Anomaly detection method and devies using prediction-based detector algorithm and large language model and system for performing the same

Abstract

The present invention relates to a method for performing predictions through environmental data acquired as time-series data of multiple sensors and detecting abnormal signs based on the predictions, and further relates to a method for detecting abnormal signs by combining an edge server that performs prediction-based abnormal sign detection and a Large Language Model (LLM).

Description

Technology Field

[0001] The present invention is a technology for detecting anomalies based on a prediction-based detection algorithm and a Large Language Model (LLM), and is a technology for detecting anomalies in environmental data detected in a target environment through a prediction-based algorithm and providing an explanation of anomaly phenomena that can be understood through the LLM. Background Technology

[0002] In recent years, anomaly detection has become critical due to the rapid increase in data-driven applications and the growing complexity of modern systems. Anomalies, which indicate potentially harmful behavior within a system, can often lead to long-term impacts and widespread consequences across various domains, such as industrial operations.

[0003] Conventionally, such anomaly detection methods have often relied heavily on expert analysis; however, these methods have the disadvantage of potential inconsistencies and reliability depending on the type of data sensed or the views and opinions of the analyst. Considering this, anomaly detection technologies based on statistical and machine learning approaches have recently been introduced; however, there is a problem in that anomalies can be multidimensional and cannot be easily characterized by existing patterns.

[0004] Furthermore, a large number of sensors, ranging from hundreds to thousands, are required to thoroughly identify anomaly issues in industrial environments. However, the rapid increase in sensors inevitably leads to the generation of vast amounts of data, necessitating a robust IoT platform capable of efficiently managing these numerous sensors, preserving the generated data, and performing autonomous data analysis. Additionally, there have been limitations in processing time-series data from multiple sensors. This presents reliability issues, such as the generation of a significant number of false alarms related to anomalies.

[0005] Meanwhile, the alarm generated when an abnormal sign is detected merely conveys information regarding whether an abnormal sign exists and presents a one-dimensional programmed response. Consequently, actual users had to seek the cause and response measures based on whether an abnormal sign existed, and this remains a challenge for automating abnormal signs and responses in smart factories. Prior art literature

[0006] Prior Art 1: Korean Published Patent No. 10-2019-0081691 (Registered July 9, 2019) The problem to be solved

[0007] The present invention aims to provide a highly reliable anomaly detection device by automating anomaly detection through an edge server connected to an IoT device-based end device and iteratively learning a deep learning-based anomaly detection model.

[0008] In addition, the present invention aims to provide a prediction-based anomaly detection method that improves reliability "G consistency" based on multidimensional time-series sensing data acquired by a plurality of sensors.

[0009] Furthermore, the present invention aims to provide an anomaly detection system that integrates a high-performance Large Language Model (LLM) and a prediction-based algorithm to reconstruct anomalies into human-understandable language when detected, and to present the analysis and inference results of data related to the anomalies as well as countermeasures.

[0010] The objectives of the present invention are not limited to the problems mentioned above, and other objectives and advantages of the present invention not mentioned may be understood from the following description and will be more clearly understood from the embodiments of the present invention. Furthermore, it will be understood that the objectives and advantages of the present invention can be realized by the means and combinations thereof set forth in the claims. means of solving the problem

[0011] One embodiment of the present invention provides an edge server device comprising: a communication unit configured to receive environment data from an end device that detects the environment of a target space and to transmit and receive data with a cloud server that runs a Large Language Model (LLM); a prediction unit that performs a prediction on environment data based on a deep learning-based prediction model; a detection unit that detects an abnormal section in which an abnormal sign appears within the environment data based on the prediction; and a prompt generation unit that generates a prompt that causes the Large Language Model to generate an explanation of the abnormal sign based on environment data corresponding to the abnormal section, wherein the communication unit transmits the prompt to the cloud server.

[0012] One embodiment of the present invention provides an edge server device in which the environment data is time-series data regarding the environment of a target space detected by an end device.

[0013] One embodiment of the present invention provides an edge server device characterized in that the prediction model operates based on ConvLSTM (Convolutional Long Short-Term Memory).

[0014] One embodiment of the present invention provides an edge server device in which a detection unit sets a confidence interval based on a prediction and detects an abnormal interval in environmental data where actual data deviates from the confidence interval.

