# US 11,308,366 B2 · Method for determining optimal anomaly detection model for processing input data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,366 B2 - Document ID: US11308366B2 - Status: Granted - Kind: B2 - Application number: 17/083,205 - Filed: 2020-10-28 - Published: 2021-04-29 - Granted: 2022-04-19 - Earliest claimed: 2019-10-28 - Assignees: MakinaRocks Co., Ltd. - Applicants: MakinaRocks Co., Ltd. - Inventors: Ki Hyun Kim - Web page: https://patentgrep.com/patent/US11308366B2 ## CPC - G06N 3/088: Non-supervised learning, e.g. competitive learning - G06F 18/211: Selection of the most significant subset of features - G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting - G06F 18/217: {Validation; Performance evaluation; Active pattern learning techniques} - G06F 18/23: Clustering techniques - G06F 18/2413: based on distances to training or reference patterns - G06F 18/251: {of input or preprocessed data} - G06N 3/045: Combinations of networks - G06N 3/0455: Auto-encoder networks; Encoder-decoder networks - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/0475: Generative networks - G06N 3/082: modifying the architecture, e.g. adding, deleting or silencing nodes or connections - G06N 3/084: Backpropagation, e.g. using gradient descent - G06N 3/0895: Weakly supervised learning, e.g. semi-supervised or self-supervised learning - G06N 3/094: Adversarial learning - G06N 3/096: Transfer learning - G06N 3/098: Distributed learning, e.g. federated learning - G06N 3/0985: Hyperparameter optimisation; Meta-learning; Learning-to-learn - G06V 10/762: using clustering, e.g. of similar faces in social networks - G06V 10/764: using classification, e.g. of video objects - G06V 10/82: using neural networks - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING ## Abstract Disclosed is a computer program stored in a computer readable storage medium according to an exemplary embodiment of the present disclosure. When the computer program is executed by one or more processors of a computing device, the computer program may perform operations for managing a model, and the operations may include: generating an anomaly detection model including a plurality of anomaly detection sub models having a pre-learned network function through using a plurality of training data subsets included in a training data set; determining one or more anomaly detection sub models for calculating an input data among the generated anomaly detection sub models; and judging whether or not the anomaly is existed in the input data through using the one or more determined anomaly detection sub models. ## Claims ### Claim 1 A computer program stored in a computer readable medium, wherein when the computer program is executed by one or more processors of a computing device, the computer program performs operations to provide methods for managing a model, and the operations comprise: generating, by a processor, an anomaly detection model including a plurality of anomaly detection sub models having a pre-learned network function through using a plurality of training data subsets included in a training data set; clustering, by the processor, the plurality of anomaly detection sub models; generating, by the processor, an integrated anomaly detection sub model through integrating one or more anomaly detection sub models included in one cluster; determining, by the processor, one or more anomaly detection sub models for calculating an input data among the plurality of anomaly detection sub models; and judging, by the processor, whether or not anomaly is existed in the input data through using the one or more anomaly detection sub model. ### Claim 2 (depends on 1) The computer program according to claim 1, wherein the operation of determining one or more anomaly detection sub models for calculating an input data among the generated anomaly detection sub models includes an operation of determining one or more anomaly detection sub models for calculating the input data based on at least one of processing tendency of other input data for the plurality of anomaly detection sub models, context information of the input data, or cluster information of the input data. ### Claim 3 (depends on 2) The computer program according to claim 2, wherein the operation of determining one or more anomaly detection sub models for calculating an input data among the generated anomaly detection sub models includes an operation of determining the anomaly detection sub model for calculating the input data from the anomaly detection sub model that calculates other input data having predetermined relationships with the input data. ### Claim 4 (depends on 3) The computer program according to claim 3, wherein the other input data includes an input data generated before generating the input data and an input data generated within time interval predetermined with the input data. ### Claim 5 (depends on 3) The computer program according to claim 3, wherein the operation of determining the anomaly detection sub model for calculating the input data from the anomaly detection sub model which calculates other input data having predetermined relationships with the input data includes an operation of determining the anomaly detection sub model for calculating the input data from the anomaly detection sub model in which other input data having predetermined relationships with the input data is judged a normal data. ### Claim 6 (depends on 2) The computer program according to claim 2, wherein the operation of determining one or more anomaly detection sub models for calculating an input data among the generated anomaly detection sub models includes an operation of determining one or more anomaly detection sub model for calculating the input data from the anomaly detection sub model matching to the context information based on the context information of the input data. ### Claim 7 (depends on 6) The computer program according to claim 6, wherein the context information includes an information for associating the input data with a normal data, and at least one of a context indicator for associating the input data with at