KR20250075220A - Abnormal detection system and method using untrained neural network - Google Patents

Abstract

The present invention relates to a non-learning neural network-based anomaly detection system and method thereof. Specifically, the present invention relates to a technology for performing anomaly detection of input data by analyzing random result values output through an artificial neural network without a learning process.

Description

Abnormal detection system and method using untrained neural network

The present invention relates to an anomaly detection system and method based on a non-learning neural network, and more specifically, to an anomaly detection system and method based on a non-learning neural network capable of performing anomaly detection on given data using an artificial neural network that has not been learned.

In general industrial fields, detection of abnormal data or abnormal data is considered important because it can have negative effects.

There are various algorithms and models for performing anomaly detection, and recently, they are based on machine learning or deep learning methods that identify the characteristics of normal data through learning from a large amount of data and utilize this.

In particular, in the case of deep learning-based methods, artificial neural networks with complex structures are trained with a large amount of data, and in the process, not only is the time actually required to construct a large amount of data and the time required for learning required, but also large computing resources are required.

In addition, it requires additional repetitive processes such as model structure change, iterative learning, and parameter tuning depending on the characteristics of the industrial domain or data to be handled.

In this regard, Korean Patent No. 10-2514795 (“Electronic device for recognizing visual stimuli based on selective neural responses naturally occurring in deep artificial neural networks and operating method thereof”) discloses a technology for obtaining visual stimuli from images without requiring a process of training an artificial neural network by measuring the responses of a random neural network to an input image and recognizing one or more visual stimuli based on the responses.

Korean Patent Registration No. 10-2514795 (Registration Date 2023.03.23.)

Accordingly, the present invention has been made to solve the problems of the prior art as described above, and an object of the present invention is to provide a non-learning neural network-based anomaly detection system and method capable of performing anomaly detection simply and efficiently without such a learning process, since the time required and computing resources required in the process of generating a model that identifies the characteristics of normal data through learning of a vast amount of data are large.

In order to achieve the above-described purpose, the non-learning neural network-based anomaly detection system of the present invention preferably includes a data input unit which receives a data set for which anomaly detection is to be performed, a neural network processing unit which inputs the data set into a pre-stored non-learning neural network model and outputs a plurality of random transformation vectors, and an anomaly determination unit which determines that each of the plurality of output random transformation vectors is abnormal data if the value is greater than a preset reference value.

Furthermore, the neural network processing unit includes a non-learning neural network model including a layer for processing input data, a layer for performing linear transformation, and an activation function layer for adding linearity, and when parameters are set so that a value of one dimension or a dimension lower than a preset target dimension is output by a layer included in the output terminal, the data set is repeatedly input to the non-learning neural network model until the output value corresponds to the number of target dimensions, and it is preferable that the network weights are initialized at each repetition.

Alternatively, the method comprises a non-learning neural network model including a layer for processing input data, a layer for performing linear transformation, a dropout layer, and an activation function layer for adding linearity, and when the parameters are set so that a value of one dimension or a dimension lower than a preset target dimension is output by a layer included in the output terminal, it is preferable to repeatedly input the data set to the non-learning neural network model until the output value corresponds to the number of target dimensions, and at each repetition, the network weight is randomly set to 0 by utilizing the dropout layer.

Alternatively, the non-learning neural network model includes a layer for processing input data, a layer for performing linear transformation, and an activation function layer for adding linearity, and when the parameters are set so that a value of a preset target dimension is output by a layer included in the output end, it is desirable that a value corresponding to the number of target dimensions is output without additional repetition.

In addition, it is preferable that the above-described abnormality judgment unit includes a reference setting unit that inputs a data set including normal data into the non-learning neural network model in advance, outputs a random transformation vector, and calculates the reference value through a preset fitting formula, and a judgment processing unit that, for calculating the reference value by the reference setting unit, substitutes each of the plurality of random transformation vectors outputted into the fitting formula using the fitting formula to which the parameters are applied, and determines that the data is abnormal if the calculated value is higher than the reference value.

In order to achieve the above-mentioned purpose, a non-learning neural network-based anomaly detection method using a non-learning neural network-based anomaly detection system in which each step is performed by an operation processing means, the method preferably includes an input step (S100) in which a data set for which anomaly detection is to be performed is input in a data input unit, an output step (S200) in which, in a neural network processing unit, the data set by the input step (S100) is input into a pre-stored non-learning neural network model and a plurality of random transformation vectors are output, and, in an abnormality determination unit, an abnormality determination step (S300) in which, with respect to each of the plurality of random transformation vectors output by the output step (S200), if the vector exceeds a preset reference value, the data is determined to be abnormal.

