Patent Description:
Time series data refers to data collected over time. Examples of time series data may include product demand quantity data for a certain period of time, anomaly detection data of an IoT device or the like, log data, and the like. Time series data analysis is widely utilized in all fields in which data associated with a concept of time are collected and analyzed, such as demand forecast, anomaly detection, log analysis, and the like.

Recently, machine learning has been increasingly used in time series data analysis. In order to improve accuracy of machine learning, a large amount of training data is required. However, imbalance in data distribution often occurs in time series data. For example, in the case of fault log data, normal data is collected in most of the cases, except for a very small number of fault data, and thus even when there is a large amount of data collected, the amount of fault log data necessary to predict failure is often insufficient.

<NPL>), discloses a multi-scale convolutional neural network for time series classification (TSC). To overcome the problem that TSC datasets have limited sizes, a data augmentation technique on the original datasets is proposed in order to avoid overfitting and to improve the generalization ability. In particular, a window slicing for the data augmentation is proposed, in which a slice is a snippet of the original time series.

<NPL>), discloses a synthetic oversampling method for a variable length, multi-feature sequence dataset based on autoencoders and generative adversarial networks. The proposed method decreases the data imbalance either by resampling or by generating synthetic minority data such that the training data is more balanced.

<NPL>), discloses a concept for dataset augmentation in a feature space.

It is therefore the object of the present invention to provide an improved apparatus for analyzing time series data for anomaly detection, log analysis or censor data analysis, and a corresponding method of analyzing time series data.

The disclosed embodiments are intended to provide a technical means for effectively performing augmentation of time series data to be learned in time series data analysis based on machine learning.

In one general aspect, there is provided an apparatus for analyzing time series data including a training data generation module configured to generate one or more pieces of training data by extracting a predetermined length of time period from raw time series data which includes one or more columns and a plurality of observations measured for the columns at consistent time intervals; a first data augmentation module configured to, when a target value of the generated training data satisfies a specific condition, further generate one or more pieces of training data which have the same target value as the target value but have a different length of time period to be extracted; a feature extractor configured to receive the training data and extract one or more feature values from the training data; and a classifier configured to classify the training data on the basis of the one or more extracted feature values.

The apparatus may further include a second data augmentation module configured to augment one or more of the training data and the feature values according to a characteristic of the column.

When the columns include one or more numeric columns, the second data augmentation module may augment one or more pieces of training data by applying a predetermined data augmentation scheme to observations that correspond to the numeric columns of the generated training data, and the feature extractor may receive the augmented training data and extract one or more feature values from the augmented training data.

When the columns include one or more categorical columns, the second data augmentation module may augment one or more feature values by applying a predetermined data augmentation scheme to the one or more feature values extracted by the feature extractor and the classifier may classify the training data on the basis of the augmented feature values.

The apparatus may further include a policy recommendation module configured to determine an optimal data augmentation policy for augmenting one or more of the training data and the feature values.

The policy recommendation module may perform learning by applying a plurality of different data augmentation policies to the training data and the feature values and determine the optimal data augmentation policy by comparing training results for each data augmentation policy.

The policy recommendation module may terminate learning in accordance with a specific data augmentation policy and delete the specific data augmentation policy when a value of loss function increases during a learning process to which the specific data augmentation policy is applied or when a difference between a mean of values of the loss function during a specific past period and a current value of loss function is smaller than a set threshold.

In another general aspect, there is provided a method of analyzing time series data, which is performed by a computing device comprising one or more processors and a memory in which one or more programs to be executed by the one or more processors are stored, the method including generating one or more pieces of training data by extracting a predetermined length of time period from raw time series data which includes one or more columns and a plurality of observations measured for the columns at consistent time intervals; when a target value of the generated training data satisfies a specific condition, further generating one or more pieces of training data which have the same target value as the target value but have a different length of time period to be extracted; receiving the training data and extracting one or more feature values from the training data; and classifying the training data on the basis of the one or more extracted feature values.

The method may further include augmenting one or more of the training data and the feature values according to a characteristic of the column.

When the columns include one or more numeric columns, the augmenting may include augmenting the one or more pieces of training data by applying a predetermined data augmentation scheme to observations that correspond to the numeric columns of the generated training data, and the extracting of the one or more feature values may include receiving the augmented training data and extracting the one or more feature values from the augmented training data.

When the columns include one or more categorical columns, the augmenting may include augmenting the one or more feature values by applying a predetermined data augmentation scheme to the one or more extracted feature values and the classifying may include classifying the training data on the basis of the augmented feature values.

