KR102555371B1 - System and method of detection anomalous signs in smart factory using M-SVDD - Google Patents

Abstract

The present invention relates to a system and method for detecting anomalies in a smart factory using the M-SVDD technique. It's about detectable technology.

Description

Anomaly sign detection system and method of smart factory using M-SVDD technique {System and method of detection anomalous signs in smart factory using M-SVDD}

The present invention relates to a smart factory anomaly detection system and method using the M-SVDD technique, and more particularly, to an M- It relates to a system and method for detecting anomalies in a smart factory using the SVDD technique.

Smart manufacturing means a technology that actively applies information and communication technology to the current manufacturing process, and is revolutionizing the manufacturing industry economy around the world.

The 4th Industrial Revolution, which is emerging today, refers to the era of building a smart manufacturing environment based on cutting-edge information and communication technology. Although there is no precise definition, SMLC, a national R&D consortium established by the US federal government, is the deepening application of advanced intelligent systems to enable rapid manufacturing of new products, active response to product demand, and real-time optimization of production and supply chains.

The final product of such smart manufacturing will be a smart factory.

A smart factory refers to an operating system that builds various sensors and communication devices in factory facilities and facilities to operate the factory remotely and monitor it in real time.

With the recent increase in non-face-to-face services, various automation facilities are increasing in the manufacturing industry, and in line with this, smart factories are rapidly increasing as a way to operate production lines more efficiently in an unmanned environment.

These smart factories are characterized by being open to the outside by grafting communication on factory operation facilities that were previously closed. Although they have the advantage of improving the efficiency of factory operation, they may inevitably be exposed to various security threats due to openness. there is only

In particular, one of the security threats of smart factories is that malicious users enter abnormal operations due to loss, theft, or hacking of terminal means that remotely monitor or control smart factories, or internal users perform abnormal operations with malicious purposes. There is something to input.

Against these security threats, anomaly detection in the smart manufacturing environment combines operational data collected in the manufacturing environment with big data analysis techniques to detect abnormal behavior in the operating state of facilities and factories, that is, to reduce the normal category at the present time. It is trying to detect deviant behavior and eliminate security risks.

However, when damage occurs due to security threats that occur in smart factories, etc., it is not limited to the simple leakage of operational data, but also the availability of facility systems and workers' Since it is a part directly related to safety, it is most important to perform preventive/response measures against abnormal behavior by detecting 'abnormal symptoms' before abnormal behavior occurs.

Korean Patent Registration No. 10-2196287 (“Smart Factory Fault Prediction Diagnosis Device Using Artificial Intelligence and Fault Prediction Diagnosis Method Using It”) discloses a technology for diagnosing abnormalities of robots or facilities in real time using artificial intelligence. .

Domestic Patent Registration No. 10-2196287 (registration date 2020.12.22.)

The present invention has been devised to solve the problems of the prior art as described above, and an object of the present invention is to detect abnormal symptoms occurring in facilities and factory operation conditions in the process of building and remotely operating a smart factory, It is to provide an anomaly symptom detection system and method of a smart factory using the M-SVDD technique that can prevent the occurrence of abnormal behavior in advance by performing defense/response in advance.

In the anomaly symptom detection system of a smart factory using the M-SVDD technique according to an embodiment of the present invention, the data input unit 100 receiving operation data from a smart factory that wants to detect anomaly, and preprocessing the operation data A data processing unit 200 that performs a learning process to generate learning data for artificial intelligence learning, a learning processing unit 300 that performs learning processing of the learning data using a plurality of pre-stored artificial intelligence algorithms, and the learning processing unit 300 ), and an analysis unit 400 that performs real-time analysis on input real-time operation data using a plurality of learning models based on the learning process result, and each characteristic setting for learning process with the artificial intelligence algorithm It is desirable to use a number of different Support Vector Data Description (SVDD) algorithms.

Furthermore, the data processing unit 200 includes a first processing unit 210 for labeling the input operation data, a second processing unit 220 for extracting characteristic values for the labeling operation data, and the extracted characteristic value information. It is preferable to include a third processing unit 230 that uses and processes learning data.