In addition, in the output step (S200), the non-learning neural network model includes a non-learning neural network model including a layer for processing input data, a layer for performing linear transformation, and an activation function layer for adding linearity, and when the parameters are set so that a value of one dimension or a dimension lower than a preset target dimension is output by a layer included in the output terminal, the data set is repeatedly input to the non-learning neural network model until the output value corresponds to the number of target dimensions, and it is preferable to initialize the network weights at each repetition.

Alternatively, in the output step (S200), the non-learning neural network model includes a non-learning neural network model including a layer for processing input data, a layer for performing linear transformation, a dropout layer, and an activation function layer for adding linearity, and when the parameters are set so that a value of one dimension or a dimension lower than a preset target dimension is output by a layer included in the output terminal, it is preferable to repeatedly input the data set to the non-learning neural network model until the output value corresponds to the number of target dimensions, and at each repetition, to randomly set the network weight to 0 by utilizing the dropout layer.

Alternatively, in the output step (S200), the non-learning neural network model includes a non-learning neural network model including a layer for processing input data, a layer for performing linear transformation, and an activation function layer for adding linearity, and when parameters are set so that a value of a preset target dimension is output by a layer included in the output stage, it is preferable that a value corresponding to the number of target dimensions is output without additional repetition.

Furthermore, it is preferable that the above-described abnormality judgment step (S300) include a standard calculation step (S310) in which, in the standard setting unit, a data set including normal data is used to input a random transformation vector into the non-learning neural network model in advance, and the standard value is calculated through a preset fitting formula, and a judgment processing step (S320) in which, in the standard calculation step (310), the standard value is calculated, and, using the fitting formula in which the applied parameters are set, each of the plurality of random transformation vectors output by the output step (S200) is substituted into the fitting formula, and if the calculated value is higher than the standard value, it is determined to be abnormal data.

According to the present invention, a non-learning neural network-based anomaly detection system and method thereof have the advantage of performing anomaly detection using an artificial neural network itself without a learning process, in order to resolve the problems of conventional anomaly detection techniques in which, when generating an anomaly detection model, there is a large difference in model performance depending on the quality of learning data or the learning result, and a long time is required for development and learning to develop an anomaly detection model suitable for each problem.

Specifically, based on the difference in the output distribution of randomly output data without learning about normal data and abnormal/abnormal data respectively, there is an effect of being able to determine abnormal data by performing normalization using the Mahalanobis distance for randomly output result values.

Through this, there is an advantage in being able to perform anomaly detection freely without limitations on computing resources by utilizing mobile devices, edge devices, etc.

In addition, it has the advantage of being able to be used as a benchmark for the possibility of classifying the data itself as an anomaly that can be achieved without learning/processing from the given data.

Figure 1 is a configuration example diagram showing a non-learning neural network-based anomaly detection system according to one embodiment of the present invention.
FIG. 2 is a flowchart illustrating an anomaly detection method based on a non-learning neural network according to one embodiment of the present invention.
Figure 3 is a table comparing the anomaly detection accuracy by a conventional learning model and the anomaly detection accuracy by a non-learning neural network-based anomaly detection system and method according to one embodiment of the present invention.

Hereinafter, a non-learning neural network-based anomaly detection system and method according to the present invention having the above-described configuration will be described in detail with reference to the attached drawings. The drawings introduced below are provided as examples so that those skilled in the art can sufficiently convey the spirit of the present invention. Accordingly, the present invention is not limited to the drawings presented below and may be embodied in other forms. In addition, the same reference numerals represent the same components throughout the specification.

In this case, if there is no other definition for the technical and scientific terms used, they have the meaning commonly understood by a person of ordinary skill in the art to which this invention belongs, and the description of well-known functions and configurations that may unnecessarily obscure the gist of the present invention in the following description and attached drawings are omitted.

In addition, a system refers to a set of components including devices, mechanisms, and means that are organized and interact regularly to perform necessary functions.

A non-learning neural network-based anomaly detection system and method according to one embodiment of the present invention relate to a simple and efficient non-learning artificial neural network-based anomaly detection technology that is not accompanied by a learning process.

Figure 1 is a configuration example diagram showing a non-learning neural network-based anomaly detection system according to one embodiment of the present invention.