The method may further include determining an optimal data augmentation policy for augmenting one or more of the training data and the feature values.

The determining of the optimal data augmentation policy may include performing learning by applying a plurality of different data augmentation policies to the training data and the feature values and determining the optimal data augmentation policy by comparing training results for each data augmentation policy.

The determining of the optimal data augmentation policy may include terminating learning in accordance with a specific data augmentation policy and deleting the specific data augmentation policy when a value of loss function increases during a learning process to which the specific data augmentation policy is applied or when a difference between a mean of values of the loss function during a specific past period and a current value of loss function is smaller than a set threshold.

The following description is provided to assist the reader in gaining a comprehensive understanding of the methods, apparatuses, and/or systems described herein. Accordingly, various changes, modifications, and equivalents of the methods, apparatuses, and/or systems described herein will be suggested to those of ordinary skill in the art.

Descriptions of well-known functions and constructions may be omitted for increased clarity and conciseness. Also, terms described in below are selected by considering functions in the embodiment and meanings may vary depending on, for example, a user or operator's intentions or customs. Therefore, definitions of the terms should be made on the basis of the overall context. The terminology used in the detailed description is provided only to describe embodiments of the present disclosure and not for purposes of limitation. Unless the context clearly indicates otherwise, the singular forms include the plural forms. It should be understood that the terms "comprises" or "includes" specify some features, numbers, steps, operations, elements, and/or combinations thereof when used herein, but do not preclude the presence or possibility of one or more other features, numbers, steps, operations, elements, and/or combinations thereof in addition to the description.

<FIG> is a table for describing time series data used in disclosed embodiments. Time series data refers to data that has a temporal order, such as sensor data, sales data, and the like. The time series data includes one or more columns and a plurality of observations measured for the columns at consistent time intervals. <FIG> illustrates weekly demand data for an arbitrary product. In the time series data shown in <FIG>, columns represent "store code", "item", "week number", "holiday", and "quantity demanded.

Unlike data whose value can be expressed numerically, such as image or voice data, each column of the time series data may be classified into a numerical column and a categorical column. For example, in the time series data shown in <FIG>, "store code", "item", and "week number" are categorical columns and "holiday", and "quantity demanded" are numeric columns. For reference, the column of "holiday" in the shown time series data represents a ratio of holidays occupying a corresponding week. Slight numerical changes in values corresponding to the numeric columns may not cause a significant change in the meaning of data. For example, when quantity demanded in a specific week is changed from <NUM> to <NUM> or to <NUM>, such a change does not significantly affect the trend of the whole data. However, in the case of a value corresponding to the categorical column, the meaning of the value may completely change according to the numerical change in the value. For example, when assuming that store code is assigned <NUM>, <NUM>, <NUM>, or the like according to the store, change of the store code from <NUM> to <NUM> or to <NUM> results in the change of the store itself. Therefore, in the case of time series data, it is necessary to distinguish between the numeric columns and the categorical columns in processing data.

In the disclosed embodiments, time series data is learned via a machine leaning model, for example, a deep neural network, to generate a prediction model. If time series data to be learned are distributed uniformly and there is a large amount of data, a prediction model with high prediction accuracy may be generated. However, data observed in the real world often follow a nonnormal distribution in which data is excessively biased to specific values, and the amount of data is mostly insufficient. For example, in the case of demand quantity data for a product for which demand occurs irregularly, data is excessively biased to <NUM> since the quantity demanded is mostly <NUM> except for a section where the demand occurs. When a demand forecasting model is trained with such data, a model that predicts most of the results as <NUM> is generated. In addition, in the case of anomaly detection data, most of the sensor data correspond to a normal section and data corresponding to a faulty section are very few, and thus it is difficult to collect data having characteristics related to the faulty section.

<FIG> is a block diagram for describing an apparatus <NUM> for analyzing time series data according to one embodiment. The apparatus <NUM> for analyzing time series data according to one embodiment refers to an apparatus for learning time series data and performing a prediction on what will happen in the future. For example, in a case where the time series data is sales data with respect to a specific product sold during a predetermined period, the apparatus <NUM> for analyzing time series data may predict a future sales amount by learning a past sales history for the corresponding product. In another example, in a case where the time series data is sensor data measured by a specific device, the apparatus <NUM> for analyzing time series data may predict a future failure of the corresponding device by analyzing the sensor data obtained for a certain period of time.

