A Study of Anomaly Detection for ICT Infrastructure using Conditional Multimodal Autoencoder (ICT 인프라 이상탐지를 위한 조건부 멀티모달 오토인코더에 관한 연구)
-
- Journal of Intelligence and Information Systems
- /
- v.27 no.3
- /
- pp.57-73
- /
- 2021
Maintenance and prevention of failure through anomaly detection of ICT infrastructure is becoming important. System monitoring data is multidimensional time series data. When we deal with multidimensional time series data, we have difficulty in considering both characteristics of multidimensional data and characteristics of time series data. When dealing with multidimensional data, correlation between variables should be considered. Existing methods such as probability and linear base, distance base, etc. are degraded due to limitations called the curse of dimensions. In addition, time series data is preprocessed by applying sliding window technique and time series decomposition for self-correlation analysis. These techniques are the cause of increasing the dimension of data, so it is necessary to supplement them. The anomaly detection field is an old research field, and statistical methods and regression analysis were used in the early days. Currently, there are active studies to apply machine learning and artificial neural network technology to this field. Statistically based methods are difficult to apply when data is non-homogeneous, and do not detect local outliers well. The regression analysis method compares the predictive value and the actual value after learning the regression formula based on the parametric statistics and it detects abnormality. Anomaly detection using regression analysis has the disadvantage that the performance is lowered when the model is not solid and the noise or outliers of the data are included. There is a restriction that learning data with noise or outliers should be used. The autoencoder using artificial neural networks is learned to output as similar as possible to input data. It has many advantages compared to existing probability and linear model, cluster analysis, and map learning. It can be applied to data that does not satisfy probability distribution or linear assumption. In addition, it is possible to learn non-mapping without label data for teaching. However, there is a limitation of local outlier identification of multidimensional data in anomaly detection, and there is a problem that the dimension of data is greatly increased due to the characteristics of time series data. In this study, we propose a CMAE (Conditional Multimodal Autoencoder) that enhances the performance of anomaly detection by considering local outliers and time series characteristics. First, we applied Multimodal Autoencoder (MAE) to improve the limitations of local outlier identification of multidimensional data. Multimodals are commonly used to learn different types of inputs, such as voice and image. The different modal shares the bottleneck effect of Autoencoder and it learns correlation. In addition, CAE (Conditional Autoencoder) was used to learn the characteristics of time series data effectively without increasing the dimension of data. In general, conditional input mainly uses category variables, but in this study, time was used as a condition to learn periodicity. The CMAE model proposed in this paper was verified by comparing with the Unimodal Autoencoder (UAE) and Multi-modal Autoencoder (MAE). The restoration performance of Autoencoder for 41 variables was confirmed in the proposed model and the comparison model. The restoration performance is different by variables, and the restoration is normally well operated because the loss value is small for Memory, Disk, and Network modals in all three Autoencoder models. The process modal did not show a significant difference in all three models, and the CPU modal showed excellent performance in CMAE. ROC curve was prepared for the evaluation of anomaly detection performance in the proposed model and the comparison model, and AUC, accuracy, precision, recall, and F1-score were compared. In all indicators, the performance was shown in the order of CMAE, MAE, and AE. Especially, the reproduction rate was 0.9828 for CMAE, which can be confirmed to detect almost most of the abnormalities. The accuracy of the model was also improved and 87.12%, and the F1-score was 0.8883, which is considered to be suitable for anomaly detection. In practical aspect, the proposed model has an additional advantage in addition to performance improvement. The use of techniques such as time series decomposition and sliding windows has the disadvantage of managing unnecessary procedures; and their dimensional increase can cause a decrease in the computational speed in inference.The proposed model has characteristics that are easy to apply to practical tasks such as inference speed and model management.