[0015] One embodiment of the present invention provides an edge server device in which the confidence range is set based on a non-parametric dynamic thresholding for the error of the prediction.

[0016] One embodiment of the present invention provides an edge server device further comprising a learning unit that trains a prediction model through collected environmental data.

[0017] One embodiment of the present invention provides an edge server device configured to retrain a prediction model based on recent data when the ratio of an abnormal interval is greater than or equal to a preset ratio.

[0018] One embodiment of the present invention provides an anomaly detection method performed by a processor, comprising the steps of: receiving environment data from an end-device that detects the environment of a target space; performing a prediction on the environment data based on a deep learning-based prediction model; detecting an anomaly section in which an anomaly appears within the environment data based on the prediction; generating a prompt that causes a large language model to generate an explanation of the anomaly based on the environment data corresponding to the anomaly section; and transmitting the prompt to a cloud running a large language model (LLM).

[0019] An anomaly detection system comprising an end device that detects the environment of a target space, a cloud server that runs a Large Language Model (LLM), and an edge server that transmits and receives data with the end device and the cloud server, wherein the edge server receives environment data from the end device that detects the environment of the target space, performs a prediction on the environment data based on a deep learning-based prediction model, detects an anomaly section in which an anomaly appears within the environment data based on the prediction, and, based on the environment data corresponding to the anomaly section, generates a prompt that causes the Large Language Model to generate an explanation of the anomaly and transmits it to the cloud server, and the cloud server is configured to receive the prompt and generate an explanation of the anomaly based on the LLM.

[0020] Other aspects, features, and advantages other than those described above will become apparent from the following drawings, claims, and detailed description of the invention. Effects of the invention

[0021] The edge server device according to the present invention is connected to an IoT device-based end device to automate anomaly detection and can provide a highly reliable anomaly detection device through iterative learning.

[0022] In addition, the anomaly detection method according to the present invention can improve reliability "G consistency while being based on multidimensional time-series sensing data obtained by a plurality of sensors.

[0023] The anomaly detection system according to the present invention integrates a high-performance Large Language Model (LLM) and a prediction-based algorithm to reconstruct an anomaly into human-understandable language when detected, and can present the analysis and inference results of data related to the anomaly and countermeasures.

[0024] The effects of the present invention are not limited to those mentioned above, and other unmentioned effects will be clearly understood by those skilled in the art from the description below. Brief explanation of the drawing

[0025] FIG. 1 is a drawing for explaining an abnormal sign detection system according to one embodiment of the present invention. FIG. 2 is a block diagram illustrating the configuration of an edge server according to an embodiment of the present invention. FIG. 3 is a block diagram showing the functional configuration of an edge server according to one embodiment of the present invention. Figure 4 is a diagram illustrating the configuration of a prediction model according to one embodiment of the present Bamryeong. Figure 5 is a graph showing the abnormal section detection results according to one embodiment of the present invention. FIG. 6 is a diagram showing the explanation and inference results regarding abnormal signs according to one embodiment of the present invention. FIG. 7 is a flowchart illustrating a method for detecting abnormal signs according to an embodiment of the present invention. Specific details for implementing the invention

[0026] Hereinafter, embodiments disclosed in this specification will be described in detail with reference to the attached drawings. Identical or similar components regardless of drawing symbols will be assigned the same reference number, and redundant descriptions thereof will be omitted. The suffixes "module" and "part" used for components in the following description are assigned or used interchangeably solely for the ease of drafting the specification and do not inherently possess distinct meanings or roles. Furthermore, in describing embodiments disclosed in this specification, if it is determined that a detailed description of related prior art could obscure the essence of the embodiments disclosed in this specification, such detailed description will be omitted. Additionally, the attached drawings are intended only to facilitate understanding of the embodiments disclosed in this specification; the technical concept disclosed in this specification is not limited by the attached drawings, and it should be understood that they include all modifications, equivalents, and substitutions that fall within the spirit and technical scope of the present invention.

[0027] Terms containing ordinal numbers, such as first, second, etc., may be used to describe various components, but the components are not limited by the terms. The terms are used solely for the purpose of distinguishing one component from another.

[0028] When it is stated that one component is "connected" or "connected" to another component, it should be understood that while it may be directly connected or connected to that other component, there may also be other components in between. On the other hand, when it is stated that one component is "directly connected" or "directly connected" to another component, it should be understood that there are no other components in between.