As shown in <FIG>, the apparatus <NUM> for analyzing time series data according to one embodiment includes a training data generation module <NUM>, a first data augmentation module <NUM>, a feature extractor <NUM>, and a classifier <NUM>.

The training data generation module <NUM> generates one or more pieces of training data by extracting a predetermined length of time period from raw time series data. As described above, the raw time series data may include one or more columns and a plurality of observations (rows) measured for the columns at consistent time intervals.

<FIG> shows tables for describing an example in which the training data generation module <NUM> generates training data according to one embodiment. Specifically, <FIG> shows an example in which training data is generated from the raw time series data shown in <FIG>, that is, demand quantity data recorded for each successive week with respect to the same store and the same item.

As shown in <FIG>, when there is demand quantity data recorded for <NUM> weeks with respect to the same store and the same item, it is assumed that after observing consecutive input data for <NUM> weeks from a starting week, training data for predicting a quantity demanded in the following week as a target value is generated. Then, the training data generation module <NUM> may generate <NUM> pieces of training data as shown in <FIG> from the raw data of <FIG>. Specifically, <FIG> shows training data for predicting a quantity demanded in week <NUM> from the quantities demanded from week <NUM> to week <NUM>, <FIG> shows training data for predicting a quantity demanded in week <NUM> from quantities demanded from week <NUM> to week <NUM>, <FIG> shows training data for predicting a quantity demanded in week <NUM> from quantities demanded from week <NUM> to week <NUM>, and <FIG> shows training data for predicting a quantity demanded in week <NUM> from quantities demanded from week <NUM> to week <NUM>.

When the target value of the training data generated by the training data generation module <NUM> meets a specific condition, the first data augmentation module <NUM> further generates one or more pieces of training data which have the same target value as said target value but have a different length of time period to be extracted.

<FIG> shows tables for describing an example in which the first data augmentation module <NUM> further generates training data according to one embodiment. Specifically, <FIG> shows an example in which training data is further generated from the raw time series data shown in <FIG>, that is, the demand quantity data recorded for each successive week with respect to the same store and the same item.

For example, it is assumed that training data is further generated for a specific week in which a target value (quantity demanded) is greater than or equal to <NUM> in the raw time series data shown in <FIG>. Then, the first data augmentation module <NUM> may further generate training data for week <NUM>, week <NUM>, and week <NUM>, in which the quantity demanded is greater than or equal to <NUM>, by changing the length of time period to be extracted from <NUM> weeks to <NUM> weeks, <NUM> weeks, or <NUM> weeks. Specifically, <FIG> shows training data for predicting a quantity demanded in week <NUM> from the quantities demanded from week <NUM> to week <NUM>, <FIG> shows training data for predicting a quantity demanded in week <NUM> from quantities demanded from week <NUM> to week <NUM>, <FIG> shows training data for predicting a quantity demanded in week <NUM> from quantities demanded from week <NUM> to week <NUM>, and <FIG> shows training data for predicting a quantity demanded in week <NUM> from quantities demanded from week <NUM> to week <NUM>.

As such, when the target value satisfies a specific condition, the first data augmentation module <NUM> may further generate training data by varying the length of time period to be extracted so that an overfitting problem due to imbalance of data distribution that the time series data may have can be alleviated. In the aforementioned example, training data is further generated only for a case in which a target quantity demanded is greater than or equal to1, so that training data in which the quantity demanded is greater than or equal to <NUM> can be further secured for a case of time series in which most of the quantities demanded are <NUM>. Particularly, a deep neural network in a recurrent neural network (RNN) family suitable for pattern learning of order (temporal relevance) information may learn data having a variable time length as an input, and hence observation time of input data may be variously generated and utilized.

Then, the feature extractor <NUM> may receive the training data and extracts one or more feature values from the training data. The feature extractor <NUM> removes unnecessary information by stepwise filtering and/or extracting information of the input training data, extracts features that are important and have information, and provides the features as inputs of the classifier <NUM>. In the disclosed embodiments, the feature extractor <NUM> may use ca convolutional neural network (CNN), RNN, a fully connected network (FNC), and the like according to features of the time series data.

The classifier <NUM> classifies the training data on the basis of one or more extracted feature values. Since the time series data requires a pattern analysis on a temporal order, the classifier <NUM> may learn the order pattern by inputting the feature value extracted for each time by the feature extractor <NUM> into an RNN or a bi-directional recurrent neural network (BRNN). Also, the classifier <NUM> may configure a model that classifies feature vectors, which are extracted by learning about a feature axis and a time axis, according to a class via a FNC or predicts the feature vectors as a single value.

