KR-102963046-B1 - method and system for judgment of abnormal situation based on natural language

KR102963046B1KR 102963046 B1KR102963046 B1KR 102963046B1KR-102963046-B1

Abstract

A natural language-based anomaly detection method according to an embodiment of the present invention comprises: a step of selecting keywords for anomaly detection from a dataset using a large language model (LLM); a step of generating a decision tree for determining whether a unit event is an anomaly; a step of acquiring text data for a unit event; and a step of using the generated decision tree to determine whether the acquired text data contains the selected keywords, and determining whether the unit event is an anomaly based on whether the keywords are included. By doing so, anomalies can be detected effectively and quickly.

Inventors

계효선
김지형
이상신

Assignees

한국전자기술연구원

Dates

Publication Date: 20260511
Application Date: 20240927

Claims (12)

A step in which the system utilizes a Large Language Model (LLM) to select keywords for anomaly detection from a dataset composed of natural language data; A step in which the system generates a decision tree to determine whether there is an abnormal situation of the corresponding unit event; The system acquires text data for a unit event; and A natural language-based anomaly detection method comprising the step of: the system utilizing a generated decision tree to determine whether the acquired text data contains a selected keyword, and determining whether the unit event is an anomaly based on whether it is included.
In claim 1, Decision trees are, A natural language-based anomaly detection method characterized by utilizing data selected as keywords for anomaly detection through a large language model as training data during training.
In claim 1, The step of acquiring text data for unit events is, A natural language-based anomaly detection method characterized by utilizing a large language model to extract text (natural language) data for anomaly detection from acquired unstructured data when acquiring unstructured data.
In claim 3, The step of determining whether there is an abnormal situation in the relevant unit event is, A natural language-based abnormal situation determination method characterized by utilizing a decision tree to determine whether a unit event is abnormal, and numerically calculating the risk level of the occurring abnormal situation by comparing it with stored expert knowledge information.
In claim 4, Decision trees are, A natural language-based abnormal situation determination method characterized by calculating the risk level of an abnormal situation within a range from Level 1, which has the lowest risk, to Level 5, which has the highest risk, based on whether the situation occurs, the degree of human damage caused by the situation, and the priority of response to the situation.
In claim 5, Decision trees are, A natural language-based anomaly detection method in which, when the risk level is calculated within the range of 1 to 5 levels, the maximum depth (max_depth) is set to 4 for judgment accuracy and computational efficiency.
In claim 1, A step of evaluating the performance of the learned decision tree through a large language model; and A natural language-based abnormal situation judgment method characterized by further including a step of retraining a decision tree by reflecting evaluation results.
In claim 7, The evaluation stage is, A natural language-based anomaly detection method characterized by evaluating the performance of a decision tree at preset intervals.
In claim 8, The retraining step is, A natural language-based abnormal situation detection method characterized by retraining the decision tree by reflecting the evaluation result when the evaluation result of the decision tree is below a preset threshold.
A storage unit for storing a dataset composed of natural language data; and A natural language-based anomaly detection system comprising: a processor that utilizes a large language model (LLM) to select keywords for anomaly detection from a dataset composed of natural language data, generates a decision tree to determine whether a unit event is an anomaly, and when text data for a unit event is obtained, utilizes the generated decision tree to determine whether the obtained text data contains the selected keywords, and determines whether the unit event is an anomaly based on whether it contains them.
A step in which the system utilizes a Large Language Model (LLM) to select keywords for anomaly detection from a dataset composed of natural language data; The system generates a decision tree to determine whether a unit event is an abnormal situation; When the system acquires unstructured data, a step of utilizing a large language model to extract text (natural language) data for determining anomalies from the acquired unstructured data; and A natural language-based anomaly detection method comprising the step of: a system utilizing a generated decision tree to determine whether a selected keyword is included in text (natural language) data, and determining whether there is an anomaly in the corresponding unit event based on whether it is included.
A keyword selection unit that selects keywords for anomaly detection from a dataset composed of natural language data using a large language model (LLM); A decision tree generation unit for generating a decision tree to determine whether a unit event is an abnormal situation; When acquiring unstructured data, a text data extraction unit that utilizes a large language model to extract text (natural language) data for determining anomalies from the acquired unstructured data; and A natural language-based anomaly judgment system comprising: an anomaly judgment unit that utilizes a generated decision tree to determine whether a selected keyword is included in text (natural language) data and determines whether there is an anomaly in the corresponding unit event based on whether it is included.

