Artificial intelligence-based method for detecting anomalies in time-series data using global and local features

Abstract

The present method for detecting anomalies in time-series data comprises the steps of: acquiring time-series data; extracting global features and local features from the acquired time-series data; classifying a type of the time-series data by performing hierarchical clustering on the basis of the global features and the local features; training a data prediction model using results of the hierarchical clustering; training an Isolation Forest model for anomaly determination by applying features combined into a vector form; and detecting anomalies in the time-series data by using the data prediction model and the Isolation Forest model.

Description

AI-based time-series data anomaly detection method utilizing global and regional characteristics

[0001] The present invention relates to a method for detecting anomalies in time series data, and more specifically, to a method for detecting anomalies in time series data utilizing anomaly detection model training.

[0002] Time series data containing noise, spikes, and periodic variations presents a problem in that accurate anomaly detection is difficult due to the reliance on data characteristics heavily focused on statistical information.

[0003] Specifically, existing time-series data anomaly detection methods have limitations in that they judge anomalies using a single model without considering the differences in global and local characteristics across time-series data, resulting in degraded anomaly detection performance as data changes.

[0004] The present invention has been devised to solve the above-mentioned problems, and the objective of the present invention is to provide a time series data anomaly detection method that extracts global and local features to improve the anomaly detection performance for various types of time series data, trains an artificial intelligence-based data anomaly detection model using these features, and determines anomalies by applying an ensemble technique to the training results according to the type of time series data.

[0005] A method for detecting anomalies in time series data according to an embodiment of the present invention for achieving the above objective comprises: a system acquiring time series data; a system extracting global features and local features of the acquired time series data; a system classifying the type of time series data by performing hierarchical clustering based on the extracted global features and local features; a system training a data prediction model using the results of the hierarchical clustering; a system training an Isolation Forest model for determining outliers by applying features combined in vector form to the Isolation Forest model; and a system performing anomaly detection in time series data using the data prediction model and the Isolation Forest model.

[0006] And the step of extracting global and local features can extract the overall time series mean, standard deviation, value range, kurtosis, skewness, and autocorrelation when extracting global features.

[0007] In addition, in the step of extracting global and local features, the moving average and standard deviation per window can be extracted by utilizing the sliding window technique when extracting local features.

[0008] And the step of classifying the type of time series data may include: a step of combining extracted global features and local features into a vector form; and a step of classifying the type of time series data by performing hierarchical clustering on the features combined into a vector form.

[0009] In addition, the step of classifying the types of time-series data by performing hierarchical clustering on features combined in vector form may utilize UMAP (Uniform Manifold Approximation and Projection), a dimensionality reduction technique for mapping high-dimensional data to a low-dimensional space, to represent features combined in vector form as a single feature point.

[0010] Furthermore, the step of training a data prediction model using the results of hierarchical clustering allows for training the data prediction model for each cluster classified through hierarchical clustering, by considering the differences existing in the global and local features of the time series data.

[0011] In addition, the Isolation Forest model can detect isolated data step by step by considering data patterns.

[0012] And the step of performing anomaly detection on time series data involves having the trained Isolation Forest model produce an ensemble score for the time series data, and the ensemble score for the time series data can be used as a threshold for determining outliers.

[0013] In addition, the step of performing anomaly detection on time series data can be performed by comparing the prediction results of the data prediction model trained for each cluster with the threshold value (ensemble score) for determining outliers calculated by the trained Isolation Forest model.

[0014] Meanwhile, a time series data anomaly detection system according to another embodiment of the present invention comprises: an input unit for acquiring time series data; and a processor for extracting global and local features of the acquired time series data, classifying the type of time series data by performing hierarchical clustering based on the extracted global and local features, training a data prediction model using the results of the hierarchical clustering, training an Isolation Forest model for determining outliers by applying features combined in vector form to the data prediction model and the Isolation Forest model, and performing anomaly detection of the time series data using the data prediction model and the Isolation Forest model.

[0015] A time series data anomaly detection method according to another embodiment of the present invention comprises: a step in which a system extracts global features and local features of time series data; a step in which the system combines the extracted global features and local features into a vector form; a step in which the system classifies the type of time series data by performing hierarchical clustering on the features combined into a vector form; a step in which the system trains a data prediction model for each cluster classified through hierarchical clustering; a step in which the system trains an Isolation Forest model for determining outliers by applying the features combined into a vector form to the Isolation Forest model; and a step in which the system performs anomaly detection of time series data by utilizing the data prediction model and the Isolation Forest model.

[0016] Additionally, a time series data anomaly detection system according to another embodiment of the present invention comprises: a feature extraction unit for extracting global features and local features of time series data; a clustering execution unit for combining the extracted global features and local features into a vector form and performing hierarchical clustering on the features combined into a vector form to classify the type of time series data; a first learning unit for training a data prediction model for each cluster classified through hierarchical clustering; a second learning unit for training an Isolation Forest model for determining outliers by applying the features combined into a vector form to the Isolation Forest model; and an anomaly detection unit for performing anomaly detection of time series data by utilizing the data prediction model and the Isolation Forest model.

[0017] As explained above, according to the embodiments of the present invention, since it is difficult for a single model to adequately perform anomaly detection for all time series data, it is possible to perform anomaly detection robust to data changes by analyzing the types of time series data and training a model that determines outliers by reflecting the distinguishing characteristics of each time series data.

[0018] FIG. 1 is a drawing provided for the description of the configuration of a time-series data anomaly detection system according to an embodiment of the present invention,

[0019] FIG. 2 is a drawing provided for a more detailed description of the configuration of a processor according to one embodiment of the present invention,

[0020] FIG. 3 is a diagram illustrating the extraction result of global features of time series data extracted through a feature extraction unit according to an embodiment of the present invention.

[0021] FIG. 4 is a diagram illustrating the extraction of time-series data local features through a feature extraction unit according to an embodiment of the present invention.

[0022] FIG. 5 is a diagram illustrating the result of hierarchical clustering performed through a clustering performing unit according to an embodiment of the present invention.

[0023] FIG. 6 is a flowchart provided for describing a time series data anomaly detection method according to an embodiment of the present invention, and

[0024] FIG. 7 is a drawing provided to describe a time series data anomaly detection method according to one embodiment of the present invention.

[0025] The present invention will be described in more detail below with reference to the drawings. To clearly explain the invention, parts unrelated to the description have been omitted from the drawings, and in the drawings, the width, length, thickness, etc., of the components may be exaggerated for convenience.

[0026] FIG. 1 is a drawing provided to describe the configuration of a time series data anomaly detection system according to one embodiment of the present invention.

[0027] The time series data anomaly detection system according to the present embodiment can determine anomalies by extracting global and local features to improve anomaly detection performance for various types of time series data, utilizing them to train an artificial intelligence-based data anomaly detection model, and applying an ensemble technique to the training results according to the type of time series data.

[0028] To this end, the time series data anomaly detection system may include an input unit (100), a processor (200), and a storage unit (300).

[0029] The input unit (100) is equipped with a communication module connected to a network, so that it can obtain time-series data from an external server connected to the network.

[0030] The storage unit (300) is provided to store programs and data necessary for the operation of the processor (200).

[0031] The processor (200) can extract global and local features to improve the performance of anomaly detection for various types of time series data and use them to train an artificial intelligence-based data anomaly detection model, apply an ensemble technique to the training results according to the type of time series data to determine anomalies, perform hierarchical clustering for the extraction of global and local features of the time series and type classification, and perform a data prediction model training and an ensemble-based anomaly determination procedure for each cluster.

[0032] Specifically, the processor (200) can classify the type of time series data by extracting global features and local features of the time series data, combining the extracted global features and local features into a vector form, and performing hierarchical clustering on the features combined into a vector form.

[0033] Additionally, the processor (200) can train a data prediction model for each cluster classified through hierarchical clustering, and train an Isolation Forest model for outlier detection by applying features combined in vector form.

[0034] Afterwards, the processor (200) can perform anomaly detection of time series data by utilizing a data prediction model and an Isolation Forest model.

[0035] FIG. 2 is a drawing provided for a more detailed description of the configuration of a processor (200) according to one embodiment of the present invention, FIG. 3 is a drawing illustrating the result of extracting global features of time series data extracted through a feature extraction unit (210) according to one embodiment of the present invention, FIG. 4 is a drawing illustrating the appearance of extracting local features of time series data extracted through a feature extraction unit (210) according to one embodiment of the present invention, and FIG. 5 is a drawing illustrating the result of hierarchical clustering performed through a clustering execution unit (220) according to one embodiment of the present invention.

[0036] Referring to FIG. 2, the processor (200) may include a feature extraction unit (210), a clustering execution unit (220), a first learning unit (230), a second learning unit (240), and an anomaly detection unit (250).

[0037] The feature extraction unit (210) is provided to extract global features and local features of the time series data.

[0038] Specifically, the feature extraction unit (210) can extract the overall time series average, standard deviation, value range, kurtosis, skewness, and autocorrelation, etc., when extracting global features, as exemplified in FIG. 3.

[0039] In addition, the feature extraction unit (210) can extract the moving average and standard deviation per window by utilizing a sliding window technique as exemplified in FIG. 4 when extracting local features.

[0040] The clustering unit (220) can classify the type of time series data by performing hierarchical clustering based on extracted global features and local features.

[0041] Specifically, the clustering unit (220) can classify the type of time series data by combining the extracted global features and local features into a vector form and performing hierarchical clustering on the features combined into a vector form.

[0042] At this time, when the clustering unit (220) performs hierarchical clustering on features combined in a vector form, it may utilize UMAP (Uniform Manifold Approximation and Projection), a dimensionality reduction technique for mapping high-dimensional data into a low-dimensional space as exemplified in FIG. 5, to represent the features combined in a vector form as a single feature point.

[0043] Here, each feature point exemplified in FIG. 5 represents time series data, and in the present invention, the clustering performing unit (220) can distinguish the type of time series data by analyzing the set of feature points through hierarchical clustering.

[0044] The first learning unit (230) is provided to train a data prediction model using the results of hierarchical clustering.

[0045] Specifically, since each cluster classified through hierarchical clustering has differences in global and local features of the time series data, the first learning unit (230) can train a data prediction model for each cluster classified through hierarchical clustering by taking into account the differences in global and local features of the time series data.

[0046] That is, when the type of time series data is classified into n clusters through hierarchical clustering in the first learning unit (230), a data prediction model is learned for each cluster, and n learned data prediction models can be generated.

[0047] And here, multiple data prediction models trained for each cluster can each be implemented as a Transformer model.

[0048] The second learning unit (240) is provided to train the Isolation Forest model by applying features combined in vector form to the Isolation Forest model for outlier detection.

[0049] The Isolation Forest model can detect isolated data step by step by considering data patterns.

[0050] The anomaly detection unit (250) can perform anomaly detection of time series data by utilizing a data prediction model and an Isolation Forest model.

[0051] Specifically, the anomaly detection unit (250) allows the trained Isolation Forest model to calculate an ensemble score for time series data, and the calculated ensemble score for time series data can be used as a threshold for determining anomalies.

[0052] That is, the anomaly detection unit (250) can detect anomalies in the time series data by comparing the prediction result (reconstruction error or prediction error) of the data prediction model learned by clusters with the threshold value (ensemble score) for determining anomalies calculated by the learned Isolation Forest model, when the features of global and local features extracted from the newly acquired time series data combined in vector form, the ensemble score for the time series data, and the prediction result (reconstruction error or prediction error) of the data prediction model learned by clusters are reflected.

[0053] Additionally, the anomaly detection unit (250) basically applies the same weight to the prediction results of the data prediction model learned for each cluster, but may apply different weights to the prediction results of the data prediction model learned for each cluster.

[0054] FIG. 6 is a flowchart provided for the description of a time series data anomaly detection method according to one embodiment of the present invention, and FIG. 7 is a drawing provided for the description of a time series data anomaly detection method according to one embodiment of the present invention.

[0055] The time series data anomaly detection method according to the present embodiment can be executed by the time series data anomaly detection system described above with reference to FIGS. 1 to 5.

[0056] Referring to FIGS. 6 and 7, the time series data anomaly detection system can classify the type of time series data by, when time series data is acquired (S610), extracting global and local features of the time series data (S620), combining the extracted global and local features into a vector form (S630), and performing hierarchical clustering on the features combined into a vector form (S640).

[0057] Subsequently, the time series data anomaly detection system can train a data prediction model by utilizing the results of hierarchical clustering (S650), and train an Isolation Forest model by applying features combined in vector form to an Isolation Forest model for determining outliers (S660).

[0058] Once the training of the data prediction model and the Isolation Forest model is complete, the time series data anomaly detection system can perform anomaly detection of the time series data by utilizing the trained data prediction model and the Isolation Forest model (S670).

[0059] Specifically, the time series data anomaly detection system can perform anomaly detection of the time series data by reflecting the features in which global and local features extracted from the newly acquired time series data are combined in vector form, the ensemble score for the time series data, and the prediction results (reconstruction error or prediction error) of the data prediction model learned by cluster.

[0060] So far, a method for detecting anomalies in time series data has been described in detail with reference to preferred embodiments.

[0061] Existing time-series data anomaly detection methods have limitations in that they judge anomalies using a single model without considering the differences in global and local characteristics among time-series data, resulting in degraded anomaly detection performance due to data changes. In contrast, according to an embodiment of the present invention, since it is difficult for a single model to adequately perform anomaly detection for all time-series data, robust anomaly detection against data changes becomes possible by analyzing the types of time-series data and training a model that judges anomalies by reflecting the distinguishable characteristics of each time-series data.