Meanwhile, the apparatus <NUM> for analyzing time series data according to one embodiment may further include a second data augmentation module <NUM>. The second data augmentation module <NUM> may augment one or more of the training data and the feature value according to features of each column of the time series data. Specifically, in a case where a numerical column is included in the columns of the time series data, the second data augmentation module <NUM> according to one embodiment may augment the training data by applying a predetermined data augmentation scheme to an observation in the generated training data which corresponds to the numerical column. Then, the feature extractor <NUM> may receive the augmented training data and extract one or more feature values from the training data. Hereinafter, such augmentation of a numerical column of training data will be referred to as "raw space augmentation.

In addition, in a case where a categorical column is included in the columns of the time series data, the second data augmentation module <NUM> may augment the feature values by applying a predetermined data augmentation scheme to the one or more feature values extracted by the feature extractor <NUM>. Then, the classifier <NUM> may classify the training data on the basis of the augmented feature values. Hereinafter, the augmentation of an output value of the feature extractor <NUM> will be referred to as "feature space augmentation.

Hereinafter, the raw space augmentation and the feature space augmentation will be described in more detail.

Raw space augmentation is one of data augmentation schemes and is a method of generating similar training data by modifying training data. For example, in the case of voice data, training data may be augmented by changing the form of voice, such as slowing down the speed of voice or changing the pitch of voice, without changing the meaning of the voice data.

As described above, the time series data consists of numeric columns and categorical columns, and in the case of the categorical columns, the meaning of data can be significantly changed even with a slight change in value. Therefore, in the disclosed embodiments, the second data augmentation module <NUM> may apply additional training data from previously generated training data by utilizing various schemes, such as applying a slight noise to the numeric columns by applying raw space augmentation only to the numeric columns of the time series data, or making a slight change in the time series trend.

When the raw space augmentation is applied to the time series data consisting of numeric columns and categorical columns, new training data may be generated by utilizing various time series data augmentation schemes, such as applying a slight noise only to the numeric columns or making a slight change in the time series trend.

<FIG> is a diagram for describing an example in which the second data augmentation module <NUM> applies raw space augmentation to training data according to one embodiment. For example, the second data augmentation module <NUM> may apply a scaling scheme to some training data in the same batch and apply a trend determination scheme to some other training data, thereby effectively amplifying the training data. In the disclosed embodiments, the batch of the training data refers to a group of training data that is processed at a time at the time of learning a model. The second data augmentation module <NUM> may be configured to apply various augmentation schemes and augmentation ratios for each batch of the training data such that the feature extractor <NUM> and the classifier <NUM> can effectively learn various forms of the training data.

A data augmentation policy necessary for the second data augmentation module <NUM> to apply raw space augmentation to training data may include as follows:
"Augmentation scheme" refers to an augmentation scheme to be applied to training data. For example, the augmentation scheme may include scaling, jittering, trend determination, magnitude warp, and the like.

"Augmentation application ratio" refers to a ratio of training data to which an augmentation scheme is applied.

"Parameter" refers to parameters related to a set augmentation scheme.

As described above, in the case of raw space augmentation, training data can be augmented only for numerical data in time series data columns and augmentation for categorical columns changes the meaning of data itself, and hence the raw space augmentation cannot be applied. Accordingly, the second data augmentation module <NUM> applies a data augmentation scheme not to training data itself but to the output values of the feature extractor <NUM>, that is, the feature values generated from the training data, in order to increase the amount of training data of a data set including a categorical column.

The feature value data extracted by the feature extractor <NUM> is a vector that numerically expresses important information having characteristics of input values as a numerical value, and may be considered sufficiently representative of the learning data. Thus, data augmentation for such a feature value may produce an effect similar to that of augmentation of training data.

<FIG> is a graph for describing an example in which the second augmentation module <NUM> applies feature space augmentation to a feature value according to one embodiment. For convenience of description, in <FIG>, each feature vector is illustrated as having two dimensions, but dimensions of the feature vector may vary according to the training data and a learning model.

In the graph shown in <FIG>, blue dots denote feature values to which an augmentation scheme is not applied and orange dots denote feature values to which the augmentation scheme is applied. The feature values to which the augmentation scheme is applied are present in a similar space to that of an original feature value, and thus the augmented feature values may be considered to have similar characteristics to those of the original feature value.

A data augmentation policy necessary for the second data augmentation module <NUM> to apply feature space augmentation to training data may be constructed the same as the raw space augmentation.

