In addition, the computing device 100 may calculate a reconstruction rate error between the process sensor data and the reconstruction process sensor data output to correspond to the process sensor data. Specifically, a reconstruction rate error calculated by the computing device 100 may be large when the difference between process sensor data related to an input and reconstruction process sensor data related to an output is large or may be small when the difference between the process sensor data related to the input and reconstruction process sensor data related to the output is small. That is, the reconstruction rate error may be calculated based on the difference between an input (i.e., process sensor data) and an output (i.e., reconstruction process sensor data) of a deep learning model.

In addition, the computing device 100 may compare a calculated reconstruction rate error with a reference threshold to detect abnormal behavior. In an embodiment, the reference threshold is obtained in a training process of the deep learning model and determined based on a reconstruction rate error related to a largest value among a plurality of reconstruction rate errors related to each of a plurality of pieces of training data. For example, the reference threshold may be determined based on a largest reconstruction rate error among reconstruction rate errors each corresponding to one of 100,000 pieces of process sensor data obtained over the past three years and one of pieces of reconstruction process sensor data corresponding to the pieces of process sensor data. In other words, the reference threshold may be determined based on a reconstruction rate error of the worse restored process sensor data (i.e., process sensor data with a largest reconstruction rate error) among pieces of process sensor data of the past several years. The reference threshold may be used as a criterion for detecting abnormal behavior. In a specific embodiment, the computing device 100 may determine that normal behavior has occurred when a reconstruction rate error is less than or equal to the reference threshold, and determine that abnormal behavior has occurred when the reconstruction rate error is greater than the reference threshold.

In other words, the computing device 100 may generate reconstruction process sensor data on the basis of process sensor data and calculate a reconstruction rate error on the basis of a comparison between the process sensor data and the reconstruction process sensor data. The computing device 100 may compare the reconstruction rate error with the reference threshold, and determine that abnormal behavior has occurred in an equipment process when the reconstruction rate error is greater than the reference threshold. For example, when the process sensor data is similar to pieces of training data used to train a deep learning model (i.e., process sensor data accumulated for many years), a calculated reconstruction rate error may be small. In contrast, when the process sensor data is not similar to the pieces of training data used to train the deep learning model, the calculated reconstruction rate error may be large. In other words, when the reconstruction rate error is greater than a reference threshold calculated based on data accumulated for many years, the computing device 100 may determine that a type of data different from the type of data obtained in a previous normal situation has been generated (i.e., sensor data that has never been detected has been detected) and thus determine that a current state is an abnormal state. A method of training a deep learning model and a method of detecting an abnormal situation will be described in more detail with reference to FIGS. 2 and 9 below.

FIG. 2 is a block diagram of a computing device for detecting the abnormal behavior of process equipment according to an embodiment of the present disclosure.

Referring to FIG. 2, the computing device 100 according to an embodiment of the present disclosure may include at least one processor 110, a memory 120 into which a computer program 151 executable by the at least one processor 110 is loaded, a bus 130, a communication interface 140, and a storage 150 storing the computer program 151. Here, FIG. 2 illustrates only components related to an embodiment of the present disclosure. Therefore, it will be apparent to those of ordinary skill in the art that other general-purpose components may be further provided, as well as the components illustrated in FIG. 2.

The at least one processor 110 control the overall operation of the computing device 100. The at least one processor 110 may include a central processing unit (CPU), a microprocessor unit (MPU), a micro controller unit (MCU), a graphics processing unit (GPU), or any type of processor well known in the technical field of the present disclosure.

The at least one processor 110 may read a computer program stored in the memory 120 and process data for detecting the abnormal behavior of process equipment according to an embodiment of the present disclosure.

The at least one processor 110 may read the computer program stored in the memory 120 and perform data processing for deep learning according to an embodiment of the present disclosure. According to an embodiment of the present disclosure, the at least one processor 110 may perform an operation of training a neural network. The at least one processor 110 may perform computations for training a neural network, e.g., processing input data for training through deep learning (DL), extracting features from the input data, calculating an error value, and updating a weight of the neural network using backpropagation.

At least one of a CPU, a GPGPU, and a TPU of the at least one processor 110 may process learning of a network function. For example, both the CPU and the GPGPU may process the learning of the network function and data classification using the network function. In an embodiment of the present disclosure, processors of a plurality of computing devices may be used together to perform the learning of the network function and data classification using the network function. A computer program performed by a computing device according to an embodiment of the present disclosure may be a program executable by the CPU, the GPGPU or the TPU.