Korea's business is composed of a few large-sized enterprises (which can be abbreviated as LSE) and a majority of small-sized enterprises (SSE). Although there has been a growing recognition of the need for the development of medium-sized enterprises (MSE) which can serve as a link between SSE and LSE, as yet there has not yet been a consensus on the definition, characteristics and the function of the MSE in Korea. Nowadays, the world is being globalized, and Japan and China are in competition to ne a great economic power. While East Asia is experiencing rapid changes, promoting MSE which can secure flexibility and efficiency through covering up the limitation of LSE and SSE is needed in order to respond the global market which is being specialized. The features of MSE in Japan can be listed as follows. First, the MSE in Japan is developing the company through getting into niche markets which are hard for major companies to enter rather than developing markets in order to compete against major companies directly. While MSEs are endeavoring to build the business firmly in the domestic market, they can possess special and competitive technical skills through trials and errors; so that they can get a chance develop their business through independent business system rather than putting their effort to compete against major companies. Second, from the MSEs with competitive edge in the market, there are many contributions to the national exportation. Those MSEs produce in domestic and maintain the quality of high price products which need cutting-edge technology, while they relocate the low and middle priced goods to the country where manufacturing costs are low, so that they can maintain the price competitiveness. Third, the industrial structure in Japan is formed from dual structure between major companies and small sized companies. In other words, in Japan's industrial structure which are composed of subcontract structure, this dual structure has taken a major role of small sized companies' growth and manufacturing businesses' international competitive power. Forth, MSE in Japan adopt a strategy of putting their value on qualitative scale growth rather than quantitative scale growth. In this paper, the case of Japanese MSE is analyzed. Along with its long history of Industrialization, Japan has a corporate environment where the SSEs can develop as a MSE and later a LSE through a full-support system. Among its SSEs, there are a number of world class corporations equipped with a large domestic market, win-win cooperation with the LSEs and an independent technology development. It can also be observed that these SSEs develop into MSEs with sustainable growth potentials. This study will focus on the condition under which the MSEs of Japan have been developed, and how they have survived the competition between SSEs and LSEs. Through this study, this paper attempts to offer solutions to Korea's polarization between the SSE and LSE, while providing the basis for SSEs revitalization. In general, if both extremities phenomenon deepen between LSE and SSE, there are possible fears of occurring disutility in national economy by the monopolization of LSE. For that reason, enterprise group, which can make SSE or MSE compete LSE in some area and ease the monopoly and oligopoly problem, is needed. This awareness has been shared for ages long. Nevertheless, there is no legal definition for MSE in Japan, and there is no definition about the enterprise size or unified view of MSE between scholars, but it is defined differently by each of academical person or research institution and study meeting. For that reason, this paper will organize the definition of MSE in Japan, and then will propose the characteristics of the background which has made MSE secure competitiveness and sustainable growth in global market. This study focus on that because through this process, the positive change to the awareness of MSE can be proposed in Korea and to seek the policy direction for building institutional framework which can make SSE become MES. Through this way, the fundamentals for SSE to become MSE can be managed and some appropriate suggestions which will be able to make MSE enter the global market in the future can also be proposed. Due to these facts, this study is very important and well timed task. In a sense of this way, this study will examine the definition and role of MSE in Japan. after this examination, this study will deal with the status, special feature, and promotion policy for MSE. Through this analysis of MSE in Japan, the foundation which be able to set the desirable role model for MSE in Korea can be proposed. Also, the political implication which is needed to push ahead to contribute to creating employment and economic growth through sustainable growth of MSEs in economic system of Korea can be offered through this study. It has been found that Japan's MSE functions as an indispensable link among various industrial structures by holding a significant position in employment rate, production and value added. Although the MSEs took up less than 1% of the entire number of businesses with 2700 manufacturing firms and 7000 non-manufacturing firms, its employment ratios are about 15%, while taking about 25% of the manufacturing industry's exports. In industries such as machinery and electronics which is considered Japan's major industry, the MSEs showed a higher than average ratio of manufacturing exports and employment rate. It can be analyzed that behind Japan's advantageous industries, close and deeply knit MSEs exist. Although there are no clearly stated policies geared towards the MSEs by the Japanese government, various political measures exist such as the R&D Project and the inducement of cooperation between enterprises which gives room for MSEs to participate in the SSE policies. In relation to these findings, the following practical measures can be considered in order to revitalize Korea's MSEs: First, there is a need for a legal definition of MSE and the incentives to provide legal support for its growth. Second, if a law to support the MSEs is established, it could provide a powerful inducement for the SSE to grow as a MSE, rather than stay as a SSE. Third, there is a need for a strategy of MSEs to establish a stable base in the domestic market and then advance to the global market with the accumulated trial and error and competitiveness. Fourth, the SSE themselves need the spirit of entrepreneurship in order to make the leap to a MSE. Because if nothing is to be changed about the system on the firms that grew, and the parts of the past custom was left to be managed alone, confusion and absence of management can take place. No matter how much tax favors the government will give and no matter how much incentive there could be through the policies, there are limits for industries to higher the ability to propagate. And because of that it is a period where industries need their own innovative skills to reform their firms.
