In an example, the application (111) can visualize and provide real-time learning status, such as the current epoch, remaining learning time, current loss and / or learning accuracy, based on a dashboard interface.

[0401] In addition, in the embodiment, the application (111) can provide a user interface (hereinafter, a learning control interface) that can control the learning process in real time.

[0402] In an example, the application (111) can control learning suspension, resumption, early stopping, etc. in real time based on user input based on the learning control interface.

[0403] In addition, as an example, the application (111) can change certain learning parameters (e.g., number of epochs and / or learning rate, etc.) in real time according to user input based on the learning control interface.

[0404] Additionally, as an example, the application (111) can perform real-time labeling for specific data based on user input based on a learning control interface.

[0405] In addition, as an example, the application (111) can obtain in real time whether there is a correct answer for a specific outlier (hereinafter, outlier manual feedback) based on user input based on a learning control interface.

[0406] And the application (111) can perform subsequent learning by further reflecting the data based on the acquired outlier manual feedback in real time.

[0407] In this way, the application (111) in the embodiment can directly and continuously improve the performance and quality of the model learning by implementing model learning that further reflects human cognitive feedback in real time.

[0408] In addition, an application (111) according to one embodiment of the present invention is, The performance of the trained anomaly detection model (ADM) can be evaluated and improved. (S109)

[0409] Specifically, in the embodiment, the application (111) can evaluate the performance of the anomaly detection target model learned as above according to a predetermined performance indicator.

[0410] In an example, the application (111) can measure the performance of an anomaly detection target model based on various performance indicators such as accuracy, precision, recall, F1 score, ROC-AUC, detection speed, etc.

[0411] In addition, in the embodiment, the application (111) can generate information (hereinafter, performance evaluation information) that visualizes the results of a performance evaluation in a predetermined way and provide it to the user.

[0412] For example, the application (111) can generate and provide performance evaluation information implemented in the form of a predetermined table, graph and / or visual dashboard, etc.

[0413] At this time, depending on the embodiment, the application (111) may further include anomaly data and / or scores for each specific type of outlier (e.g., Point Anomaly, Contextual Anomaly, Collective Anomaly, etc.) in the performance evaluation information described above.

[0414] Thus, in the embodiment, the application (111) can easily and accurately determine the performance of the model based on clear and objective criteria.

[0415] Additionally, in the embodiment, the application (111) can improve the performance of the anomaly detection target model according to a predetermined method according to the embodiment of the present invention.

[0416] Specifically, as an example, the application (111) can 1) improve the performance of an anomaly detection target model based on user feedback data.

[0417] More specifically, in an embodiment, the application (111) may provide a user interface (hereinafter, user feedback interface) that can input whether there is a correct answer (i.e., manual feedback on an anomaly) for a predetermined anomaly detected through an anomaly detection target model.

[0418] Additionally, in the embodiment, the application (111) can obtain the above-described outlier manual feedback based on user input based on the user feedback interface.

[0419] Additionally, in the embodiment, the application (111) can perform additional learning on the anomaly detection target model by further reflecting the acquired outlier manual feedback.

[0420] In an example, the application (111) can perform an automated retraining process for an anomaly detection target model by integrating data from manual outlier feedback and training target data.

[0421] That is, in the embodiment, the application (111) can support continuous performance improvement of the model by collecting user feedback on anomaly detection results based on an anomaly detection target model and implementing model retraining using the feedback.

[0422] In another embodiment, the application (111) is, 2) The performance of the anomaly detection target model can be improved based on changes in the anomaly score.

[0423] Specifically, in the embodiment, the application (111) can improve the performance of the anomaly detection target model by analyzing changes in the anomaly score obtained through the anomaly detection target model and implementing anomaly detection that reflects this.

[0424] For effective explanation, the following description is based on anomaly detection based on time-series data, but is not limited thereto.

[0425] More specifically, an application (111) according to one embodiment of the present invention is, Time-series data anomaly detection based on anomaly score change (hereinafter, anomaly score-based anomaly detection) It can perform.

[0426] Here, according to the embodiment Anomaly score-based anomaly detection This may refer to an anomaly detection method that detects outliers by analyzing the periodicity or variance of time series data and detecting changes in the anomaly score.

[0427] FIG. 13 is a flowchart illustrating a method for providing a time-series data anomaly detection service based on anomaly score change according to an embodiment of the present invention.