In the present specification, the network function may be used interchangeably with an artificial neural (AI) network and a neural network. In this specification, the network function may include at least one neural network, and in this case, an output of the network function may be an ensemble of outputs of the at least one neural network.

According to an embodiment of the present disclosure, generally, the at least one processor 110 may process overall operations of the computing device 100. The at least one processor 110 may process signals, data, information, etc. input or output through the above-described components or execute an application program stored in the memory 120 to provide appropriate information or functions to a user or a user terminal or process the information or functions.

The at least one processor 110 may perform an operation on at least one application or program for performing methods according to embodiments of the present disclosure, and the computing device 100 may include at least one processor.

In various embodiments, the at least one processor 110 may further include a random access memory (RAM) (not shown) and a read-only memory (ROM) (not shown) to temporarily and/or permanently store signals (or data) processed in the at least one processor 110. The at least one processor 110 may be in the form of a system-on-chip (SoC) including at least one of a graphics processor, a RAM, and a ROM.

The memory 120 stores various types of data, instructions, and/or information. The memory 120 may load the computer program 151 from the storage 150 to perform methods/operations according to various embodiments of the present disclosure. When the computer program 151 is loaded into the memory 120, the at least one processor 110 may execute one or more instructions constituting the computer program 151 to perform the methods/operations. The memory 120 may be embodied as a volatile memory such as a RAM, but the technical scope of the present disclosure is not limited thereto.

The bus 130 provides a communication function between the components of the computing device 100. The bus 130 may be implemented as one of various types of buses such as an address bus, a data bus, and a control bus.

The communication interface 140 supports wired/wireless Internet communication of the computing device 100. The communication interface 140 may also support various communication methods other than Internet communication. To this end, the communication interface 140 may include a communication module well known in the technical field of the present disclosure. In some embodiments, the communication interface 140 may be omitted.

The storage 150 may store the computer program 151 non-temporarily. When a process of identifying the abnormal behavior of process equipment is performed through the computing device 100, the storage 150 may store various types of information required to provide a process for identifying the abnormal behavior of the process equipment.

The storage 150 may include a non-volatile memory, such as a ROM, an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM) or a flash memory, a hard disk, a detachable disk, or any type of computer-readable recording medium well known in the technical field to which the present disclosure pertains.

The computer program 151 may include one or more instructions causing the at least one processor 110 to perform methods/operations according to various embodiments of the present disclosure when the computer program 151 is loaded into the memory 120. That is, the at least one processor 110 may execute the one or more instructions to perform the methods/operations according to various embodiments of the present disclosure.

In an embodiment, the computer program 151 may include one or more instructions causing a method of detecting the abnormal behavior of process equipment to be performed, the method including obtaining process sensor data and prior knowledge data corresponding to the process sensor data, generating reconstruction process sensor data corresponding to the process sensor data using a deep learning model, calculating a reconstruction rate error on the basis of the process sensor data and the reconstruction process sensor data, and detecting abnormal behavior on the basis of a comparison between the reconstruction rate error and a reference threshold.

The operations of the methods or algorithm described above in connection with embodiments of the present disclosure may be implemented directly by hardware, a software module executed by hardware, or a combination of hardware and software. The software module may reside in a RAM, a ROM, an EPROM, an EEPROM, a flash memory, a hard disk, a detachable disk, a CD-ROM, or any form of computer-readable recording medium well known in the technical field to the present disclosure pertains.

Components of the present disclosure may be implemented in the form of a program (or an application) and stored in a medium to be executed in combination with a computer which is hardware. The components of the present disclosure may be implemented by software programming or software elements, and similarly, embodiments may be implemented in a programming or scripting language such as C, C++, Java, or an assembler, including data structures, processes, routines, or various algorithms which are combinations of other programming constructs. Functional aspects may be implemented by an algorithm executable by one or more processors.

FIG. 3 is a flowchart of a method of identifying abnormal behavior of process equipment according to an embodiment of the present disclosure. An order of the operations shown in FIG. 3 may be changed when necessary, and at least one of the operations may be omitted or at least one operation may be added. That is, operations to be described below are only an example of the present disclosure and thus the scope of the present disclosure is not limited thereto.

According to an embodiment of the present disclosure, the computing device 100 may obtain process sensor data and prior knowledge data corresponding to the process sensor data (S110). In an embodiment of the present disclosure, the obtaining of the process sensor data and the prior knowledge data may be receiving or loading process sensor data and prior knowledge data stored in the memory 120. The obtaining of the process sensor data and the prior knowledge data may be receiving or loading from another storage medium, another computing device, or a processing module included in the same computing device through a wired/wireless communication device.