Furthermore, the analysis unit 400 determines the degree of risk of the real-time operation data by using the first analysis unit 410 that performs real-time analysis on the real-time operation data in each of a plurality of learning models and a plurality of analysis results. It is preferable to include a second analyzer 420 that analyzes and a third analyzer 430 that determines that an anomaly occurs when the risk level of the real-time operation data exceeds a preset threshold.

Furthermore, the abnormal symptom detection system of the smart factory using the M-SVDD technique, when it is determined that an abnormal symptom has occurred according to the analysis result of the third analyzer 430, detects the detected abnormal symptom using a pre-stored database. It is preferable to further include a pre-processing unit 500 that generates control information for performing defense/response measures according to abnormal symptoms.

Furthermore, the operation data is preferably external input information including control information input from a terminal means for remotely monitoring or controlling the smart factory.

In the smart factory anomaly symptom detection method using the M-SVDD technique in which each step is performed by the smart factory anomaly symptom detection system using the M-SVDD technique implemented by a computer according to another embodiment of the present invention, In the data input unit, a data input step (S100) of receiving operation data from a smart factory that wants to detect anomalies, and in the data processing unit, pre-processing of the operation data by the data input step (S100) is performed to perform artificial intelligence learning A data generation step (S200) of generating learning data for the purpose, a learning step (S300) of performing learning processing of the learning data by the data generation step (S200) using a plurality of pre-stored artificial intelligence algorithms, an analysis unit In the real-time data input step (S400) of receiving real-time operation data from the smart factory, in the analysis unit, using a plurality of learning models by the learning step (S300), by the real-time data input step (S400) It includes a data analysis step (S500) of performing analysis of the real-time operating data, and the data input step (S100) or the real-time data input step (S400) is a terminal for remotely monitoring or controlling the smart factory. External input information including control information input from the means is received as operating data, and in the learning step (S300), it is preferable to use a plurality of SVDD (Support Vector Data Description) algorithms with different characteristics settings for learning processing. do.

Furthermore, the data generation step (S200) includes a labeling step (S210) of performing labeling on the operating data by the data input step (S100), and the labeling of the operating data by the labeling step (S210). A characteristic value extraction step (S220) of extracting characteristic values for the characteristic value and a learning data generation step (S230) of generating learning data for the operation data using the characteristic value information extracted by the characteristic value extraction step (S220). desirable.

Furthermore, the data analysis step (S500) includes a multiple analysis step (S510) of performing real-time analysis in each of a plurality of learning models on the real-time operation data by the real-time data input step (S400), the multiple analysis step ( A risk analysis step (S520) of analyzing the risk level of the real-time operating data using a plurality of analysis results by S510), based on a predetermined threshold value, of the real-time operating data by the risk analysis step (S520). According to the determination step (S530) of determining whether the risk level exceeds the threshold value and the determination result of the determination step (S530), when the risk level of the real-time operation data exceeds the threshold value, the smart factory is determined by the real-time operation data It is preferable to include an anomaly symptom detection step (S540) of detecting that an anomaly symptom has occurred.

Furthermore, in the smart factory abnormal symptom detection method using the M-SVDD technique, after performing the data analysis step (S500), if the pre-processing unit detects that the abnormal symptom of the smart factory has occurred, the pre-stored It is preferable to further include a preliminary action step (S600) of generating control information for performing defense/response actions according to the detected anomaly by using the database.

The smart factory anomaly detection system and method using the M-SVDD technique of the present invention according to the above configuration detects anomalies occurring in facilities and factory operation conditions in the process of establishing a smart factory and operating it remotely. Therefore, by performing defense/response in advance, there is an advantage in preventing the occurrence of abnormal behavior in advance.

Specifically, among various security threats occurring while operating a smart factory, it is to quickly detect anomalies by means of a terminal possessed by the manager of the smart factory, through which the operating status of the smart factory can be monitored and controlled. There is an advantage in that various security accidents that may occur can be prevented in advance by detecting in real time that information input by the terminal means is abnormally input differently from usual.

In particular, it is possible to detect in advance an action with a high risk that may lead to an abnormal result even if it is a normal action at the present time, so that various possible security incidents can be prevented with high accuracy.