[0428] Referring specifically to FIG. 13, the application (111) according to the embodiment is, It is possible to perform periodicity analysis of time series data. (S301)

[0429] More specifically, in the embodiment, the application (111) can analyze the periodicity of time series data by linking with a predetermined deep learning neural network.

[0430] FIG. 14 is an illustrative diagram for explaining periodic data according to one embodiment of the present invention.

[0431] In other words, referring to FIG. 14, the application (111) can distinguish between data that repeats a specific period (pattern) within the time series data (hereinafter periodic data) and the remaining data (hereinafter non-periodic data) through a predetermined deep learning neural network.

[0432] In an example, the application (111) can perform periodicity analysis on time series data using deep learning algorithms such as an auto-correlation algorithm, a time series forecasting network (TSFNet), a recurrent neural network (RNN), a periodic neural network (PNN), a transformer-based time series prediction and / or a neural autoregressive model (NAR).

[0433] For effective explanation, the periodicity of time series data is analyzed based on the autocorrelation algorithm.

[0434] In a specific embodiment, the application (111) can analyze the correlation between data within the time series data at predetermined lag intervals based on an autocorrelation algorithm.

[0435] For example, the application (111) can analyze patterns in time series data by adjusting the time difference at various intervals such as 7 days, 14 days, or 30 days.

[0436] In addition, in the embodiment, the application (111) can calculate the auto-correlation coefficient for each time lag according to the following [Equation 1].

[0437] [Mathematical Formula 1]

[0438]

[0439] Here, 'x_t' in [Equation 1] is the data at time t, 'x_t+k' is the data at time t+k, and 'k' can represent the lag.

[0440] In addition, in the embodiment, the application (111) can distinguish between the periodic data and non-periodic data described above by comparing the autocorrelation coefficient with a predetermined threshold.

[0441] Specifically, the application (111) can determine that if the autocorrelation coefficient is higher than a predetermined threshold, the data corresponding to the time difference (interval) is periodic data, and the remaining data is non-periodic data.

[0442] Thus, in the embodiment, the application (111) can perform periodicity analysis to determine periodic data and non-periodic data within the time series data.

[0443] At this time, according to the embodiment, the application (111) can adjust the anomaly detection criteria for periodic data so as not to mistake periodic fluctuations for outliers.

[0444] In addition, the application (111) according to the embodiment is, Can perform Variance of time series data analysis. (S303)

[0445] Specifically, in the embodiment, the application (111) can analyze the variance of time series data in conjunction with a predetermined deep learning and / or statistical algorithm, etc.

[0446] That is, in the embodiment, the application (111) can calculate the variance value of the data for each predetermined unit (e.g., a window specifying a specific period and / or interval) within the time series data through a predetermined deep learning neural network.

[0447] In an example, the application (111) can perform variance analysis on time series data using deep learning and / or statistical algorithms such as a variance algorithm, a moving variance filter (MVF), kernel density estimation (KDE), Gaussian process-based time series modeling, adaptive window-based variance analysis and / or a probabilistic variance model (PVM).

[0448] In addition, the application (111) according to the embodiment is, The anomaly detection target range can be determined based on the analysis results. (S305)

[0449] That is, in the embodiment, the application (111) is a target section (hereinafter,) for performing anomaly detection on at least some data sections within the time series data based on the results of the aforementioned periodicity analysis and variance analysis. Anomaly detection target section It can be decided as ).

[0450] Specifically, as an example, the application (111) can extract at least some data intervals within the time series data based on the results of periodicity analysis and variance analysis of the time series data.

[0451] More specifically, in the embodiment, the application (111) can 1) determine an anomaly detection target interval based on the periodicity analysis results.

[0452] Specifically, in the embodiment, the application (111) can extract from the time series data a data interval corresponding to a lag in which the autocorrelation coefficient calculated based on periodicity analysis is higher than a predetermined threshold.

[0453] That is, the application (111) can extract data determined to be periodic data through periodicity analysis from the corresponding time series data.

[0454] For example, the application (111) can determine that the data interval corresponding to the first time difference (e.g., 30 days or 250 minutes, etc.) is periodic data when the autocorrelation coefficient is high, and can extract the periodic data from the time series data.

[0455] And in the embodiment, the application (111) can determine the extracted data interval as an anomaly detection target interval.

[0456] In addition, in the embodiment, the application (111) can determine 2) an anomaly detection target interval based on the results of the variance analysis.