According to an embodiment, the process sensor data may include various types of data obtained at an industrial site. The process sensor data may include sensor data generated in units of seconds in a process.

For example, hundreds of pieces of sensor data may be generated in units of seconds in production equipment. Semiconductor production equipment includes sensors that detect temperature, pressure, the amounts of injected various chemicals, and the like, and process sensor data may be obtained in real time through the sensors. That is, the process sensor data may be understood as sensor data obtained in real time through a plurality of sensors on the basis of an operation of semiconductor process equipment. The process sensor data may include operating parameters of various types of devices for manufacturing a wafer in a semiconductor fabrication process and various types of sensor data obtained during operation of the devices. Examples of the process sensor data may include, but are not limited to, lot equipment history data from a management execution system (MES), data from an equipment interface data source, processing tool recipes, processing tool test data, probe test data, electrical test data, combined measurement data, diagnostic data, remote diagnostic data, post-processed data, etc.

The prior knowledge data may include information about a relationship between a plurality of sensors. For example, the prior knowledge data may include information regarding a correlation between a first sensor that measures temperature in an operation of a certain process and a second sensor that measures pressure in the same operation during the manufacture of a semiconductor. That is, the prior knowledge data may include information about an effect of data of a certain sensor on data of another sensor in an operation of a certain process, i.e., information about a correlation between the sensors. In an embodiment, the prior knowledge data may be configured in the form of a graph.

The process sensor data and the prior knowledge data may be obtained in a process of production equipment and used to detect abnormal behavior. The abnormal behavior may include various process situations that reduce yield or a situation in which abnormal behavior related to a malfunction of equipment or a defective condition is detected.

According to an embodiment, a semiconductor production process consists of hundreds of production steps and the yield of a produced wafer may be measured through final inspection in a last step. The yield of a wafer may be understood as a ratio of the number of high-quality chips to a total number of chips included in the wafer. For example, when all the chips are normal, the yield of the corresponding wafer may be 100%. In general, when the yield of a wafer is low in a semiconductor process, pieces of process sensor data related to the production of wafers may be analyzed. For example, whether wafers processed through certain equipment has many defects or whether a certain production condition causes many problems may be analyzed on the basis of process sensor data. In hundreds of steps of producing a semiconductor, there is a specific production condition for each step, and the yield of a wafer may decrease when the production condition is not satisfied. For example, although certain equipment may be subject to a condition that a set temperature be reached within a certain time period after a wafer is inserted, the condition may not be satisfied in an actual process and this situation may be identified by process sensor data obtained at a corresponding stage. As described above, it may be very helpful in preventing a decrease in yield by analyzing hundreds of pieces of process sensor data obtained in real time in a process.

In an embodiment, predictive maintenance may be very important in a semiconductor process. Predictive maintenance may be understood as an analysis process of preventing the entire facility from being shut down by identifying an abnormal signal or a defective condition and fixing a defect before equipment fails completely. For example, in the case of a semiconductor process, it is necessary to detect a defect of less than 20 nm on a 300 mm wafer due to an equipment problem and thus it may be very difficult to detect a defect. Owing to the development of technology, line widths of circuits are becoming reduced and thus it may be more difficult to detect defects. As a specific example, a semiconductor process may consist of about 500 processes and about 1,000 measurement steps. When even a minor problem occurs in equipment in such a process, a large loss, e.g., discarding the entire quantity of wafers, may be incurred. In order to prevent such a problem, it may be very important to collect and analyze data generated by process sensors in semiconductor equipment. The computing device 100 of the present disclosure may obtain and analyze process sensor data, which is generated in a semiconductor process, using AI, thus contributing to automatic abnormal behavior detection in the process. When abnormal behavior is detected using AI, it is possible to minimize the time required to detect abnormal data and specify a cause of an abnormal state on the basis of process sensor data according to complicated equipment, thereby providing convenience to operators.

According to an embodiment of the present disclosure, the computing device 100 may generate reconstruction process sensor data corresponding to process sensor data by using a deep learning model (S120).

In an embodiment, the deep learning model may be a neural network model that outputs an output similar to an input. The deep learning model may include an auto encoder that outputs output data similar to input data. The auto encoder may include a dimension reduction network function (e.g., an encoder) and a dimension restoration network function (e.g., a decoder).