1 is an exemplary configuration diagram showing an anomaly symptom detection system of a smart factory using an M-SVDD technique according to an embodiment of the present invention.
2 is an exemplary sequence diagram illustrating a method for detecting anomalies in a smart factory using the M-SVDD technique according to an embodiment of the present invention.

Hereinafter, a system and method for detecting anomalies in a smart factory using the M-SVDD technique of the present invention will be described in detail with reference to the accompanying drawings. The drawings introduced below are provided as examples to sufficiently convey the spirit of the present invention to those skilled in the art. Accordingly, the present invention may be embodied in other forms without being limited to the drawings presented below. Also, like reference numerals denote like elements throughout the specification.

At this time, unless there is another definition in the technical terms and scientific terms used, they have meanings commonly understood by those of ordinary skill in the art to which this invention belongs, and the gist of the present invention in the following description and accompanying drawings Descriptions of well-known functions and configurations that may be unnecessarily obscure are omitted.

In addition, a system refers to a set of components including devices, mechanisms, and means that are organized and regularly interact to perform necessary functions.

An anomaly symptom detection system and method of a smart factory using the M-SVDD technique according to an embodiment of the present invention is an abnormality caused by a terminal means possessed by a manager of a smart factory among various security threats occurring while operating a smart factory. It's about technology that detects signs quickly. Through this, it is possible to prevent in advance various security accidents that may occur by detecting in real time that the input information by the terminal means capable of monitoring and controlling the operation status of the smart factory is input differently than usual and abnormally. there is

At this time, 'detection of anomalies' refers to detecting in advance an activity with a high risk that may lead to an abnormal result even if it is a normal activity at the present time, and through this, various possible security incidents can be prevented.

That is, the anomaly symptom detection system of a smart factory using the M-SVDD technique according to an embodiment of the present invention does not detect an anomaly that has already occurred, but detects an anomaly in which an anomaly may occur. The occurrence of an act can be prevented in advance.

1 is an exemplary configuration diagram illustrating an anomaly symptom detection system in a smart factory using an M-SVDD technique according to an embodiment of the present invention. Referring to FIG. 1, the M-SVDD technique according to an embodiment of the present invention The anomaly symptom detection system of the smart factory used is described in detail.

As shown in FIG. 1, the anomaly symptom detection system of a smart factory using the M-SVDD technique according to an embodiment of the present invention includes a data input unit 100, a data processing unit 200, a learning processing unit 300, and an analysis unit. It is preferably configured to include (400). As described above, each component is preferably included individually or collectively in at least one arithmetic processing unit including a computer to perform an operation.

For a detailed look at each component,

The data input unit 100 preferably receives operation data from a smart factory that wants to detect anomalies. Since each smart factory usually has its own data, it is desirable to manage the input operation data for each smart factory. However, if the characteristics of the operation data do not stand out according to the type of smart factory, operation data of other smart factories may be collected and used to utilize more data. Therefore, the scope of the smart factory received from the data input unit 100 is not limited.

As described above, the system for detecting anomalies in a smart factory using the M-SVDD technique according to an embodiment of the present invention has the main purpose of quickly detecting anomalies by means of a terminal possessed by a manager of a smart factory. As a bar, the data input unit 100 inputs external input information including control information (input information for control, etc.) input from a terminal means for remotely monitoring or controlling the smart factory as the operation data. It is desirable to receive

The data processing unit 200 preferably performs pre-processing on the operation data input through the data input unit 100 and generates learning data for artificial intelligence learning.

To this end, as shown in FIG. 1 , the data processing unit 200 preferably includes a first processing unit 210 , a second processing unit 220 and a third processing unit 230 .

Preferably, the first processing unit 210 performs labeling on the operation data input through the data input unit 100 . That is, since the data input unit 100 receives the operating data that occurred in the past, not in real time, the first processing unit 210 determines whether the action based on the operating data was a normal or abnormal action as a result. Therefore, it is desirable to perform labeling.

Through this, in the case of operational data at a short point in time, even if the same or similar actions, the resultant action result may appear differently, so the data input unit 100 is capable of sufficiently showing the consequential result of the action that occurred. It is preferable to receive operation data for a predetermined point in time series order. At this time, since the predetermined point in time may be different depending on the type of operation of the smart factory, it is not limited.