With the MICE(Meeting, Incentive travel, Convention, Exhibition) industry coming into the spotlight, there has been a growing interest in the domestic exhibition industry. Accordingly, in Korea, various studies of the industry are being conducted to enhance exhibition performance as in the United States or Europe. Some studies are focusing particularly on analyzing visiting patterns of exhibition visitors using intelligent information technology in consideration of the variations in effects of watching exhibitions according to the exhibitory environment or technique, thereby understanding visitors and, furthermore, drawing the correlations between exhibiting businesses and improving exhibition performance. However, previous studies related to booth recommendation systems only discussed the accuracy of recommendation in the aspect of a system rather than determining changes in visitors' behavior or perception by recommendation. A booth recommendation system enables visitors to visit unplanned exhibition booths by recommending visitors suitable ones based on information about visitors' visits. Meanwhile, some visitors may be satisfied with their unplanned visits, while others may consider the recommending process to be cumbersome or obstructive to their free observation. In the latter case, the exhibition is likely to produce worse results compared to when visitors are allowed to freely observe the exhibition. Thus, in order to apply a booth recommendation system to exhibition halls, the factors affecting the performance of the system should be generally examined, and the effects of the system on visitors' unplanned visiting behavior should be carefully studied. As such, this study aims to determine the factors that affect the performance of a booth recommendation system by reviewing theories and literature and to examine the effects of visitors' perceived performance of the system on their satisfaction of unplanned behavior and intention to reuse the system. Toward this end, the unplanned behavior theory was adopted as the theoretical framework. Unplanned behavior can be defined as "behavior that is done by consumers without any prearranged plan". Thus far, consumers' unplanned behavior has been studied in various fields. The field of marketing, in particular, has focused on unplanned purchasing among various types of unplanned behavior, which has been often confused with impulsive purchasing. Nevertheless, the two are different from each other; while impulsive purchasing means strong, continuous urges to purchase things, unplanned purchasing is behavior with purchasing decisions that are made inside a store, not before going into one. In other words, all impulsive purchases are unplanned, but not all unplanned purchases are impulsive. Then why do consumers engage in unplanned behavior? Regarding this question, many scholars have made many suggestions, but there has been a consensus that it is because consumers have enough flexibility to change their plans in the middle instead of developing plans thoroughly. In other words, if unplanned behavior costs much, it will be difficult for consumers to change their prearranged plans. In the case of the exhibition hall examined in this study, visitors learn the programs of the hall and plan which booth to visit in advance. This is because it is practically impossible for visitors to visit all of the various booths that an exhibition operates due to their limited time. Therefore, if the booth recommendation system proposed in this study recommends visitors booths that they may like, they can change their plans and visit the recommended booths. Such visiting behavior can be regarded similarly to consumers' visit to a store or tourists' unplanned behavior in a tourist spot and can be understand in the same context as the recent increase in tourism consumers' unplanned behavior influenced by information devices. Thus, the following research model was established. This research model uses visitors' perceived performance of a booth recommendation system as the parameter, and the factors affecting the performance include trust in the system, exhibition visitors' knowledge levels, expected personalization of the system, and the system's threat to freedom. In addition, the causal relation between visitors' satisfaction of their perceived performance of the system and unplanned behavior and their intention to reuse the system was determined. While doing so, trust in the booth recommendation system consisted of 2nd order factors such as competence, benevolence, and integrity, while the other factors consisted of 1st order factors. In order to verify this model, a booth recommendation system was developed to be tested in 2011 DMC Culture Open, and 101 visitors were empirically studied and analyzed. The results are as follows. First, visitors' trust was the most important factor in the booth recommendation system, and the visitors who used the system perceived its performance as a success based on their trust. Second, visitors' knowledge levels also had significant effects on the performance of the system, which indicates that the performance of a recommendation system requires an advance understanding. In other words, visitors with higher levels of understanding of the exhibition hall learned better the usefulness of the booth recommendation system. Third, expected personalization did not have significant effects, which is a different result from previous studies' results. This is presumably because the booth recommendation system used in this study did not provide enough personalized services. Fourth, the recommendation information provided by the booth recommendation system was not considered to threaten or restrict one's freedom, which means it is valuable in terms of usefulness. Lastly, high performance of the booth recommendation system led to visitors' high satisfaction levels of unplanned behavior and intention to reuse the system. To sum up, in order to analyze the effects of a booth recommendation system on visitors' unplanned visits to a booth, empirical data were examined based on the unplanned behavior theory and, accordingly, useful suggestions for the establishment and design of future booth recommendation systems were made. In the future, further examination should be conducted through elaborate survey questions and survey objects.
본고(本稿)시리이즈의 제1보(第一報)에서 우리는 물리(物理), 사회과학(社會科學) 및 공학분야(工學分野)의 12,442명(名)의 과학자(科學者)와 기술자(技術者)에 대한 정보교환활동(情報交換活動)의 78례(例)에 있어서 일반과정(一般過程)과 몇 가지 결과(結果)를 기술(記述)한 바 있다. 4년반(年半) 이상(以上)의 기간(其間)(