As illustrated in FIG. 1, a non-learning neural network-based anomaly detection system according to one embodiment of the present invention includes a data input unit (100), a neural network processing unit (200), and an anomaly determination unit (300). It is preferable that each component be individually or integrally configured in an operation processing means including an MCU to perform operations.

Let's take a closer look at each component:

It is preferable that the above data input unit (100) receives a data set for which anomaly detection is to be performed.

At this time, since the artificial neural network is a mathematical function, for simple expression, the above data set can be represented as x, which is represented as a d-dimensional input vector.

It is preferable that the above neural network processing unit (200) inputs a data set by the data input unit (100) into a pre-stored non-learning neural network model and outputs a plurality of random transformation vectors.

At this time, the non-learning neural network-based anomaly detection system according to one embodiment of the present invention has a technical characteristic of using data output without learning processing, based on the fact that there is a difference between the distribution of data randomly output by inputting normal data into a non-learning neural network and the distribution of data randomly output by inputting abnormal/abnormal data into a non-learning neural network as judged through performing various experiments.

In detail, an untrained neural network, or untrained artificial neural network, refers to an artificial neural network that has not been trained.

The basic structure of the above non-learning neural network can be configured differently, such as CNN (Convolution Neural Network), RNN (Recurrent Neural Network), Transformer, and MLP (Multi-Layer Perceptron), depending on the characteristics of the target data.

Based on this, the neural network processing unit (200) receives a data set from the data input unit (100) through an artificial neural network, performs multiple nonlinear random transformations, and outputs the data. There may be various ways to secure randomness.

In the present invention, as a result of comparing performances while performing various experiments, three examples can be presented as described below. As a result of the experiments, the difference in classification performance according to the randomness method is not large, but the third example to be described last is the most preferable because it takes the least time and allows the simplest layer structure.

The above neural network processing unit (200) basically sets the learnable weight parameters of the neural network that determine the output of the artificial neural network to be initialized randomly without being learned, and as a result, since learning has not been performed, a nonlinear random transformation (nonlinear random projection or nonlinear random mapping) is performed on the input data (data set, x).

Based on this, when input data (x) is a d-dimensional vector, the first embodiment of the neural network processing unit (200) (aka 'Iterative Randomness Model') includes an input layer (Input(x)) that processes input data (x), a linear layer that performs linear transformation of data obtained from a previous layer into the dimension of a set parameter, a sigmoid layer that is an activation function layer for adding non-linearity, and a linear layer that performs linear transformation of data obtained from a previous layer into the dimension of a set parameter as an output layer.

As an example, the structure of the first embodiment of the neural network processing unit (200) by setting the parameters is as follows: Input (d) - Linear (128) - Sigmoid - Linear (1).

In the first embodiment of the neural network processing unit (200), when a value of one dimension or a dimension lower than the target dimension is set to be output by a layer included in the output terminal, a one-dimensional value corresponding to the parameter setting value of the layer included in the output terminal is output at each repetition according to the structure of the first embodiment.

At this time, the first embodiment of the neural network processing unit (200) repeatedly inputs the data set into the non-learning neural network model until the output value corresponds to the number of target dimensions, and it is preferable to initialize the network weights at each repetition.

That is, when the number of output neurons = 1 and the target dimension d' = 100, a one-dimensional value is output at each iteration, and at this time, by initializing the weights each time, the output value obtained at each iteration becomes different. The one-dimensional output values obtained by performing this initialization 100 times are collected and utilized as a 100-dimensional vector, which is the target dimension d'.

The second embodiment of the neural network processing unit (200) (aka 'Dropout Randomness Model') includes an input layer (Input(x)) that processes input data (x), a linear layer that performs linear transformation of data obtained from a previous layer into the dimension of a set parameter, a dropout layer, a sigmoid layer as an activation function layer for adding non-linearity, and a linear layer as an output layer that performs linear transformation of data obtained from a previous layer into the dimension of a set parameter.

As an example, the structure of the second embodiment of the neural network processing unit (200) by setting the parameters is as follows: Input (d) - Drop (0.5) - Linear (128) - Sigmoid - Drop (0.5) - Linear (1).

In the second embodiment of the neural network processing unit (200), similarly to the first embodiment of the neural network processing unit (200) described above, when the number of output neurons, i.e., the layer included in the output terminal, is set to output a value of one dimension or a dimension lower than the target dimension, the data set is repeatedly input to the non-learning neural network model until the output value corresponds to the number of target dimensions, and at each repetition, it is preferable to randomly set the network weight to 0 by utilizing a dropout layer.