Preferably, the second processing unit 220 extracts characteristic values for the operation data labeled by the first processing unit 210 .

That is, the second processing unit 220 extracts characteristic value information for each operation data for generating learning data. Such characteristic value extraction is an extraction technique used in the process of analyzing the characteristic values of a wide range of collected data and pre-processing them as learning data, but is not limited thereto.

The third processing unit 230 uses the characteristic value information for each operational data extracted by the second processing unit 220 to set it as learning data for learning processing of an artificial intelligence algorithm stored in advance, in other words, to generate learning data. It is desirable to do

Preferably, the learning processing unit 300 performs learning processing of the learning data generated by the data processing unit 200 using a plurality of pre-stored artificial intelligence algorithms.

At this time, as the pre-stored artificial intelligence algorithm, the SVDD (Support Vector Data Description) algorithm, which guarantees optimal performance even when relatively small learning data is applied, is used, but as described above, a plurality of SVDD algorithms (M-SVDD, Multi-SVDD), it is preferable to perform learning processing of the learning data generated by the data processing unit 200, respectively.

In addition, as many of the same algorithms are used, it is desirable to set different characteristics for learning processing for each SVDD algorithm. That is, learning processing of the learning data generated by the data processing unit 200 is performed using a plurality of SVDD algorithms having different settings of learning processing characteristics (features, traffic, weight values for learning parameters, etc.) do.

Through this, it is preferable that the analysis unit 400 performs real-time analysis on input real-time operation data using a plurality of learning models based on the learning processing result of the learning processing unit 300 .

Specifically, after the learning process by the learning processing unit 300 is completed, the analysis unit 400 receives new operating data from the smart factory in real time. Through this, it is preferable that the analysis unit 400 performs real-time analysis on new operating data using a plurality of learning models based on the learning processing result of the learning processing unit 300 .

To this end, as shown in FIG. 1 , the analysis unit 400 preferably includes a first analysis unit 410 , a second analysis unit 420 and a third analysis unit 430 .

Preferably, the first analyzer 410 performs real-time analysis by inputting the real-time operation data (new operation data) into a plurality of learning models based on the learning processing result of the learning processing unit 300, respectively.

It is preferable that the second analyzer 420 analyzes the risk of the real-time operating data using a plurality of analysis results by the first analyzer 410 .

That is, since different characteristics are set for each of the plurality of learning models based on the learning processing result of the learning processing unit 300, different analysis results may be output even when the same real-time operating data is input. Of course, in some cases, when the real-time operation data is an undoubted abnormal behavior, all analysis results may appear the same.

However, in the case of the anomaly symptom detection system of a smart factory using the M-SVDD technique according to an embodiment of the present invention, as described above, even if the behavior is normal at the present time, an anomaly that may indicate an abnormal behavior result at a later time point Since detection is performed, a case in which a plurality of analysis results by the second analyzer 420 are not the same will be described as an example.

The second analyzer 420 analyzes the risk of the real-time operating data using a plurality of analysis results by the first analyzer 410, and sets the overall average value, maximum value, Various risk analysis may be performed, such as setting the average value excluding the minimum value, setting the maximum value, setting the minimum value, and setting the majority exceeding a predetermined value, but is not limited thereto.

Preferably, the third analysis unit 430 determines that an anomaly occurs when the risk level of the real-time operation data analyzed by the second analysis unit 420 exceeds a preset threshold.

At this time, in setting the threshold, when an abnormal behavior occurs due to the nature of the smart factory, the risk cost to solve it is likely to be greater than the cost of precautionary measures due to strict anomaly detection, so the threshold is a relatively low standard It is preferable to apply

In addition, the anomaly symptom detection system of a smart factory using the M-SVDD technique according to an embodiment of the present invention does not stop at anomaly symptom detection, and as shown in FIG. 1, defense/response through the pre-processing unit 500 It is desirable to take action.

According to the analysis result of the third analysis unit 430, the pre-processing unit 500 determines that the risk level of the real-time operation data exceeds a preset threshold and an anomaly occurs, using a pre-stored database, It is desirable to generate control information for performing defense/response measures according to the detected anomaly and transmit it to an external linking means.