[0029] An anomaly detection system according to an embodiment of the present invention will be described with reference to FIG. 1. The anomaly detection system according to the present invention may include an edge server (10) that transmits and receives data to and from an end device (20) and a cloud server (30), and a cloud server (30) that runs an end device (20) and a Large Language Model (LLM).

[0030] In one embodiment, the anomaly detection system is a sensor-based IoT system that is utilized as a system for sensing the environment of a factory or smart factory applied to an industrial environment and detecting signs of anomalies, and can perform data processing, device management, data flow control, and data integration of various devices.

[0031] The edge server (100) can be implemented as a computing device capable of connecting to a remote server or terminal via a network, and can refer to any device implemented in a form that performs the above-described function.

[0032] The edge server (10) is responsible for data aggregation, edge computation, and real-time remote data analysis. In one embodiment, the edge server (10) may be configured to receive environment data from an end device (20) that detects the environment of a target space, perform a prediction on the environment data based on a deep learning-based prediction model, detect an abnormal section in which an abnormal sign appears in the environment data based on the prediction, and generate environment data corresponding to the abnormal section as a prompt in the form of a large-scale language model and transmit it to a cloud server (30).

[0033] At this time, the environment data is time-series data regarding the environment of the target space detected by the end device (20), for example, data regarding the temperature, humidity, and air quality of the target space, which can be acquired and stored in real time by the end device (20) or the sensor unit (21).

[0034] In one embodiment, such environment data is stored using a MongoDB time-series collection. This allows for efficient data storage and reduces missing data and latency.

[0035] The function of the edge server (10) extends to predicting anomalies for each sensor and then generating a prompt that is sent to the cloud server (30) for further analysis. In one embodiment, the prediction model for predicting these anomalies may be an LSTM-based model, which is described in detail below.

[0036] The end device (20) is an IoT device and may include a sensor unit (21) that detects the environment of the target space and a driving unit (22) that is driven by receiving a control signal from the edge server (10).

[0037] In addition, the end device (20) and the edge server (10) can exchange data with each other through IoT communication. Specifically, for seamless data exchange, communication protocols such as Zigbee, Wi-Fi, LoRa, and NB-IoT, and communication software such as MQTT, RestAPI, OPC-UA, Modbus, and CoAP can be used.

[0038] In one embodiment, a PLC device may be further included to manage data collection of the sensor unit (21) and to control the driving unit (22). The PLC may include electronic devices for digital operation that use programmable memory to perform special functions such as logic, sequencing, timing, counting, and calculation through digital or analog input / output modules, and that control various types of machines or processors. Such a PLC transmits Modbus RTU and Modbus data to the edge server (10). Specifically, the PLC may include Wago PLC PFC200 750-8212 and Schneider Modicon M262 devices, but some sensor units (21) included in the end device (20) may transmit data directly to the edge server (10) via MQTT, etc. without a PLC.

[0039] The cloud server (30) receives a prompt and generates descriptions and inferences regarding abnormal sections and abnormal signs based on LLM. These descriptions of abnormal signs can be sent directly to a maintenance operator for verification.

[0040] In one embodiment, the cloud server (30) supports data visualization, system reporting, and maintenance functions, thereby enabling the establishment of a stable operation and maintenance system.

[0041] The cloud server (10) includes a Local Area Network (LAN), a Wide Area Network (WAN), the Internet (WWW: World Wide Web), wired and wireless data networks, telephone networks, wired and wireless television networks, etc. Wireless data networks include, but are not limited to, 3G, 4G, 5G, 3GPP (3rd Generation Partnership Project), 5GPP (5th Generation Partnership Project), LTE (Long Term Evolution), WIMAX (World Interoperability for Microwave Access), Wi-Fi, the Internet, LAN (Local Area Network), Wireless LAN (Wireless Local Area Network), WAN (Wide Area Network), PAN (Personal Area Network), RF (Radio Frequency), Bluetooth networks, NFC (Near-Field Communication) networks, satellite broadcasting networks, analog broadcasting networks, DMB (Digital Multimedia Broadcasting) networks, etc.

[0042] Referring to FIG. 2, the configuration of an edge server (10) according to an embodiment of the present invention will be described. The edge server (10) shown in FIG. 2 corresponds to the server (10) of FIG. 1, and redundant descriptions regarding the functions of the edge server (10) will be omitted.