That is, when the number of output neurons = 1 and the target dimension d' = 100, a one-dimensional value is output at each iteration. At this time, instead of repeatedly initializing the network weights at each iteration, it is desirable to use a dropout layer to randomly make the weights 0.

This allows the weight connections between neurons to be randomly disconnected at each iteration due to the dropout layer, so that the outputs of random sub-networks are collected and used as a target dimension d'-dimensional vector as well.

The third embodiment of the neural network processing unit (200) (aka 'One-shot Randomness Model') includes an input layer (Input(x)) that processes input data (x), a linear layer that performs linear transformation of data obtained from a previous layer into the dimension of a set parameter, a sigmoid layer as an activation function layer for adding non-linearity, and a linear layer as an output layer that performs linear transformation of data obtained from a previous layer into the dimension of a set parameter.

As an example, the structure of the third embodiment of the neural network processing unit (200) by setting the parameters is as follows: Input (d) - Linear (128) - Signoid - Linear (100).

In the third embodiment of the neural network processing unit (200), when the parameters are set so that a value of a target dimension preset by a layer included in the output terminal is output, it is preferable that a value corresponding to the number of target dimensions is output without additional repetition.

That is, the third embodiment of the neural network processing unit (200) sets the number of output neurons of the neural network to be equal to the target dimension d' in the simplest way. Through this, a 100-dimensional nonlinear random transformation vector can be obtained without additional repetition.

The operations of the first to third embodiments of the neural network processing unit (200) described above can be explained through pseudocode as shown in Table 1 below.

The neural network processing unit (200) preferably uses the network structure of the above-described embodiment to nonlinearly map the data set (d-dimensional data) input through the data input unit (100) onto the target dimension d' (100-dimensional) space and use this as a new feature vector.

It is preferable that the above-mentioned abnormality judgment unit (300) determines that each of the plurality of random transformation vectors output by the above-mentioned neural network processing unit (200), i.e., output values nonlinearly mapped onto the target dimension d' space, is abnormal data if it exceeds a preset reference value.

In detail, it is preferable that the non-learning neural network-based anomaly detection system according to one embodiment of the present invention employs the Mahalanobis distance as a metric for measuring the distance between points and distributions, and utilizes it together with a non-learning neural network model, thereby enabling non-learning neural network-based anomaly detection.

To this end, the above-described ideal judgment unit (300) includes a standard setting unit (310) and a judgment processing unit (320), as illustrated in FIG. 1.

It is preferable that the above-mentioned standard setting unit (310) inputs a data set including normal data into the non-learning neural network model by the above-mentioned neural network processing unit (200) in advance, receives a random transformation vector, and calculates the standard value through a preset fitting formula.

Specifically, if a data set including normal data, i.e., a set of normal data, is assumed to be Xref, and a sample of normal data to be determined among them is assumed to be x', when this is input into a non-learning neural network model by the neural network processing unit (200), a non-linear randomly transformed output Yref and y' included therein can be obtained.

The mean and covariance matrix for Yref are respectively , S, it is desirable to calculate the abnormality score for the data sample x' to be determined through the preset mathematical expression 1 below.

Since the abnormality score for the data sample x' to be determined above is a sample of normal data to be determined among the set of normal data, the abnormality score for this is set as a threshold for determining abnormality.

Using this, the judgment processing unit (320) preferably uses the mathematical expression 1, which is the fitting equation to which the parameters are applied, to calculate the reference value in the standard setting unit (310), and substitutes each of the plurality of output random transformation vectors into the mathematical expression 1, and if the calculated value is greater than or equal to the reference value, determines it as abnormal data.

In detail, the judgment processing unit (320) inputs each of the plurality of random transformation vectors output by the neural network processing unit (200) into the mathematical expression 1, which is the fitting equation to which the parameters are applied, in order to calculate the reference value in the reference setting unit (310), and if the calculated value is higher than the reference value calculated by the reference setting unit (310), i.e., the abnormality score of normal data, it is determined as abnormal data.

Of course, conversely, if it is below the above criteria, it is judged as normal data.

At this time, the above abnormality judgment unit (300) extracts two or more samples of normal data to be determined from the set of normal data Xref through the above standard setting unit (310) for a more precise judgment, and assuming that these are x1' to xn', inputs these into the non-learning neural network model by the above neural network processing unit (200), thereby obtaining the non-linear randomly transformed output Yref and y1' to yn' included therein.