At this time, it is preferable that the pre-stored database is configured to include action results based on the operation data that occurred in the past input through the data input unit 100 and corresponding information, but when an abnormality occurs according to the type of smart factory Since it may be necessary to stop the operation unconditionally, the above control information is not limited.

2 is an exemplary sequence diagram showing a method for detecting anomalies in a smart factory using the M-SVDD technique according to an embodiment of the present invention. Referring to FIG. 2, the M-SVDD technique according to an embodiment of the present invention The method for detecting anomalies in smart factories is described in detail.

As shown in FIG. 2, the method for detecting anomalies in a smart factory using the M-SVDD technique according to an embodiment of the present invention includes a data input step (S100), a data generation step (S200), a learning step (S300), It is preferable to include a real-time data input step (S400) and a data analysis step (S500).

Each step is performed by the abnormal symptom detection system of the smart factory using the computer-implemented M-SVDD technique.

For a detailed look at each step,

In the data input step (S100), the data input unit 100 receives operation data from a smart factory that wants to detect an anomaly.

At this time, as the operation data, external input information including control information (input information for control, etc.) input from a terminal means for remotely monitoring or controlling the smart factory is input as the operation data, Through this, it is possible to quickly detect anomalies by means of a terminal possessed by a manager of a smart factory, which is the greatest object of the present invention.

In the data generation step (S200), the data processing unit 200 performs pre-processing on the operation data by the data input step (S100), and generates learning data for artificial intelligence learning.

To this end, in the data generation step (S200), as shown in FIG. 2, a labeling step (S210), a characteristic value extraction step (S220), and a learning data generation step (S230) are performed.

The labeling step (S210) performs labeling on the operation data by the data input step (S100).

That is, since the operating data by the data input step (S100) is the operating data generated in the past, it is possible to know whether the action based on the operating data was a normal or abnormal action as a result, and labeling thereof is performed. do.

Through this, in the case of operating data at a short point in time, even if the same or similar action, the resultant action result may appear differently, so the operating data input by the data input step (S100) is the result of the corresponding action Operational data for a certain point in time at which theoretical results can be sufficiently displayed are input in a time series order. Of course, at this time, since the predetermined time point may be different depending on the operation type of the smart factory, it is not limited.

The characteristic value extraction step (S220) extracts the characteristic value for the operation data that has been labeled by the labeling step (S210).

The characteristic value extraction step (S220) extracts characteristic values for each operation data for generating learning data, and is an extraction technique used in the process of analyzing characteristic values of a wide range of collected data and preprocessing them into learning data, but is not limited thereto. .

The learning data generation step (S230) uses the feature value information for each operation data extracted in the feature value extraction step (S220) to set the learning data for the learning process of the artificial intelligence algorithm stored in advance, in other words, the learning data will create

In the learning step (S300), the learning process of the learning data by the data generation step (S200) is performed using a plurality of pre-stored artificial intelligence algorithms.

At this time, a plurality of artificial intelligence algorithms do not use various algorithms, but use a plurality of the same algorithm.

In addition, as the pre-stored artificial intelligence algorithm, the SVDD (Support Vector Data Description) algorithm, which guarantees optimal performance even when relatively small learning data is applied, is used, but as described above, a plurality of SVDD algorithms (M-SVDD, Multi -SVDD), the learning process of the learning data generated by the learning data generating step (S230) is performed respectively.

In the case of an individual smart factory, since it is practically difficult to apply enough learning data, it is most desirable to use the SVDD algorithm that guarantees optimal performance even when relatively little training data is applied.

In addition, in the learning step (S300), as many of the same algorithms are used, the characteristic setting for the learning process for each SVDD algorithm is different, in other words, the weight value for learning the characteristics (features, traffic, parameters, etc.) of the learning process etc.) The learning process is performed using a plurality of SVDD algorithms with different settings.

In the real-time data input step (S400), real-time operation data (new operation data) is received from the smart factory in the analysis unit 400.

That is, after the learning is completed by the learning step (S300), new operating data is received from the smart factory in real time.

At this time, the received real-time operating data also receives external input information including control information (input information for control, etc.) input from a terminal means for remotely monitoring or controlling the smart factory.