[0457] In detail, in an embodiment, the application (111) can extract a data interval from the time series data according to a unit corresponding to the variance value (e.g., a window specifying a specific period and / or interval) when the variance value calculated based on the analysis of variance is below a predetermined threshold (i.e., when the degree of variance is lower than a predetermined threshold and the range of variation between data is small).

[0458] In addition, in the embodiment, the application (111) can determine the extracted data interval as an anomaly detection target interval.

[0459] In this way, in the embodiment, the application (111) can filter and detect sections within the time series data where anomaly detection needs to be performed based on the results of the periodicity analysis and variance analysis described above.

[0460] In other words, the application (111) can extract a data segment that has a pattern at a specific period (time lag) based on the periodicity analysis results and extract a relatively stable data segment (i.e., a segment with a small range of data fluctuation) based on the variance analysis results and determine it as a data segment requiring more intensive anomaly detection (i.e., anomaly detection target segment).

[0461] Through this, the application (111) in the embodiment can reduce the cost of anomaly detection by reducing unnecessary anomaly detection caused by periodic fluctuations or noise, and can also increase the accuracy of anomaly detection by minimizing false positives and false negatives.

[0462] Therefore, the application (111) can significantly improve its efficiency and reliability by implementing anomaly detection that is more robust against noise.

[0463] In addition, the application (111) according to the embodiment is, Changes in the anomaly score within a determined anomaly detection target interval can be tracked. (S307)

[0464] Specifically, in the embodiment, the application (111) can calculate an anomaly score for each data included in the anomaly detection target interval.

[0465] For reference, an anomaly score can refer to a value that quantitatively specifies the probability that a given data point is an outlier. In other words, the anomaly score numerically indicates how far the data deviates from the normal range, and this value can be used to determine the degree of data anomaly.

[0466] Additionally, in the embodiment, the application (111) can calculate an anomaly variation score based on an anomaly score for each data.

[0467] Here, according to the embodiment Anomaly fluctuation scoreThis may mean the difference value between an anomaly score between a predetermined first time point (hereinafter, time point t) within the anomaly detection target interval and a predetermined second time point (hereinafter, time point t-1) prior to the first time point.

[0468] That is, in the embodiment, the anomaly variation score may be the difference between the anomaly score at time t and the anomaly score at time t-1. This can be expressed as a formula as shown in [Equation 2] below.

[0469] [Mathematical Formula 2]

[0470]

[0471] Here, 'Anomaly Score Diff' in [Equation 2] represents the anomaly variation score, 'Anomaly Score(t)' represents the anomaly score at time t, and 'Anomaly Score(t-1)' represents the anomaly score at time t-1.

[0472] In other words, in the embodiment, the application (111) can calculate an anomaly variation score by calculating the difference value between the anomaly score at time t and the anomaly score at time t-1.

[0473] In this case, in the embodiment, the application (111) can calculate an anomaly variation score for all data within the anomaly detection target interval and track changes in the anomaly score.

[0474] Specifically, in the embodiment, the application (111) can calculate an anomaly variation score by applying [Equation 2] to all data points of the anomaly detection target interval.

[0475] For example, the application (111) can continuously calculate anomaly variation scores between the first data and the second data, the second data and the third data, …, the n-1 data and the n data when the anomaly detection target interval consists of the first to n data.

[0476] Thus, in the embodiment, the application (111) tracks the pattern of change of the anomaly score within the anomaly detection target interval on a continuous flow of time-series data and can detect a certain pattern or a sudden change.

[0477] In addition, the application (111) according to the embodiment is, Anomaly abnormal scores can be detected by tracking changes in anomaly scores. (S309)

[0478] Here, according to the embodiment Anomaly Abnormal Score This may refer to an anomaly variation score that has a value greater than or equal to a predetermined threshold among multiple anomaly variation scores based on anomaly detection target intervals.

[0479] That is, in the embodiment, the anomaly abnormal score may be data capable of identifying a point in time when the difference between a predetermined anomaly score is greater than or equal to a predetermined threshold (i.e., a point in time when the fluctuation range between a predetermined anomaly score is rapid, exceeding a specific reference value).

[0480] Specifically, in the embodiment, the application (111) can compare each of a plurality of anomaly variation scores based on an anomaly detection target interval with a predetermined threshold.

[0481] In this case, in the embodiment, the application (111) can identify and detect an anomaly fluctuation score having a value greater than or equal to a predetermined threshold as a result of comparison.

[0482] In addition, the application (111) according to the embodiment is, Anomaly detection based on the detected anomaly abnormal score can be performed. (S311)

[0483] Specifically, in the embodiment, the application (111) can determine the data at a point in time corresponding to the anomaly abnormal score detected as above as an outlier.