The mean and covariance matrix for Yref are respectively , S, and it is desirable to calculate the abnormality score for each of the data samples x1' to xn' to be determined through the mathematical expression 1 above, add them up, and set them as the abnormality score, i.e., the reference value.

In response to this, it is also preferable that the judgment processing unit (320) inputs each of the plurality of random transformation vectors, i.e., 100-dimensional vector values, output by the neural network processing unit (200) into the mathematical expression 1, which is the fitting equation to which the parameters are applied in order to calculate the reference value in the reference setting unit (310), and then adds up the calculated values and determines abnormal data/normal data using the reference value.

The operation of the non-learning neural network-based anomaly detection system according to one embodiment of the present invention can be explained through the pseudocode shown in Table 2 below.

FIG. 2 is a flowchart illustrating an anomaly detection method based on a non-learning neural network according to one embodiment of the present invention.

A non-learning neural network-based anomaly detection method according to one embodiment of the present invention is a non-learning neural network-based anomaly detection method using a non-learning neural network-based anomaly detection system in which each step is performed by a computational processing means, and includes an input step (S100), an output step (S200), and an anomaly determination step (S300), as illustrated in FIG. 2.

Let's take a closer look at each step:

The above input step (S100) receives a data set for which anomaly detection is to be performed from the data input unit (100). At this time, since the artificial neural network is a mathematical function, for simple expression, the data set can be represented as x, which is represented as a d-dimensional input vector.

The above output step (S200) inputs the data set from the input step (S100) into the pre-stored non-learning neural network model in the neural network processing unit (200) to output multiple random transformation vectors.

At this time, the non-learning neural network-based anomaly detection method according to one embodiment of the present invention has a technical characteristic of using data output without learning processing, based on the fact that there is a difference between the distribution of data randomly output by inputting normal data into a non-learning neural network and the distribution of data randomly output by inputting abnormal/abnormal data into a non-learning neural network as judged through performing various experiments.

In detail, an untrained neural network, or untrained artificial neural network, refers to an artificial neural network that has not been trained.

The basic structure of the above non-learning neural network can be configured differently, such as CNN (Convolution Neural Network), RNN (Recurrent Neural Network), Transformer, and MLP (Multi-Layer Perceptron), depending on the characteristics of the target data.

Based on this, in the output step (S200), the non-learning neural network model receives the data set from the input step (S100) through an artificial neural network, performs multiple non-linear random transformations, and outputs the data. There may be various methods for securing randomness.

In the present invention, as a result of comparing performances while performing various experiments, three examples can be presented as described below. As a result of the experiments, the difference in classification performance according to the randomness method is not large, but the third example to be described last is the most preferable because it takes the least time and allows the simplest layer structure.

In the above output step (S200), the non-learning neural network model basically sets the learnable weight parameters of the neural network that determine the output of the artificial neural network to be randomly initialized without being learned, and as a result, since learning has not occurred, a nonlinear random transformation (nonlinear random projection or nonlinear random mapping) is performed on the input data (data set, x).

Based on this, when the input data (x) is a d-dimensional vector, in the output step (S200), the first embodiment of the non-learning neural network model (aka 'Iterative Randomness Model') includes an input layer (Input(x)) that processes the input data (x), a linear layer that performs linear transformation of data obtained from a previous layer into the dimension of a set parameter, a sigmoid layer that is an activation function layer for adding non-linearity, and a linear layer that performs linear transformation of data obtained from a previous layer into the dimension of a set parameter as an output layer.

As an example, the structure of the first embodiment of the neural network processing unit (200) by setting the parameters is as follows: Input (d) - Linear (128) - Sigmoid - Linear (1).

In the above output step (S200), when the first embodiment of the non-learning neural network model is set so that a value of one dimension or a dimension lower than the target dimension is output by a layer included in the output terminal, according to the structure of the first embodiment, a one-dimensional value corresponding to the parameter setting value of the layer included in the output terminal is output at each iteration.

At this time, in the output step (S200), the first embodiment of the non-learning neural network model repeatedly inputs the data set into the non-learning neural network model until the output value corresponds to the number of target dimensions, and it is preferable to initialize the network weights at each repetition.

That is, when the number of output neurons = 1 and the target dimension d' = 100, a one-dimensional value is output at each iteration, and at this time, by initializing the weights each time, the output value obtained at each iteration becomes different. The one-dimensional output values obtained by performing this initialization 100 times are collected and utilized as a 100-dimensional vector, which is the target dimension d'.