least one of a manufacturing recipe or a manufacturing equipment, a context characteristic indicator for associating with at least one of a manufacturing recipe characteristic or a manufacturing equipment characteristic, or a missing characteristic indicator including information for a missing characteristic of the input data. ### Claim 8 (depends on 6) The computer program according to claim 6, wherein the context information is matched to at least one of the input data or a training data, and the anomaly detection sub model is matched to the context information matching to the training data subsets. ### Claim 9 (depends on 2) The computer program according to claim 2, wherein the operation of determining one or more anomaly detection sub models for calculating an input data among the generated anomaly detection sub models includes an operation of clustering one or more other input data based on a similarity, and an operation of determining the anomaly detection sub model for calculating the input data from the anomaly detection sub model calculating other input data included in a cluster having the input data. ### Claim 10 (depends on 1) The computer program according to claim 1, wherein the operation of clustering a plurality of anomaly detection sub models includes an operation of clustering one or more anomaly detection sub models included the plurality of anomaly detection sub models based on at least one of a context information matched to each anomaly detection sub model, or an input data processing characteristic of each anomaly detection sub model. ### Claim 11 (depends on 1) The computer program according to claim 1, wherein the operation of clustering a plurality of anomaly detection sub models includes an operation of clustering the anomaly detection sub model based on a judging result for the input data of each anomaly detection sub model. ### Claim 12 (depends on 11) The computer program according to claim 11, wherein the operation of clustering the anomaly detection sub model based on a judging result for the input data of each anomaly detection sub model includes an operation of clustering the anomaly detection sub model and other anomaly detection sub model to one cluster when the input data and the other input data is associated with each other, and the anomaly detection sub model judges the input data as a normal data, and the other anomaly detection sub model judges other input data as the normal data. ### Claim 13 (depends on 11) The computer program according to claim 11, wherein the operation of clustering the anomaly detection sub model based on a judging result for the input data of each anomaly detection sub model includes an operation of classifying one or more anomaly detection sub models that judges the input data as the normal data into one cluster. ### Claim 14 (depends on 1) The computer program according to claim 1, wherein the operation of generating an integrated anomaly detection sub model through integrating one or more anomaly detection sub models included in one cluster includes an operation of generating the integrated anomaly detection sub model through an ensemble of one or more anomaly detection sub models included in one cluster. ### Claim 15 (depends on 1) The computer program according to claim 1, wherein the operation of generating an integrated anomaly detection sub model through integrating one or more anomaly detection sub models included in one cluster includes an operation of generating the integrated anomaly detection sub model through removing at least some among one or more anomaly detection sub models included in one cluster. ### Claim 16 (depends on 1) The computer program according to claim 1, wherein the operation of generating an integrated anomaly detection sub model through integrating one or more anomaly detection sub models included in one cluster includes an operation of generating the integrated anomaly detection sub model based on a performance teat for one or more anomaly detection sub models included in one cluster. ### Claim 17 (depends on 1) The computer program according to claim 1, wherein the operation of generating an integrated anomaly detection sub model through integrating one or more anomaly detection sub models included in one cluster includes an operation of generating the integrated anomaly detection sub model through retraining of one or more anomaly detection sub models included in one cluster. ### Claim 18 A method for detecting anomaly of data using network function performed by one or more processors, comprising: generating, by a processor, an anomaly detection model including a plurality of anomaly detection sub models having a pre-learned network function through using a plurality of training data subsets included in a training data set; clustering, by the processor, the plurality of anomaly detection sub models; generating, by the processor, an integrated anomaly detection sub model through integrating one or more anomaly detection sub models included in one cluster; determining, by the processor, one or more anomaly detection sub models for calculating an input data among the plurality of anomaly detection sub models; and judging, by the processor, whether or not anomaly is existed in the input data through using the one or more anomaly detection sub model. ### Claim 19 A computing device, including: one or more processors; and a memory storing commands executable in processor, wherein the processor is configured to: generate an anomaly detection model including a plurality of anomaly detection sub models having a pre-learned network function through using a plurality of training data subsets included in a training data set; cluster the plurality of anomaly detection sub models; generate an integrated anomaly detection sub model through integrating one or more anomaly detection sub models included in one cluster; determine one or more anomaly detection sub models for calculating an input data among the plurality of anomaly detection sub models; and judge whether or not anomaly is existed in the input data through using the one or more anomaly detection sub model.