[0043] The edge server (10) may include a processor (110), memory (120), a learning processor (130), a communication unit (140), an output unit (150), and an input unit (160).

[0044] The processor (110) is a type of central processing unit that can execute one or more codes for implementing an anomaly detection system stored in memory (120) and generate electrical signals to control other components of the edge server (10).

[0045] The processor (110) may include any type of device capable of processing data. The processor (100) may mean a data processing device embedded in hardware, having a physically structured circuit to perform a function expressed by code or instructions included in a program, for example.

[0046] Examples of data processing devices embedded in hardware as described above include, but are not limited to, microprocessors, central processing units (CPUs), processor cores, multiprocessors, application-specific integrated circuits (ASICs), and field programmable gate arrays (FPGAs).

[0047] The processor (110) may include at least one processor. The processor (110) may include at least one processor deployed in a plurality of computing devices.

[0048] The memory (120) can store one or more instructions that enable the edge server (10) to implement an anomaly detection system according to the present invention, and can store one or more codes that are operablely connected to the processor (110) and cause the processor (110) to perform part of the anomaly detection method according to the present invention.

[0049] The memory (120) is capable of storing data and software and may include a volatile or non-volatile recording medium. The memory (120) is connected to one or more processors (110) via an electrical or internal communication interface and may store code that causes the processor (110) to control the server device (100) when executed by the processor (110).

[0050] Here, the memory (120) may include a non-transient storage medium such as a magnetic storage medium or a flash storage medium, or a transient storage medium such as RAM, but the scope of the present invention is not limited thereto. Such memory (120) may include internal memory and / or external memory, and may include volatile memory such as DRAM, SRAM, or SDRAM, non-volatile memory such as OTPROM (one-time programmable ROM), PROM, EPROM, EEPROM, mask ROM, flash ROM, NAND flash memory, or NOR flash memory, flash drives such as SSD, CF (compact flash) card, SD card, Micro-SD card, Mini-SD card, Xd card, or memory stick, or storage devices such as HDD.

[0051] In one embodiment, a deep learning-based prediction model (121) may be stored in the memory (120) to perform anomaly detection and prediction on environmental data.

[0052] In the present disclosure, the prediction model (121) refers to an artificial neural network model that performs data-based learning, including artificial intelligence and deep learning. The prediction model (121) may correspond to a trained model, which is an artificial neural network whose parameters are estimated by being trained using training data.

[0053] The prediction model (121) may be implemented in hardware, software, or a combination of hardware and software, and if part or all of the learning model is implemented in software, data including one or more instructions (code) and parameters constituting the prediction model may be stored in memory.

[0054] Additionally, the prediction model (120) may be based on an artificial neural network, and the artificial neural network may refer to a model in which artificial neurons (nodes) that form a network through the combination of synapses change the strength of the synapse combinations through learning to have problem-solving capabilities.

[0055] An artificial neural network may include multiple layers, and each of the layers may include multiple neurons. Additionally, an artificial neural network may include synapses connecting the neurons.

[0056] An artificial neural network composed of multiple layers consists of an input layer, one or more hidden layers, and an output layer. There may be multiple hidden layers.

[0057] The input layer is a layer that receives external data, and the number of neurons in the input layer is equal to the number of input variables. The hidden layer is located between the input layer and the output layer, receives signals from the input layer, extracts features, and transmits them to the output layer. Input signals between neurons are multiplied by their respective connection strengths (weights) and then summed; if this sum is greater than the neuron's threshold, the neuron is activated and outputs the value obtained through the activation function.

[0058] In one embodiment, the prediction model (121) may be an LSTM or ConVLSTM-based model, and this is described in detail below.

[0059] In one embodiment, the memory (120) may include a database (122) that stores environmental data for driving a prediction model (121). The database (122) may be a place for loading environmental data used in an anomaly detection system according to the present invention.

[0060] The database (122) may constitute a part of the memory (120) and may be implemented in such a way that it is located outside the server device (10) rather than inside the server (10) as in FIG. 2, and provides loaded data to the server (10) through the communication unit (140).

[0061] In one embodiment, the edge server (10) may additionally be equipped with a learning processor (130) in addition to the processor (110) to learn and operate the prediction model (120). The learning processor (130) can determine optimized model parameters of the artificial neural network by iteratively training the artificial neural network using various learning techniques described above.