According to an embodiment, the auto encoder may include at least one hidden layer, and an odd number of hidden layers may be disposed between input and output layers. The number of nodes of each layer may be reduced from the number of nodes of an input layer to the number of nodes of a bottleneck layer (encoding), i.e., an intermediate layer, and expanded, symmetrically with the reduction, from the number of nodes of the bottleneck layer to the number of nodes of an output layer (symmetric to the input layer). Nodes of a dimension reduction layer and nodes of a dimension restoration layer may or may not be symmetrical to each other. The auto encoder may perform nonlinear dimension reduction. The number of input layers and the number of output layers may correspond to the number of sensors remaining after input data is preprocessed. In a structure of the auto encoder, the number of nodes of a hidden layer included in the auto encoder may decrease as the distance between the hidden layer and the input layer increases. When the number of nodes of the bottleneck layer (a layer having a smallest number of nodes and located between the encoder and a decoder) is too small, a sufficient amount of information cannot be transmitted and thus the number of nodes of the bottleneck layer may be maintained to be greater than or equal to a certain number (e.g., half or more of the number of input layers).

Specifically, referring to FIG. 4, a deep learning model 400 may generate reconstruction process sensor data 210 on the basis of process sensor data 200 and prior knowledge data 300 corresponding to the process sensor data 200. The computing device 100 may process the process sensor data 200 and the prior knowledge data 300 as inputs of the deep learning model 400 to output the reconstruction process sensor data 210. A deep learning model is a model trained to output an output similar to a specific input, and reconstruction process sensor data output from the deep learning model may be similar to the input process sensor data. According to an embodiment, the computing device 100 may generate a deep learning model by training the deep learning model with a dimension reduction network function and a dimension restoration network function related to an auto encoder.

The deep learning model may be generated by learning one or more network functions using a training data set including multiple pieces of process sensor data for training and prior knowledge data corresponding to the multiple pieces of process sensor data.

In an embodiment, multiple pieces of process sensor data for training, which are to be used to train a deep learning model, may include pieces of sensor data related to normal behavior excluding pieces of sensor data related to abnormal behavior. The multiple pieces of process sensor data for training may include pieces of process sensor data related to a normal state among process sensor data accumulated for many years.

As shown in FIGS. 5 and 6, the deep learning model 400 may include a first sub-model 410, a second sub-model 420, an attention module 430, and a dimension restoration model 440.

According to an embodiment, the computing device 100 may learn one or more network functions using a plurality of training data sets to generate the deep learning model 400 of the present disclosure. The plurality of training data sets may include a plurality of pieces of process sensor data 200a for training and a plurality of pieces of prior knowledge data 300a for training, each corresponding to one of the pieces of process sensor data for training. In an embodiment, the deep learning model may be implemented through at least a part of the auto encoder. For example, the deep learning model may be generated through a training process of the auto encoder. The computing device 100 may train the auto encoder to output data similar to input data.

More specifically, referring to FIG. 6, the computing device 100 may process the plurality of pieces of process sensor data 200a for training as an input of an embedding layer 411 and output vectors corresponding to each piece of process sensor data. The embedding layer 411 may embed a vector corresponding to process sensor data when the process sensor data is input thereto. The embedding layer 411 may perform embedding to correspond to each sensor to which process sensor data is input. For example, the embedding layer 411 may allocate first sensor data related to operation of a first sensor to a first vector and second sensor data related to operation of a second sensor to a second vector. That is, the embedding layer 411 may randomly embed various types of process sensor data.

The embedding layer 411 may randomly embed a vector corresponding to each of a plurality of pieces of process sensor data for training in relation to initial learning, and feature information of training data may be stored in a corresponding vector space during a training process using pieces of training data.

The second sub-model 420 may be a graph neural network (GNN) model that analyzes data related to a dynamic graph structure that changes over time to extract relationship information. The GNN model may be a neural network model that analyzes graph-structured data. The graph structure may be a data structure consisting of two components, i.e., nodes and edges. A graph G may be a set of nodes connected by edges having directionality or no directionality. In an embodiment, the nodes may be sensor data obtained from various types of sensors on a plurality of regions of semiconductor process equipment, and the edges may represent a relationship between the sensors. Because a graph allows an abstract concept, such as an interaction, to be easily represented and a complex matter to be simplified into simpler representation or expressed from different perspectives, the GNN model may be very useful for analyzing data representing a relationship or an interaction. The GNN model is a neural network that may directly act on a graph structure and model a correlation between nodes. That is, the GNN model may model a relationship between nodes of a graph and generate a representation of the relationship.

The second sub-model 420 may output interrelationship information when the prior knowledge data 300a for training is input thereto. The interrelationship information may include information about a relationship between pieces of sensor data. For example, the interrelationship information may be graph network information about a relationship connecting various types of sensor data. In an embodiment, the second sub-model 420 may output interrelationship information between pieces of process sensor data when the process sensor data 200a for training and the prior knowledge data 300a for training are input thereto. For example, the prior knowledge data may not include information about an interaction relationship related to all pieces of sensor data. Accordingly, information about a relationship, which is not included in prior knowledge information, may be extracted from process sensor data using both the process sensor data and the prior knowledge information.

In an embodiment, the attention module 430 may combine a vector randomly assigned through the embedding layer 411 with interrelationship information related to an output of the second sub-model 420, and the dimension restoration model 440 may restore the data combined through the attention module 430 to generate reconstruction process sensor data 210a for training. Training may be performed by backpropagation such that a difference between the process sensor data 200a for training and the reconstruction process sensor data 210a for training decreases and thus feature information may be stored in a feature space corresponding to each piece of process sensor data for training.

The attention module 430 may generate relationship information between time steps of the first sub-model 410 and the second sub-model 420 to combine outputs related to the same time step. For example, the attention module 430 may generate relationship information between a feature output from the first sub-model 410 and interrelationship information output from the second sub-model 420. The attention module 430 may generate information about an interaction relationship that is most related to the feature output from the first sub-model 410. That is, relationship information about interrelationship information having an effect during the outputting of a feature corresponds to process sensor data from the first sub-model 410, i.e., an interaction relationship to be focused on during the outputting of the feature, may be generated to generate feature information from a combination of the feature and the interrelationship information. The attention module 430 may generate feature information by putting emphasis on an interaction relationship to be focused on during the outputting of the feature on the basis of relationship information between an output of the first sub-model 410 and an output of the second sub-model 420.

According to an embodiment, the deep learning model 400 may include the dimension restoration model 440 that restores feature information to generate reconstruction process sensor data. The dimension restoration model 440 may output the reconstruction process sensor data 210a for training when feature information is input thereto. In an embodiment, in a decoding process using the second sub-model 420, data output from a hidden layer may be an approximation of input data (i.e., process sensor data) rather than a perfect copy value. In an embodiment, the dimension restoration model 440 may be configured through a dimension restoration network function (i.e., a decoder) in a trained auto encoder. That is, the dimension restoration network model may output reconstruction process sensor data related to a feature (i.e., feature information) obtained through combining by the attention module 430 when the feature is input thereto.

As described above, a vector randomly assigned to each piece of process sensor data for training through the embedding layer 411 at an initial stage may be updated in a learning process and thus feature information of pieces of sensor data may be stored in the vector.

Accordingly, the trained deep learning model 400 may generate the reconstruction process sensor data 210 when the process sensor data 200 and the prior knowledge data 300 corresponding to the process sensor data 200 are input thereto.

More specifically, referring to FIG. 7, process sensor data 200 obtained in real time may be processed as an input of a first sub-model 410. In this case, the first sub-model 410 may be generated on the basis of a vector including feature information of each piece of process sensor data for training during the above-described training process. For example, a vector randomly assigned to each piece of process sensor data at an initial learning stage may be updated in a learning process in which backpropagation is performed to make an input and an output similar to each other and thus feature information of sensor data is included in the vector. That is, the first sub-model 410 may be trained with feature information related to previous process sensor data (i.e., process sensor data for training) and thus may receive process sensor data generated in real time and output feature information corresponding to the process sensor data.

In addition, the second sub-model 420 may extract interrelationship information between pieces of process sensor data on the basis of the process sensor data 200 and the prior knowledge data 300.

The attention module 430 may generate feature information by combining outputs of the first sub-model 410 and the second sub-model 420, and the dimension restoration model 440 may generate reconstruction process sensor data to restore feature information. That is, the deep learning model 400 may be trained with features of process sensor data classified as normal and thus may generate reconstruction process sensor data similar to process sensor data obtained in real time.

According to an embodiment of the present disclosure, the computing device 100 may calculate a reconstruction rate error on the basis of the process sensor data and the reconstruction process sensor data (S130). Specifically, a reconstruction rate error calculated by the computing device 100 may be large when the difference between process sensor data related to an input and reconstruction process sensor data related to an output is large or may be small when the difference between the process sensor data related to the input and reconstruction process sensor data related to the output is small. That is, the reconstruction rate error may be calculated based on the difference between an input (i.e., process sensor data) and an output (i.e., reconstruction process sensor data) of a deep learning model.