Meanwhile, the apparatus <NUM> for analyzing time series data may further include a policy recommendation module <NUM>. The policy recommendation module <NUM> according to one embodiment may determine an optimal data augmentation policy for augmenting one or more of the training data and the feature values.

As described above, when the data augmentation scheme is applied to the training data or the feature value, better learning result can be achieved as compared to a case where the data augmentation is not applied. However, time series data which is a target to be learned has various characteristics, and thus it is inefficient to apply the same augmentation scheme to all time series data. Therefore, the apparatus <NUM> for analyzing time series data may be configured to determine which data augmentation policy is the most effective for the time series data to be learned and recommend an optimal data augmentation policy. As described above, the data augmentation scheme may include an augmentation scheme, an augmentation application ratio, parameters, and the like.

In one embodiment, the policy recommendation module <NUM> may perform learning by applying a plurality of different data augmentation schemes to the training data and the feature values and determine the optimal data augmentation policy by comparing the learning results for each data augmentation policy.

<FIG> is a flowchart illustrating a process of determining an optimal data augmentation policy in the policy recommendation module <NUM> according to one embodiment. In the illustrated flowchart, raw space augmentation or feature space augmentation may be equally applied.

In operation <NUM>, the policy recommendation module <NUM> generates a plurality of data augmentation policies to be applied to raw space augmentation or feature space augmentation. In this case, the policy recommendation module <NUM> may receive the data augmentation policies from a user or randomly generate the data augmentation policies.

In operation <NUM>, the policy recommendation module <NUM> selects one from the generated data augmentation policies.

In operation <NUM>, the policy recommendation module <NUM> performs model learning by applying the selected policy to training data.

In operation <NUM>, the policy recommendation module <NUM> periodically determines whether the learning result corresponds to an early stopping condition during the learning of the model. In one embodiment, the policy recommendation module <NUM> may determine that the learning result corresponds to the early stopping condition when a value of loss function increases during the learning process in accordance with the selected policy or when a difference between the mean of values of the loss function within a specific past period and the current value of loss function is smaller than a set threshold. Specifically, the early stopping condition may be expressed as follows: <MAT> <MAT>.

These conditions will be described in more detail as follows.

Condition <NUM> represents a case where losst which is a value of loss function at time t becomes greater than losst-<NUM> which is a value of loss function at time t-<NUM>. A greater loss than a previous point in time may mean that learning is not performed. Condition <NUM> represents a case where a difference between losst at time t and the mean value of loss functions during a past period (t-k to t-<NUM>) from time t is smaller than a set threshold. In this case, the length k of the past period and the threshold may be appropriately set by taking into account characteristics of the time series data.

When it is determined in operation <NUM> that the early stopping condition is satisfied, in operation <NUM>, the policy recommendation module <NUM> may delete the policy selected in operation <NUM>. That is, when one or both of the above conditions <NUM> and <NUM> are applied and satisfied, the policy recommendation module <NUM> may determine that learning is no longer performed properly and may terminate the learning early. As such, when the separate early stopping condition is used, unnecessary computation may be reduced and efficiency of an optimal policy determination process may be improved.

By contrast, when it is determined in operation <NUM> that the early stopping condition is not satisfied, in operation <NUM>, the policy recommendation module <NUM> determines whether the learning in accordance with the corresponding policy is terminated.

When it is determined in operation <NUM> that the learning is not terminated, the policy recommendation module <NUM> returns back to operation <NUM> and continues to perform learning.

In contrast, when it is determined in operation <NUM> that the learning is terminated, or when the policy is deleted according to the early stopping condition in operation <NUM>, in operation <NUM>, the policy recommendation module <NUM> determines whether there are remaining data augmentation policies.

When it is determined in operation <NUM> that there are remaining policies, the policy recommendation module <NUM> returns back to operation <NUM> and selects one from the remaining data augmentation policies.

In contrast, when it is determined in operation <NUM> that there is no remaining policy, the policy recommendation module <NUM> determines an optimal policy by comparing the learning results for each policy.

<FIG> is a flowchart for describing a method <NUM> of analyzing time series data according to one embodiment. The illustrated flowchart may be performed by a computing device which includes one or more processors and a memory in which one or more programs to be executed by the one or more processors, for example, the above-described apparatus <NUM> for analyzing time series data. In the illustrated flowchart, the method or process is described as being divided into a plurality of operations. However, it should be noted that at least some of the operations may be performed in different order or may be combined into fewer operations or further divided into more operations. In addition, some of the operations may be omitted, or one or more extra operations, which are not illustrated, may be added to the flowchart and be performed.