In the data analysis step (S500), in the analysis unit 400, real-time analysis of new operation data by the real-time data input step (S400) is performed using a plurality of learning models by the learning step (S300). will perform

To this end, in the data analysis step (S500), as shown in FIG. 2, a multiple analysis step (S510), a risk analysis step (S520), a determination step (S530), and an anomaly symptom detection step (S540) are performed. .

In the multiple analysis step (S510), real-time analysis is performed by inputting the real-time operation data (new operation data) to a plurality of learning models based on the learning processing result of the learning step (S300).

The risk analysis step (S520) analyzes the risk of the real-time operating data using a plurality of analysis results by the multiple analysis step (S510).

In detail, since the plurality of learning models based on the learning processing result of the learning step (S300) have different characteristic settings, different analysis results may be output even if the same real-time operating data is input. Of course, in some cases, when the real-time operation data is an undoubted abnormal behavior, all analysis results may appear the same.

However, as described above, the method for detecting anomalies in a smart factory using the M-SVDD technique according to an embodiment of the present invention detects anomalies that may indicate abnormal behavior results at a later time even if the behavior is normal at the present time. Therefore, the case where the analysis result by the risk analysis step (S520) is not the same will be described as an example.

Accordingly, in the risk analysis step (S520), the risk of the real-time operation data is analyzed using a plurality of analysis results by the multiple analysis step (S510), and the overall average value is set as the maximum value for risk analysis. , various risk analysis may be performed, such as setting the average value excluding the minimum value, setting the maximum value, setting the minimum value, and setting the majority exceeding a predetermined value, but is not limited thereto.

In the determining step (S530), it is determined whether the risk level of the real-time operation data by the risk analysis step (S520) exceeds the threshold value based on a preset threshold value.

At this time, in setting the threshold, when an abnormal behavior occurs due to the nature of the smart factory, the risk cost to solve it is likely to be greater than the cost of precautionary measures due to strict anomaly detection, so the threshold is a relatively low standard It is preferable to apply

In the abnormal symptom detection step (S540), if the risk level of the real-time operation data analyzed by the risk analysis step (S520) exceeds a preset threshold according to the determination result of the determination step (S530), the real-time operation Based on the data, it is detected that abnormal symptoms of the smart factory have occurred.

In addition, the method for detecting anomalies in a smart factory using the M-SVDD technique according to an embodiment of the present invention, as shown in FIG. 2, after performing the data analysis step (S500), the preliminary action step ( S600) is performed to respond to abnormal symptoms detected before abnormal behavior occurs.

In the preliminary action step (S600), when the risk level of the real-time operation data exceeds a preset threshold in the pre-processing unit 500 and it is determined that an anomaly has occurred in the smart factory, the detection is performed using a pre-stored database. Control information for performing defense/response measures according to the detected anomaly is generated and transmitted to an external linking means.

At this time, it is preferable that the pre-stored database is configured to include action results based on the operation data that occurred in the past and corresponding information, but depending on the type of smart factory, it is necessary to unconditionally stop operation when abnormal symptoms occur. Since it can be, the control information is not limited.

As described above, the present invention has been described with specific details such as specific components and limited embodiment drawings, but this is only provided to help a more general understanding of the present invention, and the present invention is not limited to the above embodiment. No, various modifications and variations are possible from these descriptions by those skilled in the art in the field to which the present invention belongs.

Therefore, the spirit of the present invention should not be limited to the described embodiments, and not only the scope of the claims described later, but also all modifications equivalent or equivalent to the scope of the claims belong to the scope of the scope of the present invention. .