[0062] The learning processor (130) may be configured to receive, classify, store, and output information to be used for data mining, data analysis, intelligent decision-making, and machine learning algorithms and techniques.

[0063] The learning processor (130) may include one or more memory units configured to store data received, detected, sensed, generated, predefined, or output by a component, device, terminal, or device communicating with the terminal.

[0064] In one embodiment, the learning processor (130) may be implemented using memory maintained in a cloud computing environment, or another remote memory location accessible by a terminal through a communication method such as a network.

[0065] The learning processor (130) may be configured to store data in one or more databases (122) to identify, index, categorize, manipulate, store, retrieve, and output the data for use in general or unsupervised learning, data mining, predictive analytics, or other machines.

[0066] The communication unit (140) can transmit and receive data to implement an anomaly detection system using wired and wireless communication technology. The communication unit (140) can transmit and receive sensor information, user input, control signals, etc., with external devices.

[0067] The communication unit (140) is configured to transmit and receive data with the end device (20) and the cloud server (30), specifically, it can receive environment data of the target space from the end device (10) or transmit a prompt to the cloud server (30) to generate an explanation and analysis of anomalies by a large-scale language model driven by the cloud server (30).

[0068] The communication unit (140) can use communication technologies such as GSM (Global System for Mobile communication), CDMA (Code Division Multi Access), CDMA2000 (Code Division Multi Access 2000), EV-DO (Enhanced Voice-Data Optimized or Enhanced Voice-Data Only), WCDMA (Wideband CDMA), HSDPA (High Speed ​​Downlink Packet Access), HSUPA (High Speed ​​Uplink Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution-Advanced), WLAN (Wireless LAN), Wi-Fi (Wireless-Fidelity), Bluetooth (Bluetooth), RFID (Radio Frequency Identification), Infrared Data Association (IrDA), ZigBee, NFC (Near Field Communication), Visible Light Communication, Li-Fi (Light Fidelity), etc.

[0069] The communication unit (140) can use a 5G communication network. The communication unit (140) can communicate using at least one of the services of eMBB (Enhanced Mobile Broadband), URLLC (Ultra-reliable and low latency communications) and mMTC (Massive Machine-type communications).

[0070] In one embodiment, the end device (20) and the edge server (10) can exchange data with each other through IoT communication. At this time, the communication unit (140) may use communication protocols such as Zigbee, Wi-Fi, LoRa, NB-IoT and communication software such as MQTT, RestAPI, OPC-UA, Modbus, and CoAP for data exchange.

[0071] The output unit (150) is intended to display the output of the edge server (10) to the outside to convey information to the user, and may include a display, LED, speaker, etc. for displaying visual output, auditory output, or tactile output.

[0072] The input unit (160) is configured to receive user signals and can receive user-defined parameters, etc., for implementing an abnormality detection system.

[0073] The input unit (160) includes a user interface (UI) that includes a microphone and a touch interface for receiving information from a user. The user interface may include a mouse, a keyboard, as well as mechanical or electronic interfaces implemented in the device, and the method and form are not specifically limited as long as it is capable of inputting user commands. The electronic interface includes a touch-input capable display.

[0074] Referring to FIG. 3, the configuration of an edge server (10) according to an embodiment of the present invention will be described. The edge server (10) shown in FIG. 3 corresponds to the edge server (10) of FIG. 1 and FIG. 2, and redundant descriptions below will be omitted.

[0075] According to FIG. 3, the edge server 10) may include a communication unit (210), a prediction unit (220), a detection unit (230), a prompt generation unit (240), and a learning unit (250).

[0076] The communication unit (210) illustrated in FIG. 3 corresponds to the communication unit (140) of FIG. 2, and the prediction unit (220), detection unit (230), prompt generation unit (240), and learning unit (250) may be implemented as part of a computing device or processor that is implemented to perform the corresponding functions in the processor (110).

[0077] The prediction unit (220) performs predictions on environmental data based on a deep learning-based prediction model. The prediction model may be a model based on LSTM or ConvLSTM, and a detailed description of the prediction model is described below with reference to FIG. 4.

[0078] The detection unit (230) detects abnormal sections in which abnormal signs appear within the environmental data based on the prediction performed by the prediction unit (220). At this time, a confidence interval based on the prediction is set, and sections in which the actual data within the environmental data deviates from the confidence interval can be detected as abnormal sections with abnormal signs.