In the above output step (S200), the second embodiment of the non-learning neural network model (aka 'Dropout Randomness Model') includes an input layer (Input(x)) for processing input data (x), a linear layer for performing linear transformation of data obtained from a previous layer into the dimension of a set parameter, a dropout layer, a sigmoid layer as an activation function layer for adding non-linearity, and a linear layer as an output layer for performing linear transformation of data obtained from a previous layer into the dimension of a set parameter.

In the output step (S200) above, by setting the parameters, the structure of the second embodiment of the non-learning neural network model is, for example, Input(d) - Drop(0.5) - Linear(128) - Sigmoid - Drop(0.5) - Linear(1).

In the above output step (S200), in the second embodiment of the non-learning neural network model, similarly to the first embodiment of the neural network processing unit (200) described above, when the number of output neurons, i.e., the layer included in the output terminal, is set to output a value of one dimension or a dimension lower than the target dimension, it is preferable to repeatedly input the data set to the non-learning neural network model until the output value corresponds to the number of target dimensions, and at each repetition, to randomly set the network weight to 0 by utilizing a dropout layer.

That is, when the number of output neurons = 1 and the target dimension d' = 100, a one-dimensional value is output at each iteration. At this time, instead of repeatedly initializing the network weights at each iteration, it is desirable to use a dropout layer to randomly make the weights 0.

This allows the weight connections between neurons to be randomly disconnected at each iteration due to the dropout layer, so that the outputs of random sub-networks are collected and used as a target dimension d'-dimensional vector as well.

In the above output step (S200), the third embodiment of the non-learning neural network model (aka 'One-shot Randomness Model') includes an input layer (Input(x)) that processes input data (x), a linear layer that performs linear transformation of data obtained from a previous layer into the dimension of a set parameter, a sigmoid layer as an activation function layer for adding non-linearity, and a linear layer as an output layer that performs linear transformation of data obtained from a previous layer into the dimension of a set parameter.

In the output step (S200) above, by setting the parameters, the structure of the third embodiment of the non-learning neural network model is as follows: Input (d) - Linear (128) - Signoid - Linear (100).

In the third embodiment of the neural network processing unit (200), when the parameters are set so that a value of a target dimension preset by a layer included in the output terminal is output, it is preferable that a value corresponding to the number of target dimensions is output without additional repetition.

That is, in the output step (S200), the third embodiment of the non-learning neural network model sets the number of output neurons of the neural network to be equal to the target dimension d' in the simplest way. Through this, a 100-dimensional nonlinear random transformation vector can be obtained without additional repetition.

In the above-described output step (S200), the operations according to the first to third embodiments of the non-learning neural network model can be explained through pseudocode as in Table 1 above.

Through this, the output step (S200) preferably uses the network structure of the above-described embodiment to non-linearly map the data set (d-dimensional data) input by the input step (S100) onto the target dimension d' (100-dimensional) space and use this as a new feature vector.

The above abnormality judgment step (S300) determines that each of the plurality of random transformation vectors output by the above output step (S200) in the above abnormality judgment unit (300) is abnormal data if the value is greater than a preset standard value.

In detail, the above abnormality judgment step (S300) determines that each of the plurality of random transformation vectors output by the above output step (S200), i.e., output values nonlinearly mapped onto the target dimension d' space, is abnormal data if it exceeds a preset reference value.

To this end, the above-described abnormality judgment step (S300) employs the Mahalanobis distance as a metric for measuring the distance between points and distributions, and utilizes it together with a non-learning neural network model to enable abnormality detection based on a non-learning neural network, and includes a criterion calculation step (S310) and a judgment processing step (S320), as illustrated in FIG. 2.

The above-mentioned standard calculation step (S310) uses a data set including normal data in advance in the mood setting unit (310), inputs it into the non-learning neural network model, outputs a random transformation vector, and calculates the standard value through a preset fitting formula.

In detail, if a data set including normal data, i.e., a set of normal data, is assumed to be Xref, and a sample of normal data to be determined among them is assumed to be x', when this is input into a non-learning neural network model by the output step (S200), a non-linear randomly transformed output Yref and y' included therein can be obtained.

The mean and covariance matrix for Yref are respectively , S, it is desirable to calculate the abnormality score for the data sample x' to be determined through the above mathematical expression 1 set in advance.

Since the abnormality score for the data sample x' to be determined above is a sample of normal data to be determined among the set of normal data, the abnormality score for this is set as a threshold for determining abnormality.