[0484] That is, the application (111) can determine the data at the corresponding point in time as an anomaly abnormal score when it detects an anomaly abnormal score that is an anomaly fluctuation score greater than a predetermined threshold while monitoring all anomaly fluctuation scores within the anomaly detection target interval.

[0485] In this case, in the embodiment, the application (111) can store and manage result data resulting from the anomaly detection in a predetermined manner.

[0486] In an example, the application (111) can store and manage an anomaly obtained by performing anomaly detection, the time of detection of the anomaly, an anomaly score and / or an anomaly fluctuation score corresponding to the anomaly.

[0487] In this way, in the embodiment, the application (111) can determine an outlier based on the amount of change in the anomaly score, unlike the conventional method of simply determining data with a high anomaly score as an outlier.

[0488] Through this, the application (111) can filter out small data fluctuations below a threshold and detect outliers by reacting to large data fluctuations above a threshold.

[0489] Therefore, the application (111) can implement an anomaly detection process that minimizes false positives caused by noise and focuses on actual meaningful data changes to operate sensitively.

[0490] As described above, in an embodiment of the present invention, the application (111) can detect anomalies in time series data based on periodicity analysis based on an auto-correlation algorithm, data filtering based on variance analysis according to a specific unit (e.g., a window of a certain length), and analysis of changes in anomaly scores between predetermined data points.

[0491] Through this, in the embodiment, the application (111) can perform efficient anomaly detection based on periodic data exhibiting a repetitive pattern, while simultaneously implementing anomaly detection with improved performance that is robust against noise.

[0492] Thus, in the embodiment, the application (111) can directly further improve the accuracy, precision, and reliability of anomaly detection.

[0493] In addition, the application (111) according to the embodiment is, Anomaly detection result information including the detected anomaly abnormal score can be provided. (S313)

[0494] Here, according to the embodiment Anomaly detection result information This can refer to information that systematizes the process of performing anomaly detection and the resulting data.

[0495] In an example, the anomaly detection result information may include a predetermined periodicity analysis result (e.g., an auto-correlation algorithm analysis result, etc.), an analysis of variance result, the number of outliers, outlier types, an anomaly score, an anomaly fluctuation score, an anomaly abnormal score, detection result (e.g., normal or abnormal, etc.), detection time, detection location, detection basis (e.g., sudden change in data fluctuation range, etc.), and / or user feedback history data, etc.

[0496] In detail, in the embodiment, the application (111) can obtain anomaly detection result information as described above during the process of performing anomaly detection.

[0497] And in the embodiment, the application (111) can provide the acquired anomaly detection result information in a predetermined manner.

[0498] FIG. 15 is an illustrative diagram for explaining an anomaly detection result information dashboard according to one embodiment of the present invention.

[0499] As an example, referring to FIG. 15, the application (111) can generate and output data that visually displays anomaly detection result information (hereinafter, anomaly detection result information dashboard) and provide it to the user.

[0500] For example, the application (111) can generate an anomaly detection result information dashboard that visualizes the anomaly detection result information using a predetermined heatmap, graph, table and / or chart, etc., and provide it by displaying it.

[0501] In addition, as an example, the application (111) can generate and output data (hereinafter referred to as an anomaly detection result information report) processed into a predetermined report format (e.g., PDF and / or CSV, etc.) and provide it to the user.

[0502] In this case, in the embodiment, the application (111) may provide a notification when it detects a predetermined anomaly value during the process of performing anomaly detection.

[0503] In an example, the application (111) may provide a notification to the user regarding an anomaly detected through anomaly detection by linking with a predetermined notification system (e.g., a message transmission and / or audio output system, etc.).

[0504] As such, in the embodiment, the application (111) can provide anomaly detection result information including an anomaly abnormal score in the form of a visual dashboard and / or report, and can provide real-time notifications regarding the occurrence of anomalies.

[0505] Thus, the application (111) can support the user in clearly recognizing the anomaly detection process and results and responding quickly.

[0506] In addition, through this, the application (111) can improve the interpretability of anomaly detection results and operational transparency, and can further enhance user trust based on clearer and more objective anomaly detection grounds.

[0507] In addition, the application (111) according to the embodiment is, Parameters based on anomaly score-based anomaly detection can be updated based on user feedback. (S315)

[0508] Specifically, in an embodiment, the application (111) may provide a user interface (hereinafter, an anomaly detection parameter setting interface) that can set parameters of an anomaly detection target model that performs anomaly score-based anomaly detection.

[0509] At this time, the parameters of the anomaly detection target model according to the embodiment (hereinafter, anomaly detection parameters) may include parameters that specify various anomaly detection criteria, such as periodicity analysis criteria based on an autocorrelation algorithm, variance filtering criteria, and / or anomaly abnormal score thresholds.

[0510] Additionally, in the embodiment, the application (111) can perform an update to the above anomaly detection parameters based on user input (i.e., user feedback) based on the anomaly detection parameter setting interface.

[0511] For example, the application (111) can perform an anomaly detection parameter update by resetting the threshold used when detecting an anomaly abnormal score based on user input based on an anomaly detection parameter setting interface from '0.1' to '0.2', thereby lowering sensitivity to small data fluctuations and reducing unnecessary false positives.

[0512] As another example, the application (111) can perform an anomaly detection parameter update to expand the detection range of the model so that it can recognize data patterns with longer periods by changing the periodicity analysis criteria of the autocorrelation algorithm from 7 days to 14 days based on user input based on the anomaly detection parameter setting interface.

[0513] In another example, the application (111) can perform an anomaly detection parameter update to adjust detection sensitivity so as not to judge minute fluctuations in data as anomalies by raising the variance filtering criterion from an existing threshold (e.g., '0.05') to a new threshold (e.g., '0.08') based on user input based on an anomaly detection parameter setting interface.

[0514] Additionally, in the embodiment, the application (111) can perform anomaly score-based anomaly detection according to the embodiment of the present invention based on an anomaly detection target model that has updated anomaly detection parameters.

[0515] As such, in the embodiment, the application (111) can dynamically adjust the parameters of the anomaly detection target model that performs anomaly score-based anomaly detection according to user settings.

[0516] Therefore, the application (111) can easily improve the performance of the anomaly detection target model in a form optimized for user needs.

[0517] In another embodiment, the application (111) is, 3) The performance of the anomaly detection target model can be improved based on the calculation of an anomaly score for inversion data following the detection of a decline in data trends.

[0518] Specifically, in the embodiment, the application (111) can detect whether the trend of the input data is declining, and after reversing the input data value within a specified range that includes the section where the trend of the input data is declining, calculate an anomaly score for the reversal section.

[0519] Subsequently, the application (111) can use the result of a weighted sum of an anomaly score for the input data before inversion and an anomaly score for the input data after inversion for the inversion interval as the final anomaly score for anomaly detection.

[0520] FIG. 16 is a flowchart illustrating a method for providing a time series data anomaly detection service based on the calculation of an anomaly score for inversion data based on the detection of a decline in data trends according to an embodiment of the present invention.

[0521] Referring specifically to FIG. 16, the application (111) according to the embodiment is, It can detect a decline in the trend of the input data. (S401)

[0522] For example, referring to Fig. 17, input data including a section where the trend is declining may be provided. For data in this declining trend section (DR), anomaly detection may not be performed well due to causes such as structural defects in the dataset.

[0523] Therefore, anomaly detection based on anomaly score calculation may not be effective for data included in the period where the trend is declining.

[0524] In contrast, for data that includes sections where the trend is rising, anomaly detection based on anomaly score calculation can be performed effectively.

[0525] Before performing preprocessing on data included in a trend-declining section where such anomaly detection is not well performed, the application (111) can detect a trend-declining section in the input data where the trend is declining through various techniques such as calculating a moving average of the data values, calculating the slope, and observing the rate of change.

[0526] In addition, the application (111) according to the embodiment is, Data reversal can be performed on the downward trend section of the input data. (S403)

[0527] Specifically, the application (111) can invert the data values ​​included in the trend-decreasing section to convert the trend-decreasing section, where anomaly score-based anomaly detection is not effectively performed, into a trend-rising section.

[0528] For example, as illustrated in FIG. 18, the data values ​​included in the trend-declining section of the input data can be inverted to convert the trend-declining section (DR) of the input data into the trend-increasing section (IR).

[0529] In addition, the application (111) according to the embodiment is, For the inversion interval, a weighted sum of the first anomaly score before inversion and the second anomaly score after inversion can be calculated. (S405)

[0530] Specifically, the application (111) can calculate a first anomaly score for the input data before inversion and a second anomaly score for the input data after inversion for the region where the data values ​​of the input data are inverted.

[0531] Additionally, the application (111) has a first anomaly score according to the following [Equation 3] ( ) and the second anomaly score( ' The weighted sum of ) can be used as the final anomaly score for anomaly detection.

[0532] [Mathematical Formula 3]

[0533]

[0534] In this case, the weight (ε) can be adjusted according to the degree of trend decline of the input data. For example, the weight (ε) can be adjusted larger as the degree of trend decline increases, and the weight (ε) can be adjusted smaller as the degree of trend decline decreases.

[0535] Additionally, the application (111) according to the embodiment can perform anomaly detection based on the weighted sum of the first anomaly score and the second anomaly score. (S405)

[0536] Specifically, the application (111) can perform anomaly detection on input data by using the weighted sum of the first anomaly score and the second anomaly score as the final anomaly score.

[0537] As described above, in the embodiment, the application (111) can diagnose the performance of the anomaly detection target model according to objective criteria, visualize and provide it, and improve it in a multifaceted way, thereby improving the accuracy of anomaly detection using the model to minimize the probability of false positives and false negatives, and at the same time provide an anomaly detection service that operates more reliably and stably.

[0538] In addition, an application (111) according to one embodiment of the present invention is, Anomaly monitoring based on an Anomaly Detection Model (ADM) can be performed. (S111)

[0539] In detail, in the embodiment, the application (111) can provide a learned, evaluated, and improved anomaly detection target model in a predetermined manner as described above.

[0540] As an example, the application (111) can build a monitoring system capable of performing real-time anomaly detection by deploying an anomaly detection target model to a predetermined operating environment.

[0541] In this embodiment, the application (111) can deploy an anomaly detection target model based on a data distribution environment such as a predetermined cloud infrastructure (e.g., AWS, GCP, Azure, etc.), an on-premises server, and / or an edge device.

[0542] Additionally, the application (111) can deploy anomaly detection target models based on deployment strategies such as Blue-Green Deployment, Canary Deployment, and Rolling Update.

[0543] In addition, in the embodiment, the application (111) can perform real-time anomaly detection based on a monitoring system built on a distributed anomaly detection target model.

[0544] Specifically, in the embodiment, the application (111) can set a data input path for an anomaly detection target model.

[0545] In an example, the application (111) can set a data input path based on a predetermined real-time data streaming (e.g., Kafka, AWS Kinesis, Google Pub / Sub, etc.), cloud storage and / or an API (Application Programming Interface), etc.

[0546] In addition, in the embodiment, the application (111) can perform anomaly detection using an anomaly detection target model based on real-time input data received through a set data input path.

[0547] In this case, in the embodiment, the application (111) can dynamically adjust the size of the window, which is the basic processing unit for the data, when performing anomaly detection on real-time input data.

[0548] A window refers to the length of the interval in the input time series data where anomaly detection is to be performed. The application (111) can divide the time series data by the window size and perform anomaly detection for each interval.

[0549] For example, the application (111) can reduce the size of the window when the variation value of the anomaly score increases significantly as a result of analyzing real-time input data.

[0550] This is intended to efficiently detect outliers by reducing the window size to perform local anomaly detection, as there is a high probability of outliers occurring when the fluctuation value of the anomaly score increases significantly, such as when the anomaly score rapidly decreases or increases.

[0551] The anomaly score is an indicator that contains information on how much a given data value deviates from normal data values.

[0552] The anomaly score can be determined based on the difference between the data value and the baseline. The baseline can be, for example, a statistical characteristic value of the data within the anomaly detection range (e.g., mean, median, etc.).

[0553] For example, the application (111) can perform local anomaly detection on real-time input data by reducing the window size when the variation value of the anomaly score, which is the difference between the anomaly score at the current time and the anomaly score at the previous time, is greater than a predetermined first threshold value.

[0554] In this case, the aforementioned predetermined first threshold value may be determined based on a linear combination of the mean and standard deviation of the anomaly score variation values ​​for the data values ​​within the window. However, it is not limited thereto, and the aforementioned predetermined threshold value may be determined in various ways.

[0555] Additionally, for example, the application (111) can increase the size of the window if, as a result of analyzing real-time input data, the variability of the anomaly score is maintained below a predetermined second threshold for a predetermined amount of time.

[0556] Here, the fact that the variability of the anomaly score remains below a predetermined second threshold means that the anomaly score exhibits a relatively stable pattern without increasing or decreasing rapidly; in this case, it implies that the data is in a steady state or that the influence of outliers is global rather than local.

[0557] For example, the application (111) can perform global anomaly detection on real-time input data by increasing the window size when the change value of the anomaly score, which is the difference between the anomaly score at the current time and the anomaly score at the previous time, is maintained at or below a predetermined second threshold for a predetermined period of time.

[0558] In this case, the aforementioned predetermined second threshold value may be determined by a linear combination of the mean and standard deviation of the anomaly score variation values ​​for the data values ​​within the window. However, it is not limited thereto, and the aforementioned predetermined threshold value may be determined in various ways.

[0559] Here, the second threshold value may differ from the first threshold value. For example, the second threshold value may be set smaller than the first threshold value. However, this is not limited thereto, and the first threshold value and the second threshold value may be the same.

[0560] In addition, in the embodiment, the application (111) can provide data obtained as a result of performing anomaly detection (hereinafter, anomaly detection result data) in a predetermined manner.

[0561] Here, the anomaly detection result data according to the embodiment may include at least one anomaly type, an anomaly score, a detection result (e.g., normal or abnormal, etc.), detection time and / or detection location data, etc.

[0562] In an example, the application (111) can generate and output data that visually displays anomaly detection result data (hereinafter, anomaly detection result dashboard) and provide it to the user.

[0563] For example, the application (111) can generate an anomaly detection result dashboard that visualizes anomaly detection result data using a predetermined heatmap, graph and / or chart, etc., and provide it by displaying it.

[0564] Additionally, in the embodiment, the application (111) may provide a notification if it detects a predetermined anomaly value during the process of performing anomaly detection.

[0565] In an example, the application (111) may provide a notification to the user about an anomaly detected through anomaly detection by linking with a predetermined notification system (e.g., a message transmission and / or audio output system, etc.).

[0566] In this way, in the embodiment, the application (111) can significantly improve anomaly detection automation and operational efficiency by deploying an anomaly detection target model that has been learned, evaluated, and improved according to the aforementioned process onto a predetermined operating environment and performing real-time anomaly monitoring based thereon.

[0567] In addition, in the embodiment, the application (111) provides the results of the anomaly detection in the form of a visual dashboard, thereby allowing the user to grasp the status of the anomaly detection at a glance and to recognize the results more intuitively and clearly.

[0568] In addition, in the embodiment, the application (111) can respond quickly and accurately to abnormal situations by providing a real-time notification when an anomaly is detected.

[0569] Thus, as a result, the application (111) can provide a high-quality / high-performance user-customized AIaaS-based anomaly detection service by increasing operational transparency and user trust regarding the model of the anomaly detection environment, while also effectively supporting anomaly detection optimization processes according to user needs.

[0570] In other words, in the embodiment, the application (111) can enable even users with limited expertise to easily optimize and improve the anomaly detection system to meet their needs through intuitive operation via the aforementioned processes, such as automated model recommendations, user-friendly interfaces, data visualization, and / or outlier notifications, and can enable the smooth management and operation of a user-customized anomaly detection system without the intervention of a separate expert by intuitively and clearly recognizing various information obtained as the anomaly detection system operates.

[0571] The embodiments according to the present invention described above may be implemented in the form of program instructions that can be executed through various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc., either individually or in combination. The program instructions recorded on the computer-readable recording medium may be those specifically designed and configured for the present invention or those known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes; optical recording media such as CD-ROMs and DVDs; magneto-optical media such as floptical disks; and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, and flash memory. Examples of program instructions include machine code, such as that generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. Hardware devices may be modified into one or more software modules to perform processing according to the present invention, and vice versa.

[0572] The specific embodiments described in this invention are examples and do not limit the scope of the invention in any way. For the sake of brevity of the specification, descriptions of prior electronic configurations, control systems, software, and other functional aspects of said systems may be omitted. Additionally, the connections of lines or connecting members between components shown in the drawings are illustrative of functional connections and / or physical or circuit connections, and may be replaced or additionally represented as various functional connections, physical connections, or circuit connections in actual devices. Furthermore, unless specifically stated as “essential,” “importantly,” etc., a component may not be strictly necessary for the application of the invention.

[0573] Furthermore, although the detailed description of the present invention has been explained with reference to preferred embodiments of the invention, those skilled in the art or those with ordinary knowledge in the relevant technical field will understand that various modifications and changes can be made to the invention without departing from the spirit and technical scope of the invention as set forth in the claims below. Accordingly, the technical scope of the present invention should not be limited to the contents described in the detailed description of the specification, but should be determined by the claims.

Claims

Claim 1 A method for detecting anomalies in time series data using a dynamic window, wherein an anomaly detection application executed by at least one processor of a terminal provides an anomaly detection service, comprising: a step of acquiring first time series data; a step of performing preprocessing on the first time series data; a step of training an anomaly detection model based on the preprocessed first time series data; and a step of calculating a change value of an anomaly score for newly acquired second time series data and dynamically adjusting the size of a window for the second time series data according to the change value to perform anomaly detection based on the anomaly detection model. Claim 2 A method for detecting anomalies in time series data using a dynamic window, wherein, in the step of performing the anomaly detection, the size of the window is dynamically adjusted, and when the variation value of the anomaly score is greater than a first threshold value, the size of the window is reduced. Claim 3 A method for detecting anomalies in time series data using a dynamic window, wherein, in claim 2, the first threshold value is determined based on a linear combination of the mean and standard deviation of the anomaly score variation values ​​for the time series data within the window. Claim 4 A method for detecting anomalies in time-series data using a dynamic window, wherein, in the step of performing the anomaly detection, the size of the window is dynamically adjusted, and the size of the window is increased when the variation value of the anomaly score is maintained at or below a second threshold value for a predetermined period of time. Claim 5 In claim 4, a time series data anomaly detection method using a dynamic window, wherein the first threshold is greater than the second threshold. Claim 6 A method for detecting anomalies in time series data using a dynamic window, wherein, in the step of performing preprocessing on the first time series data, abnormal data is removed from the first time series data using an LSTM-VAE model. Claim 7 In claim 6, the LSTM-VAE model is a model trained to generate a first latent variable based on normal data and a second latent variable based on abnormal data, and in removing abnormal data from the first time series data using the LSTM-VAE model, the LSTM-VAE model is used to generate a target latent variable based on the first time series data, and if the shape of the distribution of the target latent variable is similar to the shape of the distribution of the second latent variable, the data is determined as abnormal data, and the determined abnormal data is removed from the first time series data, a method for detecting anomalies in time series data using a dynamic window. Claim 8 A method for detecting anomalies in time series data using a dynamic window according to claim 1, wherein, in the step of performing preprocessing on the first time series data, if it is determined that the first time series data falls below a predetermined threshold, additional time series data including at least one pattern parameter is generated, in the step of performing preprocessing, the preprocessing is performed on the additional time series data, and in the step of training the anomaly detection model, the anomaly detection model is trained based on the preprocessed additional time series data. Claim 9 A method for detecting anomalies in time series data using a dynamic window according to claim 8, wherein the additional time series data includes a plurality of pattern parameters and the additional time series data is generated according to a method of independently assigning probability values ​​to each of the plurality of pattern parameters. Claim 10 A method for detecting anomalies in time series data using a dynamic window according to claim 1, wherein, in the step of performing preprocessing on the first time series data, a predetermined anomaly is injected into the first time series data to generate abnormal time series data, the distribution of the first anomaly score of the first time series data and the distribution of the second anomaly score of the abnormal time series data are compared, a threshold for the anomaly score is selected in the overlapping region of the distribution of the first anomaly score and the distribution of the second anomaly score, and in the step of training the anomaly detection model, the anomaly detection model is trained based on the preprocessed first time series data and the threshold for the anomaly score. Claim 11 A system for detecting anomalies in time series data using a dynamic window, comprising: at least one memory; and at least one processor that reads at least one application stored in the memory and performs time series data anomaly detection using a dynamic window; wherein the instructions of the processor include the steps of acquiring first time series data, performing preprocessing on the first time series data, training an anomaly detection model based on the preprocessed first time series data, calculating a change value of an anomaly score for newly input second time series data, and dynamically adjusting the size of a window for the second time series data according to the change value to perform anomaly detection based on the anomaly detection model. Claim 12 A time-series data anomaly detection system using a dynamic window according to claim 11, wherein the instructions of the processor further include instructions for performing a step of reducing the size of the window when the variation value of the anomaly score is greater than a first threshold value when dynamically adjusting the size of the window in the step of performing the anomaly detection. Claim 13 A time-series data anomaly detection system using a dynamic window according to claim 12, wherein the instructions of the processor further include an instruction to increase the size of the window when the fluctuation value of the anomaly score is maintained at or below a second threshold value for a predetermined period of time when dynamically adjusting the size of the window in the step of performing the anomaly detection. Claim 14 In claim 13, a time-series data anomaly detection system using a dynamic window, wherein the first threshold is greater than the second threshold.

Images