[0079] In one embodiment, the confidence range may be set based on a non-parametric dynamic thresholding for the prediction error. The confidence range is described in detail below with reference to FIG. 5.

[0080] The prompt generation unit (240) generates a prompt that causes a large-scale language model to generate an explanation of an abnormal sign based on environment data corresponding to the abnormal section.

[0081] The learning unit (250) trains a prediction model using environmental data.

[0082] In one embodiment, anomalies are determined based on predictions made by a prediction model, and if there are too many time intervals determined to be abnormal, it may be determined that the prediction model needs to be retrained.

[0083] To this end, if the ratio of detected abnormal intervals exceeds a preset ratio, the prediction model can be retrained based on recent data, thereby enabling continuous training.

[0084] For example, if the time interval detected as an abnormal interval is 5% or more of the total data, the learning unit (250) can train a prediction model using recent environmental data collected through the communication unit (210).

[0085] Through such continuous learning, recent data can be reflected in the prediction model, and according to one embodiment, the prediction model can ensure reliability in anomaly detection while learning environmental data unsupervisedly.

[0086] A prediction model according to one embodiment of the present invention will be described with reference to FIG. 4.

[0087] In one embodiment, the prediction model (221) may be constructed based on a Long Short-Term Memory (LSTM) model. An STM is a specialized iteration of a Recurrent Neural Network (RNN) and can overcome the shortcomings of existing RNNs, which cannot effectively handle long-term temporal dependencies. Compared to an RNN, an LSTM incorporates a memory unit within the LSTM to preserve cell states over a long period of time so that long-term dependencies can be easily learned.

[0088] In addition, as shown in Figure 4, the prediction model can operate based on ConvLSTM (Convolutional LSTM). In the case of ConvLSTM, spatial information is captured by integrating convolutional layers, and then a recurrent neural network-based technique including LSTM and Gated Recurrent Unit is applied. Through this, predictions for the data can be performed by considering both temporal and spatial characteristics.

[0089] According to the above embodiment, when performing environmental data prediction through a ConvLSTM-based prediction model (221), the prediction can be performed by considering spatial information compared to a general time series prediction model based on RNN.

[0090] In one embodiment, the prediction model (221) may use Adam as the optimization function. This allows for effective processing of data with sparse gradients and noise, and enables efficient optimization, especially when environmental data is a complex and large-scale data set obtained through multiple sensors.

[0091] Referring to FIG. 5, a method for detecting an abnormal section according to an embodiment of the present invention will be described.

[0092] Referring to FIG. 5, the detection unit (230) can set a confidence interval based on prediction and detect an abnormal interval in the environmental data where the actual data deviates from the confidence interval. At this time, the confidence interval can be determined based on a non-parametric dynamic thresholding for the error of the prediction. Through this, a fast, unsupervised learning-based prediction model (221) can be provided that can efficiently detect abnormal signs in thousands of environmental data affected by changing environmental conditions and command sequences.

[0093] The nonparametric dynamic threshold according to the present invention may include error smoothing, threshold calculation, and anomaly score calculation steps.

[0094] In one embodiment, the nonparametric dynamic threshold can be determined based on the following mathematical formula 1.

[0095]

[0097] At this time, is the error, is the smoothed error, and is the selected threshold, is the error sequence, represents the degree of error. When applying the data using the above mathematical formula, a threshold value can be found that can most significantly reduce the average error and error distribution of the prediction.

[0098] Based on these non-parametric dynamic thresholds, the upper and lower limits of the confidence range for the predictions performed by the prediction unit can be determined.

[0099] FIG. 5 shows humidity and temperature data, prediction data, confidence range, and abnormal interval detection results obtained from an end device of a target space according to one embodiment.

[0100] As shown in Figure 5, the predicted data follows the data trend of the actual data. Since the data exhibits changing patterns at various points, rapid adaptation of the model to such dynamic environmental changes is required. By applying a non-parametric dynamic threshold according to the present invention to set a confidence range, the model can be enabled to effectively adapt to and accommodate these changing data patterns.

[0101] FIG. 6 shows the result of generating an anomaly description performed by the cloud in an anomaly detection system according to one embodiment.

[0102] In one embodiment according to the present invention, an edge server transmits data and a prompt indicating an anomaly to a cloud server included in an anomaly detection system, thereby enabling the cloud server running a large-scale language model to generate an explanation and inference regarding the anomaly.

[0103] In this embodiment, the explanatory results generated by a finely tuned GPT-4 model as a large-scale language model are shown.

[0104] By generating and providing explanations for abnormal signs in this way, users or environment managers can easily understand them and quickly identify the root cause of the problem.

[0105] In addition, according to one embodiment, the generated description is highly associated with the anomaly and therefore includes inference regarding the relationship between the observed data pattern and the anomaly. The generated description and inference can effectively highlight specific aspects of the data that led to the detection of the anomaly, thereby providing insight into the root cause of the anomaly.

[0106] Referring to FIG. 6, a specific embodiment can be seen in which a language model driven by the cloud processes input data and provides an explanation of detected anomalies. As shown in FIG. 6, one embodiment of the present invention can understand data related to anomalies and generate a related explanation and deliver it in a human-readable format.

[0107] In one embodiment, the input data of this large-scale language model, driven by a cloud server, may include environmental data and related information sensed by various end devices. Through this, the cloud server can generate a well-structured description and provide insights into detected anomalies, potential causes, and even proposed action plans.

[0108] A method for detecting abnormal signs according to an embodiment of the present invention will be described with reference to FIG. 7.

[0109] An anomaly detection method according to one embodiment of the present invention may be performed by a processor and may include the steps of: receiving environment data from an end-device that detects the environment of a target space (S110); performing a prediction on the environment data based on a deep learning-based prediction model (S120); detecting an anomaly section in which an anomaly appears in the environment data based on the prediction (S130); generating a prompt that causes a large language model to generate an explanation of the anomaly based on the environment data corresponding to the anomaly section (S140); transmitting the prompt to a cloud running a large language model (LLM) (S150); and, if the ratio of the detected anomaly section is greater than or equal to a preset ratio, retraining the prediction model based on recent data (S160).

[0110] The above-described disclosure can be implemented as computer-readable code on a medium on which a program is recorded. A computer-readable medium includes all types of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable media include a Hard Disk Drive (HDD), a Solid State Disk (SSD), a Silicon Disk Drive (SSD), ROM, RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc. Additionally, the computer may include a processor for each device.

[0111] Meanwhile, the program may be one specifically designed and configured for the present disclosure or one known and available to a person skilled in the art of computer software. Examples of programs may include machine code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc.

[0112] In the specification of this disclosure (particularly in the claims), the use of the term "above" and similar descriptive terms may be in both singular and plural. Furthermore, where a range is described in this disclosure, it is to include the invention to which individual values ​​belonging to the range are applied (unless otherwise stated), and is equivalent to describing each individual value constituting the range in the detailed description of the invention.

[0113] Unless explicitly stated otherwise, the steps constituting the method according to the present disclosure may be performed in a suitable order. The present disclosure is not necessarily limited by the order in which the steps are described. The use of any examples or exemplary terms (e.g., etc.) in the present disclosure is merely for the purpose of describing the present disclosure in detail, and the scope of the present disclosure is not limited by such examples or exemplary terms unless limited by the claims. Furthermore, a person skilled in the art will understand that various modifications, combinations, and changes may be made according to design conditions and factors within the scope of the claims or equivalents to which they are added.

[0114] Accordingly, the scope of the present disclosure should not be limited to the described embodiments, and all scopes equivalent to or equivalently modified from the claims set forth below, as well as the claims set forth below, shall be considered to fall within the scope of the scope of the present disclosure. Explanation of the symbols

[0115] 10: Edge Server 20: End device 30: Cloud Server

Claims

Claim 1 A communication unit configured to receive environment data from an end device that detects the environment of a target space and to transmit and receive data with a cloud server running a Large Language Model (LLM); a prediction unit that performs a prediction on the environment data based on a deep learning-based prediction model; and a detection unit that detects an abnormal section in the environment data where abnormal signs appear based on the prediction. An edge server device comprising: a prompt generation unit that generates a prompt that causes a large-scale language model to generate an explanation of the anomaly based on environment data corresponding to the anomaly interval; a communication unit that transmits the prompt to the cloud server; a detection unit that sets a confidence interval based on the prediction and detects an interval in the environment data where actual data deviates from the confidence interval as the anomaly interval; the confidence interval is set based on a non-parametric dynamic thresholding for the error of the prediction; the non-parametric dynamic thresholding is calculated by including error smoothing for the prediction error and calculation of anomaly degree based on the error, and is determined to reduce the average error and error distribution of the prediction; and the confidence interval is set to include an upper and lower limit of the confidence interval for the prediction based on the non-parametric dynamic thresholding. Claim 2 In claim 1, the edge server device, wherein the environment data is time-series data regarding the environment of the target space detected by the end device. Claim 3 An edge server device according to claim 1, wherein the prediction model operates based on ConvLSTM (Convolutional Long Short-Term Memory). Claim 4 delete Claim 5 delete Claim 6 An edge server device according to claim 1, further comprising a learning unit that trains the prediction model through the collected environment data. Claim 7 In claim 6, the learning unit is configured to retrain the prediction model based on recent data when the ratio of the abnormal interval is greater than or equal to a preset ratio, in an edge server device. Claim 8 A method for detecting anomalies performed by a processor comprises: receiving environment data from an end-device that detects the environment of a target space; performing a prediction on the environment data based on a deep learning-based prediction model; detecting an anomaly section in which an anomaly appears within the environment data based on the prediction; generating a prompt that causes the large language model to generate an explanation of the anomaly based on the environment data corresponding to the anomaly section; and transmitting the prompt to a cloud running the large language model (LLM), wherein the detection step includes setting a confidence interval based on the prediction. A method for detecting anomalies, comprising the step of detecting an abnormal interval in the above environment data where actual data deviates from the above confidence range, wherein the step of setting the confidence range is a step of setting the confidence range based on a non-parametric dynamic thresholding for the error of the prediction, wherein the non-parametric dynamic thresholding is calculated by including error smoothing for the error of the prediction and calculation of an anomaly degree based on the error, and is determined to reduce the average error and error distribution of the prediction, and wherein the confidence range is set to include an upper limit and a lower limit of the confidence range for the prediction based on the non-parametric dynamic thresholding. Claim 9 A method for detecting abnormal signs according to claim 8, wherein the environment data is time-series data regarding the environment of the target space detected by the end device. Claim 10 A method for detecting abnormal signs according to claim 8, wherein the prediction model operates based on ConvLSTM (Convolutional Long Short-Term Memory). Claim 11 delete Claim 12 delete Claim 13 A method for detecting anomalies according to claim 8, further comprising the step of retraining the prediction model based on recent data when the ratio of the detected anomaly interval is greater than or equal to a preset ratio. Claim 14 An end device that detects the environment of the target space; a cloud server that runs a Large Language Model (LLM); The system includes an edge server that transmits and receives data with the end device and the cloud server, wherein the edge server receives environment data from an end device that detects the environment of a target space, performs a prediction on the environment data based on a deep learning-based prediction model, sets a confidence interval based on the prediction, detects a section in the environment data where actual data deviates from the confidence interval as an anomaly section, and is configured to generate a prompt that causes the large-scale language model to generate an explanation of the anomaly based on the environment data corresponding to the anomaly section, and transmits it to the cloud server; wherein the confidence interval is set based on a non-parametric dynamic thresholding for the error of the prediction, wherein the non-parametric dynamic thresholding is calculated by including error smoothing for the error of the prediction and calculation of anomaly degree based on the error, and is determined to reduce the average error and error distribution of the prediction, and wherein the confidence interval includes an upper and lower limit of the confidence interval for the prediction based on the non-parametric dynamic thresholding. An anomaly detection system configured such that the cloud server receives the prompt and is configured to generate a description of the anomaly based on the LLM. Claim 15 In claim 14, the abnormal sign detection system, wherein the environment data is time-series data regarding the environment of the target space detected by the end device. Claim 16 An anomaly detection system according to claim 14, wherein the prediction model operates based on ConvLSTM (Convolutional Long Short-Term Memory). Claim 17 delete Claim 18 delete Claim 19 In claim 14, the edge server is configured to retrain the prediction model based on recent data when the ratio of the abnormal interval is greater than or equal to a preset ratio, thereby forming an abnormal sign detection system. Claim 20 In claim 14, the cloud server is configured to transmit a description of the generated abnormal signs to an administrator terminal, an abnormal sign detection system.

Images