Using this, the judgment processing step (S320) performs the calculation of the reference value through the reference calculation step (310) in the judgment processing unit (320), and, using the fitting equation in which the applied parameters are set, for each of the plurality of random transformation vectors output by the output step (S200), if the calculated value is greater than or equal to the reference value, it is determined as abnormal data.

That is, in the judgment processing step (S320), for calculating the reference value in the reference calculation step (S310), the fitting equation, which is the mathematical expression 1 to which the parameters are applied, is used, for each of the plurality of output random transformation vectors, and if the calculated value is greater than or equal to the reference value, it is determined to be abnormal data.

In detail, the judgment processing step (S320) inputs each of the plurality of random transformation vectors output by the output step (S200) into the mathematical expression 1, which is the fitting equation to which the parameters are applied, for calculating the reference value in the reference calculation step (S310), and if the calculated value is higher than the reference value calculated by the reference calculation step (310), i.e., the abnormality score of normal data, it is determined as abnormal data.

Of course, conversely, if it is below the above criteria, it is judged as normal data.

At this time, the judgment processing step (S320) extracts two or more samples of normal data to be determined from the set Xref of normal data through the reference generation step (S310) to resolve the inaccuracy of random output and, for a more precise judgment, assumes x1' to xn' and inputs these into the non-learning neural network model by the output step (S200), thereby obtaining the nonlinear randomly transformed output Yref and y1' to yn' included therein.

The mean and covariance matrix for Yref are respectively , S, and it is desirable to calculate the abnormality score for each of the data samples x1' to xn' to be determined through the mathematical expression 1 above, add them up, and set them as the abnormality score, i.e., the reference value.

In response to this, it is also preferable that the judgment processing step (S320) inputs each of the plurality of random transformation vectors, i.e., 100-dimensional vector values, output by the output step (S200) into the mathematical expression 1, which is the fitting equation to which the parameters are applied, for calculating the reference value in the reference calculation step (S310), and then sums up the calculated values, and then determines abnormal data/normal data using the reference value.

The entire operation of the non-learning neural network-based anomaly detection method according to one embodiment of the present invention can be explained through the pseudocode as shown in Table 2 above.

As shown in FIG. 3, the non-learning neural network-based anomaly detection system and method according to one embodiment of the present invention were compared with a neural network model that performed a learning process, and it was found that the most recent learning model (LUNAR in FIG. 3) and the non-learning neural network model according to the present invention (UNN ORM (Example 3) in FIG. 3) showed similar or equivalent performance.

To put it bluntly, this means that the anomaly judgment performance is the best using a deep learning model that has undergone optimal learning processing using an optimal learning data set, but as described above, considering the time/cost incurred in the process of constructing an optimal learning data set, the time/computing resources in the process of performing learning processing, etc., it can be seen that it is efficient to detect anomalies by analyzing random result values output through an artificial neural network without a learning process through a non-learning neural network-based anomaly detection system and method according to an embodiment of the present invention.

Meanwhile, the non-learning neural network-based anomaly detection method according to one embodiment of the present invention may be implemented in the form of a program command that can be performed through various electronic information processing means and recorded in a storage medium. The storage medium may include program commands, data files, data structures, etc., singly or in combination.

The program commands recorded on the storage medium may be those specially designed and configured for the present invention, or may be those known and available to those skilled in the software field. Examples of the storage medium include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to store and execute program commands such as ROMs, RAMs, and flash memories. Examples of the program commands include not only machine language codes generated by a compiler, but also high-level language codes that can be executed by a device that electronically processes information using an interpreter, for example, a computer.

As described above, the present invention has been described by specific matters such as specific components and limited example drawings, but this has only been provided to help a more general understanding of the present invention, and the present invention is not limited to the above-described embodiment, and those skilled in the art to which the present invention pertains can make various modifications and variations from this description.

Therefore, the idea of the present invention should not be limited to the described embodiments, and all things that are equivalent or equivalent to the scope of the patent claims as well as the scope of the patent claims are included in the scope of the idea of the present invention.