According to an embodiment of the present disclosure, the computing device 100 may detect abnormal behavior on the basis of a comparison between the reconstruction rate error and a reference threshold (S140).

The reference threshold may be obtained based on a reconstruction rate error related to a maximum value among a plurality of reconstruction rate errors related to a plurality of pieces of training data in a training process of a deep learning model using the plurality of pieces of training data.

In an embodiment, the reference threshold is obtained in a training process of the deep learning model and determined based on a reconstruction rate error related to a largest value among a plurality of reconstruction rate errors related to each of a plurality of pieces of training data. For example, the reference threshold may be determined based on a largest reconstruction rate error among reconstruction rate errors each corresponding to one of 100,000 pieces of process sensor data obtained in the past three years and one of pieces of reconstruction process sensor data corresponding to the pieces of process sensor data. As a specific example, referring to FIG. 6, as each of the plurality of pieces of process sensor data 200a for training may be processed as an input of the embedding layer 411, a plurality of vectors corresponding to the pieces of process sensor data 200a may be output. As each of the plurality of pieces of prior knowledge data 300a is processed as an input of the second sub-model 420, a plurality of pieces of interrelationship information may be output. Here, the plurality of pieces of process sensor data 200a for training and the plurality of pieces of prior knowledge data 300a may be process sensor data that is related to normality and accumulated for many years.

The attention module 430 may generate a plurality of pieces of feature information by combining a plurality of vectors and a plurality of pieces of interrelationship information, and the dimension restoration model 440 may receive the plurality of pieces of feature information and generate a plurality of pieces of reconstruction process sensor data 210a for training. In this case, the computing device 100 may compare the plurality of pieces of process sensor data 200a with the plurality of pieces of reconstruction process sensor data 210a to calculate a reconstruction rate error corresponding to each of the pieces of process sensor data 200a. For example, first process sensor data for training and first reconstruction process sensor data for training may be compared with each other to calculate a reconstruction rate error corresponding to the first process sensor data. Similarly, reconstruction rate errors corresponding to the plurality of pieces of process sensor data for training may be generated. The computing device 100 may determine a reference threshold on the basis of a reconstruction rate error related to a maximum value among the reconstruction rate errors corresponding to the plurality of pieces of process sensor data for training.

In other words, the reference threshold may be determined on the basis of the worse restored process sensor data (i.e., process sensor data with a largest reconstruction rate error) among pieces of process sensor data accumulated for the past several years. The reference threshold may be used as a criterion for detecting abnormal behavior.

In an embodiment, the computing device 100 may detect abnormal behavior on the basis of a reconstruction rate error calculated according to process sensor data. Specifically, referring to FIG. 8, the computing device 100 may calculate a reconstruction rate error on the basis of process sensor data and reconstruction process sensor data (S210). In addition, the computing device 100 may compare the calculated reconstruction rate error with a reference threshold. The computing device 100 may identify whether the reconstruction rate error is greater than the reference threshold (S220). The computing device 100 may determine that normal behavior has occurred when the reconstruction rate error is not greater than the reference threshold (when the reconstruction rate error is equal to or less than the reference threshold) (S230). The computing device 100 may determine that abnormal behavior has occurred when the reconstruction rate error is greater than the reference threshold (S240).

More specifically, the deep learning model 400 is a neural network model trained based on data accumulated over many years (i.e., pieces of process sensor data obtained through normal behavior in previous processes), and thus, when process sensor data similar to existing process sensor data is input to the deep learning model 400, the deep learning model 400 may output reconstruction process sensor data similar to the input process sensor data and thus a reconstruction rate error may be calculated to be small because the process sensor data and the reconstruction process sensor data are similar to each other. In contrast, when process sensor data that is not similar to the existing process sensor data is input to the deep learning model 400, because the deep learning model 400 has not been trained with the input process sensor data, the likelihood of outputting reconstruction process sensor data that is not similar to the process sensor data. In this case, the process sensor data and the reconstruction process sensor data are not similar to each other and thus a reconstruction rate error may be calculated to be large.

That is, the deep learning model 400 may be trained with features of process sensor data classified as normal and thus is capable of restoring reconstruction process sensor data similar to the process sensor data, and the computing device