[0062] Meanwhile, it goes without saying that the technical concept of the present invention may also be applied to a computer-readable recording medium containing a computer program that enables the device and method according to the present embodiment to perform their functions. Furthermore, the technical concept according to various embodiments of the present invention may be implemented in the form of computer-readable code recorded on a computer-readable recording medium. A computer-readable recording medium may be any data storage device that can be read by a computer and store data. For example, a computer-readable recording medium may be a ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical disk, hard disk drive, etc. Additionally, computer-readable code or a program stored on a computer-readable recording medium may be transmitted through a network connected between computers.

[0063] Furthermore, although preferred embodiments of the present invention have been illustrated and described above, the present invention is not limited to the specific embodiments described above. Various modifications are possible by those skilled in the art without departing from the essence of the invention as claimed in the claims, and such modifications should not be understood individually from the technical spirit or perspective of the present invention.

Claims

1. A step in which the system acquires time series data; The system extracts global and local features of acquired time series data; A step in which the system classifies the types of time series data by performing hierarchical clustering based on extracted global and local features; A step in which the system trains a data prediction model by utilizing the results of hierarchical clustering; A step in which the system applies features combined in vector form to an Isolation Forest model for outlier detection and trains it; and A method for detecting anomalies in time series data, comprising the step of a system utilizing a data prediction model and an Isolation Forest model to perform anomaly detection in time series data.

2. In Claim 1, The step of extracting global and local features is, A time series data anomaly detection method characterized by extracting the overall time series mean, standard deviation, value range, kurtosis, skewness, and autocorrelation when extracting global features.

3. In Claim 1, The step of extracting global and local features is, A time series data anomaly detection method characterized by extracting a moving average and standard deviation per window using a sliding window technique when extracting regional features.

4. In Claim 1, The step of classifying the types of time series data is, A step of combining extracted global and local features into a vector form; and A method for detecting anomalies in time series data, characterized by including the step of classifying the type of time series data by performing hierarchical clustering on features combined in vector form.

5. In Claim 4, The step of classifying the types of time series data by performing hierarchical clustering on features combined in vector form is, A time series data anomaly detection method characterized by utilizing Uniform Manifold Approximation and Projection (UMP), a dimensionality reduction technique for mapping high-dimensional data into a low-dimensional space, to represent features combined in vector form as a single feature point.

6. In Claim 5, The step of training a data prediction model using the results of hierarchical clustering is, A time series data anomaly detection method characterized by training a data prediction model for each cluster classified through hierarchical clustering, taking into account the differences existing in global and local features of the time series data.

7. In Claim 1, The Isolation Forest model is, A time series data anomaly detection method characterized by detecting isolated data stepwise by considering data patterns.

8. In Claim 7, The step of performing anomaly detection on time series data is, To have the trained Isolation Forest model calculate ensemble scores for time series data, and The ensemble score for time series data is, A time series data anomaly detection method characterized by being used as a threshold for determining outliers.

9. In Claim 8, The step of performing anomaly detection on time series data is, A time series data anomaly detection method characterized by performing anomaly detection in time series data by comparing the prediction results of a data prediction model trained for each cluster with a threshold value (ensemble score) for outlier judgment calculated by a trained Isolation Forest model.

10. An input unit for acquiring time series data; and A time series data anomaly detection system comprising: a processor that extracts global and local features of acquired time series data, classifies the type of time series data by performing hierarchical clustering based on the extracted global and local features, trains a data prediction model using the results of hierarchical clustering, trains an Isolation Forest model for outlier detection by applying features combined in vector form to the data prediction model and the Isolation Forest model; and performs anomaly detection of the time series data using the data prediction model and the Isolation Forest model.

11. A step in which the system extracts global and local features of time series data; A step in which the system combines extracted global features and local features into a vector form; A step in which the system classifies the type of time series data by performing hierarchical clustering on features combined in vector form; A step in which the system trains a data prediction model for each cluster classified through hierarchical clustering; A step in which the system applies features combined in vector form to an Isolation Forest model for outlier detection and trains it; and A method for detecting anomalies in time series data, comprising the step of a system utilizing a data prediction model and an Isolation Forest model to perform anomaly detection in time series data.

12. Feature extraction unit for extracting global and local features of time series data; A clustering unit that combines extracted global and local features into a vector form, and performs hierarchical clustering on the features combined into a vector form to classify the type of time series data; A first learning unit that trains a data prediction model for each cluster classified through hierarchical clustering; A second learning unit that applies features combined in vector form to an Isolation Forest model for outlier detection and trains it; and A time series data anomaly detection system comprising: an anomaly detection unit that performs anomaly detection of time series data by utilizing a data prediction model and an Isolation Forest model.

Images