100 : Data input section
200: Neural network processing unit
300 : Ideal Judgment Department
310: Standard setting unit 320: Judgment processing unit

Claims (10)

A data input section that receives a data set on which anomaly detection is to be performed;
A neural network processing unit that inputs the above data set into a pre-stored non-learning neural network model and outputs multiple random transformation vectors; and
An abnormality determination unit that determines that each of the plurality of output random transformation vectors is abnormal data if it exceeds a preset reference value;
An anomaly detection system based on a non-learning neural network, comprising:
In paragraph 1,
The above neural network processing unit
It includes a non-learning neural network model that includes a layer for processing input data, a layer for performing linear transformation, and an activation function layer for adding linearity.
When the parameters are set so that a value of one dimension or a dimension lower than the preset target dimension is output by the layer included in the output section,
Repeat the above data set input to the above unlearned neural network model until the output value corresponds to the number of target dimensions.
An anomaly detection system based on non-learning neural networks that initializes the network weights at each iteration.
In paragraph 1,
The above neural network processing unit
It includes a non-learning neural network model that includes a layer for processing input data, a layer for performing linear transformation, a dropout layer, and an activation function layer for adding linearity.
When the parameters are set so that a value of one dimension or a dimension lower than the preset target dimension is output by the layer included in the output section,
Repeat the above data set input to the above unlearned neural network model until the output value corresponds to the number of target dimensions.
An anomaly detection system based on a non-learning neural network that randomly sets the network weights to 0 at each iteration using a dropout layer.
In paragraph 1,
It includes a non-learning neural network model that includes a layer for processing input data, a layer for performing linear transformation, and an activation function layer for adding linearity.
When the parameters are set so that the values of the target dimension set by the layer included in the output section are output,
An anomaly detection system based on a non-learning neural network that outputs values corresponding to the number of target dimensions without additional iterations.
In clauses 2 to 4,
The above judgment department
In advance, a reference setting unit that inputs a data set including normal data into the non-learning neural network model, outputs a random transformation vector, and calculates the reference value through a preset fitting formula; and
A judgment processing unit that uses the fitting formula to which the parameters are applied to calculate the reference value by the above-mentioned reference setting unit to determine that each of the plurality of output random transformation vectors is abnormal data if the calculated value is greater than or equal to the reference value by substituting the calculated value into the fitting formula;
An anomaly detection system based on a non-learning neural network, comprising:
A non-learning neural network-based anomaly detection method using a non-learning neural network-based anomaly detection system in which each step is performed by an operation processing means,
In the data input section, an input step (S100) for receiving a data set on which anomaly detection is to be performed;
In the neural network processing unit, an output step (S200) for inputting the data set by the input step (S100) into the pre-stored non-learning neural network model and outputting multiple random transformation vectors; and
In the abnormal judgment unit, for each of the plurality of random transformation vectors output by the output step (S200), an abnormal judgment step (S300) for judging it as abnormal data if the value is greater than a preset standard value;
An anomaly detection method based on a non-learning neural network, comprising:
In paragraph 6,
In the above output step (S200), the non-learning neural network model
It includes a non-learning neural network model that includes a layer for processing input data, a layer for performing linear transformation, and an activation function layer for adding linearity.
When the parameters are set so that a value of one dimension or a dimension lower than the preset target dimension is output by the layer included in the output section,
Repeat the above data set input to the above unlearned neural network model until the output value corresponds to the number of target dimensions.
Anomaly detection method based on non-learning neural networks that initializes network weights at each iteration.
In paragraph 6,
In the above output step (S200), the non-learning neural network model
It includes a non-learning neural network model that includes a layer for processing input data, a layer for performing linear transformation, a dropout layer, and an activation function layer for adding linearity.
When the parameters are set so that a value of one dimension or a dimension lower than the preset target dimension is output by the layer included in the output section,
Repeat the above data set input to the above unlearned neural network model until the output value corresponds to the number of target dimensions.
An anomaly detection method based on a non-learning neural network that randomly sets the network weights to 0 at each iteration by utilizing a dropout layer.
In paragraph 6,
In the above output step (S200), the non-learning neural network model
It includes a non-learning neural network model that includes a layer for processing input data, a layer for performing linear transformation, and an activation function layer for adding linearity.
When the parameters are set so that the values of the target dimension set by the layer included in the output section are output,
An anomaly detection method based on a non-learning neural network that outputs values corresponding to the number of target dimensions without additional iterations.
In clauses 7 to 9,
The above abnormal judgment step (S300)
In the standard setting section, in advance, a standard calculation step (S310) is performed in which a data set including normal data is input into the non-learning neural network model, a random transformation vector is output, and the standard value is calculated through a preset fitting formula; and
In the judgment processing unit, the reference value is calculated through the reference calculation step (310), and, using the fitting formula for which the applied parameters are set, a judgment processing step (S320) for determining that the data is abnormal if the calculated value is greater than or equal to the reference value by substituting each of the plurality of random transformation vectors output by the output step (S200) into the fitting formula;
An anomaly detection method based on a non-learning neural network, comprising: