Method and apparatus for detecting anomaly status based on system screen
Disclosed herein is a method for detecting an anomaly state based on screen output. The method includes receiving the output screen of a target device to be monitored, setting a target region to be examined in the output screen of the target device to be monitored, calculating a feature value vector corresponding to the state of the target region to be examined, calculating an anomaly score using a pretrained auto-encoder by receiving the feature value vector as input, and determining whether the target device to be monitored is anomalous using the anomaly score.
1 . A method for detecting an anomaly state based on screen output, comprising:
receiving an output screen of a target device to be monitored;
setting a target region to be examined in the output screen of the target device to be monitored;
calculating a feature value vector corresponding to a state of the target region to be examined;
calculating an anomaly score using a pretrained auto-encoder by receiving the feature value vector as input; and
determining whether the target device to be monitored is anomalous using the anomaly score.
2 . The method of claim 1 , wherein the feature value vector is calculated based on a pattern dictionary predefined to correspond to each of patterns in the target region to be examined.
3 . The method of claim 2 , wherein the pattern dictionary is a predefined vector corresponding to a numeric value or an image in the target region to be examined.
4 . The method of claim 2 , wherein the auto-encoder is pretrained by using a screen output in a normal state of the target device as training data.
5 . The method of claim 4 , wherein determining whether the target device to be monitored is anomalous comprises determining that the target device to be monitored is in an anomaly state when the anomaly score is greater than a threshold.
6 . The method of claim 4 , wherein determining whether the target device to be monitored is anomalous comprises determining that the target device to be monitored is in an anomaly state when an integral value of the anomaly score in a preset section, which is calculated using a distribution of the anomaly score changing over time, is greater than a threshold.
7 . The method of claim 1 , further comprising:
providing an anomaly state alarm when it is determined that the target device to be monitored is in an anomaly state,
wherein the anomaly state alarm includes a screen in which an anomaly part is displayed to be distinguished from other parts in the target region to be examined in the output screen of the target device to be monitored.
8 . The method of claim 7 , wherein the anomaly state alarm includes information acquired by visualizing time-series data of the anomaly score.
9 . An apparatus for detecting an anomaly state based on screen output, comprising:
a processor; and a memory storing instructions which, when executed by the processor, cause the processor to:
receive an output screen of a target device to be monitored;
set a target region to be examined in the output screen of the target device to be monitored;
calculate a feature value vector corresponding to a state of the target region to be examined;
calculate an anomaly score using a pretrained auto-encoder by receiving the feature value vector as input; and
determine whether the target device to be monitored is anomalous using the anomaly score.
10 . The apparatus of claim 9 , wherein the feature value vector is calculated based on a pattern dictionary predefined to correspond to each of patterns in the target region to be examined.
11 . The apparatus of claim 10 , wherein the pattern dictionary is a predefined vector corresponding to a numeric value or an image in the target region to be examined.
12 . The apparatus of claim 10 , wherein the auto-encoder is pretrained by using a screen output in a normal state of the target device as training data.
13 . The apparatus of claim 12 , wherein when determining whether the target device to be monitored is anomalous, the instructions, when executed by the processor, further cause the processor to determine that the target device to be monitored is in an anomaly state when the anomaly score is greater than a threshold.
14 . The apparatus of claim 12 , wherein when determining whether the target device to be monitored is anomalous, the instructions, when executed by the processor, further cause the processor to determine that the target device to be monitored is in an anomaly state when an integral value of the anomaly score in a preset section, which is calculated using a distribution of the anomaly score changing over time, is greater than a threshold.
15 . The apparatus of claim 9 ,
wherein the instructions, when executed by the processor, further cause the processor to provide an anomaly state alarm when it is determined that the target device to be monitored is in an anomaly state,
wherein the anomaly state alarm includes a screen in which an anomaly part is displayed to be distinguished from other parts in the target region to be examined in the output screen of the target device to be monitored.
16 . The apparatus of claim 15 , wherein the anomaly state alarm includes information acquired by visualizing time-series data of the anomaly score.