100: data input unit
200: data processing unit
210: first processing unit 220: second processing unit
230: third processing unit
300: learning processing unit
400: analysis unit
410: first analysis unit 420: second analysis unit
430: third analysis unit
500: pre-processing unit

Claims (9)

A data input unit 100 that receives operation data for a predetermined time period from a smart factory that wants to detect anomalies in chronological order;
A data processing unit 200 that performs pre-processing on the operation data and generates learning data for artificial intelligence learning;
A learning processing unit 300 that performs learning processing of the learning data multiple times using a plurality of Support Vector Data Description (SVDD) algorithms, and sets characteristics for the learning processing to be different for each SVDD algorithm; and
an analysis unit 400 that performs real-time analysis on input real-time operation data by using a plurality of learning models based on the learning processing result of the learning processing unit 300;
Including,
The analysis unit 400
a first analyzer 410 inputting the real-time operation data to each of a plurality of learning models and performing real-time analysis;
A second analysis unit 420 that analyzes the risk of the real-time operation data by using the respective analysis results of a plurality of learning models in an integrated manner; and
a third analysis unit 430 that determines that an anomaly in which an abnormal behavior may occur occurs when the risk level of the real-time operating data exceeds a preset threshold;
Including more,
The operating data or the real-time operating data
An abnormal symptom detection system of a smart factory using the M-SVDD technique, which is external input information including control information input from a terminal means for remotely monitoring or controlling the smart factory.
According to claim 1,
The data processing unit 200
A first processing unit 210 that performs labeling on the input operation data;
A second processing unit 220 for extracting a characteristic value for the labeling operation data; and
a third processing unit 230 that processes the extracted characteristic value information as learning data;
A smart factory anomaly detection system using the M-SVDD technique.
delete According to claim 1,
An anomaly symptom detection system of a smart factory using the M-SVDD technique
According to the analysis result of the third analyzer 430, when it is determined that an anomaly has occurred, a dictionary for generating control information for performing defense/response measures according to the detected anomaly using a pre-stored database. processing unit 500;
A system for detecting anomalies in smart factories using the M-SVDD technique.
delete In the anomaly symptom detection method of a smart factory using the M-SVDD technique in which each step is performed by the anomaly symptom detection system of the smart factory using the computer-implemented M-SVDD technique,
A data input step (S100) of receiving operational data for a predetermined time period from a smart factory that wants to detect anomalies in a chronological order in a data input unit;
A data generation step (S200) of performing pre-processing of the operation data by the data input step (S100) in a data processing unit to generate learning data for artificial intelligence learning;
Using a plurality of SVDD (Support Vector Data Description) algorithms, learning processing of the learning data by the data generation step (S200) is performed a plurality of times, but the characteristic setting for the learning process is different for each SVDD algorithm. Step (S300);
In the analysis unit, a real-time data input step of receiving real-time operation data from the smart factory (S400);
In the analysis unit, a data analysis step (S500) of performing real-time analysis by inputting the real-time operating data by the real-time data input step (S400) to each of the plurality of learning models by the learning step (S300). );
Including,
The data input step (S100) or the real-time data input step (S400)
External input information including control information input from a terminal means for remotely monitoring or controlling the smart factory is input as operation data,
The data analysis step (S500)
A multi-analysis step (S510) of performing real-time analysis by respectively inputting the real-time operation data by the real-time data input step (S400) to each of a plurality of learning models;
A risk analysis step (S520) of analyzing the risk of the real-time operation data by using the analysis results from the plurality of learning models in the multi-analysis step (S510);
Based on a predetermined threshold value, a determination step (S530) of determining whether the risk level of the real-time operation data by the risk level analysis step (S520) exceeds the threshold value; and
According to the determination result of the determination step (S530), when the risk level of the real-time operation data exceeds the threshold value, the real-time operation data detects that an anomaly that may cause an abnormal behavior of the smart factory has occurred. Abnormal symptom detection step (S540);
A method for detecting anomalies in a smart factory using the M-SVDD technique.
According to claim 6,
The data generation step (S200) is
A labeling step (S210) of performing labeling on the operation data by the data input step (S100);
a characteristic value extraction step (S220) of extracting characteristic values for the operation data labeled by the labeling step (S210); and
A learning data generation step (S230) of generating learning data for the operation data using the feature value information extracted by the feature value extraction step (S220);
A method for detecting anomalies in a smart factory using the M-SVDD technique.
delete According to claim 6,
A method for detecting anomalies in smart factories using the M-SVDD technique
After performing the data analysis step (S500),
In the pre-processing unit, when an anomaly of the smart factory is detected, a pre-action step of generating control information for performing defense/response measures according to the detected anomaly using a pre-stored database (S600);
A method for detecting anomalies in a smart factory using the M-SVDD technique.

Images