In operation <NUM>, the training data generation module <NUM> of the apparatus <NUM> for analyzing time series data generates one or more pieces of training data by extracting a predetermined length of time period from raw time series data that includes one or more columns and a plurality of observations measured for the columns at consistent time intervals.

In operation <NUM>, when a target value of the generated training data satisfies a specific condition, the first data augmentation module <NUM> of the apparatus <NUM> for analyzing time series data further generates one or more pieces of training data which have the same target value as the target value of the previously generated training data but have a different length of time period to be extracted.

In operation <NUM>, the feature extractor <NUM> of the apparatus <NUM> for analyzing time series data receives the training data and extracts one or more feature values from the training data.

In operation <NUM>, the classifier <NUM> of the apparatus <NUM> for analyzing time series data classifies the training data on the basis of the one or more extracted feature values.

<FIG> is a block diagram for describing a computing environment including a computing device suitable to be used in exemplary embodiments. In the illustrated embodiments, each of the components may have functions and capabilities different from those described hereinafter and additional components may be included in addition to the components described herein.

The illustrated computing environment <NUM> includes a computing device <NUM>. In one embodiment, the computing device <NUM> may be the apparatus <NUM> for analyzing time series data according to embodiments of the present disclosure. The computing device <NUM> may include at least one processor <NUM>, a computer-readable storage medium <NUM>, and a communication bus <NUM>. The processor <NUM> may cause the computing device <NUM> to operate according to the above-described exemplary embodiment. For example, the processor <NUM> may execute one or more programs stored in the computer-readable storage medium <NUM>. The one or more programs may include one or more computer executable commands, and the computer executable commands may be configured to, when executed by the processor <NUM>, cause the computing device <NUM> to perform operations according to the exemplary embodiment.

The computer readable storage medium <NUM> is configured to store computer executable commands and program codes, program data and/or information in other suitable forms. The program <NUM> stored in the computer readable storage medium <NUM> may include a set of commands executable by the processor <NUM>. In one embodiment, the computer readable storage medium <NUM> may be a memory (volatile memory, such as random access memory (RAM), non-volatile memory, or a combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash memory devices, storage media in other forms capable of being accessed by the computing device <NUM> and storing desired information, or a combination thereof.

The communication bus <NUM> connects various other components of the computing device <NUM> including the processor <NUM> and the computer readable storage medium <NUM>.

The computing device <NUM> may include one or more input/output interfaces <NUM> for one or more input/output devices <NUM> and one or more network communication interfaces <NUM>. The input/output interface <NUM> and the network communication interface <NUM> are connected to the communication bus <NUM>. The input/output device <NUM> may be connected to other components of the computing device <NUM> through the input/output interface <NUM>. The illustrative input/output device <NUM> may be a pointing device (a mouse, a track pad, or the like), a keyboard, a touch input device (a touch pad, a touch screen, or the like), an input device, such as a voice or sound input device, various types of sensor devices, and/or a photographing device, and/or an output device, such as a display device, a printer, a speaker, and/or a network card. The illustrative input/output device <NUM>, which is one component constituting the computing device <NUM>, may be included inside the computing device <NUM> or may be configured as a device separate from the computing device <NUM> and be connected to the computing device <NUM>.

According to the disclosed embodiments, it is possible to effectively augment time series data, which is a target to be learned, according to characteristics of the time series data, thereby solving a problem of overfitting a machine learning model due to limited training data and a problem of deterioration of prediction accuracy due to imbalance of distribution of time series data and improving reliability of time series data analysis.

In addition, according to the disclosed embodiments, it is possible to effectively set an optimal parameter for augmenting time series data.

Claim 1:
An apparatus for analyzing time series data for anomaly detection data of an IoT device , the apparatus comprising:
a training data generation module (<NUM>) configured to generate (<NUM>) one or more pieces of training data by extracting a predetermined length of time period from raw time series data which comprises one or more columns and a plurality of observations measured for the columns at consistent time intervals, the generated training data comprises a target value;
a first data augmentation module (<NUM>) configured to, when the target value of the generated training data satisfies a specific condition, further generate (<NUM>) one or more additional pieces of training data which have the same target value as the target value but have a different varying length of time period to be extracted;
a feature extractor (<NUM>) configured to receive the training data generated by the training data generation module (<NUM>) and by the first data augmentation module (<NUM>) and extract (<NUM>) one or more feature values from the training data; and
a classifier (<NUM>) configured to classify (<NUM>) the training data on the basis of the one or more extracted feature values.