Description

Method and system for judgment of abnormal situation based on natural language The present invention relates to a method and system for determining abnormal situations, and more specifically, to a method and system for determining abnormal situations based on natural language. When attempting to detect anomalies through video, previously, the anomalies had to be predefined and required training with a massive amount of data, so it was barely possible to detect anomalies at a very simple level. However, recently, as the performance of VLM (Vision-Language Model) has improved, it has become possible to generate descriptions (natural language) for CCTV footage. Accordingly, there is a need to explore methods to detect anomalies based on natural language generation for images. FIG. 1 is a drawing provided for the description of the configuration of a natural language-based abnormal situation judgment system according to an embodiment of the present invention, FIG. 2 is a drawing provided for a more detailed description of the configuration of a processor according to one embodiment of the present invention, FIG. 3 is a diagram illustrating the application of all words present in the training data to a decision tree according to an embodiment of the present invention. FIG. 4 is a diagram illustrating the application of a word (keyword) selected through a large language model (LLM) to a decision tree according to an embodiment of the present invention. FIG. 5 is a drawing provided to explain the learning process of a decision tree according to one embodiment of the present invention, FIG. 6 is a diagram illustrating learning data of a decision tree according to one embodiment of the present invention, FIG. 7 is a diagram illustrating test data for performance evaluation of a decision tree according to an embodiment of the present invention. FIG. 8 is a drawing provided for explaining the process of determining whether an abnormal situation exists by utilizing a decision tree according to an embodiment of the present invention. FIG. 9 is a flowchart provided for explaining a natural language-based abnormal situation determination method according to an embodiment of the present invention, and FIG. 10 is a drawing provided to explain a natural language-based abnormal situation determination method according to one embodiment of the present invention. The present invention will be described in more detail below with reference to the drawings. To clearly explain the invention, parts unrelated to the description have been omitted from the drawings, and in the drawings, the width, length, thickness, etc., of the components may be exaggerated for convenience. FIG. 1 is a diagram provided for the configuration description of a natural language-based abnormal situation judgment system according to one embodiment of the present invention. The natural language-based abnormal situation determination system according to the present embodiment (hereinafter collectively referred to as the 'system') utilizes a large language model (LLM) to generate a decision tree for determining whether an abnormal situation exists, and is provided to determine whether an abnormal situation exists by utilizing the decision tree. To this end, the system may include an input unit (100), a processor (200), and a storage unit (300). The input unit (100) is equipped with a communication module connected to a network, so that it can obtain unstructured data from CCTV, an external server, etc. The storage unit (300) is provided to store programs and data necessary for the operation of the processor (200). Specifically, the storage unit (300) may include an expert knowledge DB that stores a dataset composed of natural language data and expert knowledge information used to determine the risk level of an abnormal situation that occurs. A processor (200) is provided to generate a decision tree for determining whether an abnormal situation exists by utilizing a large language model (LLM), and to process all matters for determining whether an abnormal situation exists by utilizing the decision tree. Specifically, the processor (200) can utilize a large language model (LLM) to select keywords for determining anomalies from a dataset composed of natural language data and generate a decision tree to determine whether the unit event is anomaly. Additionally, the processor (200) can evaluate the performance of the generated (trained) decision tree through a large language model, retrain the decision tree by reflecting the evaluation results, and then, when text data for a unit event is obtained, use the decision tree to determine whether there is an abnormal situation in the unit event. FIG. 2 is a drawing provided for a more detailed description of the configuration of a processor (200) according to one embodiment of the present invention. Referring to FIG. 2, the processor (200) may include a keyword selection unit (210), a decision tree generation unit (220),