Data processing system

Abstract

The present application relates to a system for highly automating the operation management of an IT infrastructure as a whole, which includes a system management unit, a security monitoring unit, and a resource optimization unit, uses generative AI to analyze the operation status, load information, fault occurrence, access log, authentication history, external threat information, etc. of a plurality of information processing devices and network equipment in real time, and performs anomaly detection, fault cause inference, threat detection, automatic response, resource allocation optimization, cost reduction suggestions, etc. with high precision and unification. Thus, it is characterized by realizing comprehensive management, security enhancement, operation efficiency, and business continuity improvement of complex IT infrastructures that were difficult in the past.

Description

Technical Field

[0001] The technology disclosed herein relates to a system. Background Technology

[0002] Patent Document 1 discloses a personalized chatbot control method executed by at least one processor, the method comprising: receiving user speech; adding the user speech to a prompt containing instructions related to a chatbot role; encoding the prompt; and inputting the encoded prompt into a language model to generate chatbot speech in response to the user speech.

[0003] Patent document 1: Japanese Patent Application Publication No. 2022-180282.

[0004] The problem this invention aims to solve is that, in the management of complex and diverse information systems in IT departments, it has been difficult to implement monitoring, operation, fault handling, resource optimization, and security measures that are scattered across various independent systems in a unified and efficient manner. In particular, it is difficult to grasp the overall operating status and load of the system in real time, to detect anomalies and faults early and respond quickly, and to detect sophisticated and ingenious security risks such as network attacks and internal violations with high precision. It is also difficult to automatically and promptly execute appropriate responses without relying on human resources, and to continuously analyze the overall resource utilization of IT infrastructure. While eliminating excessive resource consumption and waste, it is also difficult to autonomously plan and execute optimal resource allocation and structural changes based on business load and future demand changes. Furthermore, if these tasks are carried out solely through traditional manual operations or rule-based automation, it will result in a huge workload, reliance on human-specific proprietary technologies, limitations in the accuracy and speed of anomaly detection and threat response, and insufficient flexibility in resource optimization. Therefore, the objective of this invention is to leverage generative AI to highly automate the overall monitoring, analysis, optimization, and security response of IT infrastructure, thereby dramatically improving the efficiency, security, and flexibility of IT departments. Summary of the Invention

[0005] The means to solve the problem involved in this invention is to construct a system including a system management department, a security monitoring department, and a resource optimization department. In the system management department, the overall operation status and load information of the IT infrastructure, which includes multiple information processing devices and network devices, are collected in real time. Generative AI is used to analyze the operation status of each device and whether any abnormalities have occurred. When an abnormality or high load is detected, an alarm message is immediately generated and notified to the administrator terminal. By adopting such a structure, unified monitoring of the entire system and early detection and response to faults can be achieved.

[0006] Furthermore, in the security monitoring department, generative AI analytics is used to analyze IT infrastructure access logs and communication data to accurately detect threats such as unauthorized access or malware infections from both external and internal sources. For detected threats, automatic actions such as access control or isolation are taken, and the response history is recorded. This architecture enables real-time responsiveness and automation in addressing security risks. Subsequently, in the resource optimization department, generative AI analyzes the resource utilization of each information processing device. Under high load, virtual server or storage capacity is automatically scaled up; under low load, resource scaling down or halting is proposed or automatically implemented. These optimization suggestions and results are then displayed to the management terminal. This architecture significantly improves the overall resource utilization efficiency and flexibility of the IT infrastructure. Attached Figure Description

[0007] Figure 1 This is a conceptual diagram illustrating an example of the configuration of a data processing system according to the first embodiment.

[0008] Figure 2 This is a conceptual diagram illustrating an example of the main functions of the data processing apparatus and smart device according to the first embodiment.

[0009] Figure 3 This is a conceptual diagram illustrating an example of the data processing system configuration in the second embodiment.

[0010] Figure 4 This is a conceptual diagram illustrating an example of the main functions of the data processing device and smart glasses according to the second embodiment.

[0011] Figure 5 This is a conceptual diagram illustrating an example of the data processing system configuration in the third embodiment.

[0012] Figure 6 This is a conceptual diagram illustrating an example of the main functions of the data processing device and head-mounted terminal according to the third embodiment.

[0013] Figure 7 This is a conceptual diagram illustrating an example of the data processing system configuration in the fourth embodiment.

[0014] Figure 8 This is a conceptual diagram illustrating an example of the functions of the main parts of the data processing device and robot according to the fourth embodiment.

[0015] Figure 9 It represents an emotion graph that maps multiple emotions.

[0016] Figure 10 It represents an emotion graph that maps multiple emotions.

[0017] Figure Labels Data processing systems 10, 210, 310, and 410 12 Data processing device 14 Smart devices 214 Smart Glasses 314 Head-mounted terminal 414 Robot. Detailed Implementation

[0018] Hereinafter, an example of an implementation of the system involved in this disclosure will be described with reference to the accompanying drawings.

[0019] First, let's explain the terms used in the following description.

[0020] In the following embodiments, the processor (hereinafter referred to as "processor") can be a single computing device or a combination of multiple computing devices. Furthermore, a processor can be a single computing device or a combination of multiple computing devices. Examples of computing devices include CPU (Central Processing Unit), GPU (Graphics Processing Unit), GPGPU (General-Purpose computing on Graphics Processing Units), APU (Accelerated Processing Unit), etc.

[0021] In the following implementation, the labeled RAM (Random Access Memory) is a memory that temporarily stores information and is used by the processor as working memory.

[0022] In the following embodiments, the labeled memory is one or more non-volatile storage devices used to store various programs and various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), disk (e.g., hard disk) or magnetic tape, etc.

[0023] In the following implementation, the labeled Communication I / F (Interface) is an interface that includes a communication processor and an antenna, etc. The Communication I / F is responsible for communication between multiple computers. Examples of communication standards applicable to the Communication I / F include wireless communication standards such as 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), or Bluetooth (registered trademark).

[0024] In the following implementation, "A and / or B" is synonymous with "at least one of A and B". That is, "A and / or B" means that it can be only A, only B, or a combination of A and B. Furthermore, in this specification, when "and / or" connects more than three items, the same approach as "A and / or B" applies.

[0025] [First Implementation] Figure 1 An example of the configuration of the data processing system 10 according to the first embodiment is shown.

[0026] like Figure 1 As shown, the data processing system 10 includes a data processing device 12 and an intelligent device 14. An example of the data processing device 12 is a server.

[0027] The data processing apparatus 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" as understood in this disclosure. The computer 22 includes a processor 28, RAM 30, and memory 32. The processor 28, RAM 30, and memory 32 are connected to a bus 34. Furthermore, the database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. An example of the network 54 includes a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0028] The smart device 14 includes a computer 36, a receiver 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, RAM 48, and memory 50. The processor 46, RAM 48, and memory 50 are connected to a bus 52. Furthermore, the receiver 38, output device 40, camera 42, and communication I / F 44 are also connected to the bus 52.

[0029] The receiving device 38 includes a touchscreen 38A and a microphone 38B, etc., for receiving user input. The touchscreen 38A receives user input generated by contact with an indicator (e.g., a pen or finger). The microphone 38B receives user input generated by sound by detecting the user's voice. The control unit 46A in the processor 46 sends data representing user input received through the touchscreen 38A and microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data representing the user input.

[0030] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting data in a form perceptible to the user 20 (e.g., sound and / or text). The display 40A displays visual information such as text and images according to instructions from the processor 46. The speaker 40B outputs sound according to instructions from the processor 46. The camera 42 is a small digital camera equipped with an optical system such as a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0031] Communication I / F 44 is connected to network 54. Communication I / F 44 and 26 are responsible for sending and receiving various information between processor 46 and processor 28 via network 54.

[0032] Figure 2 An example of the main functions of the data processing device 12 and the smart device 14 is shown.

[0033] like Figure 2 As shown, in the data processing apparatus 12, specific processing is performed by the processor 28. A specific processing program 56 is stored in the memory 32. The specific processing program 56 is an example of a "program" as understood in this disclosure. The processor 28 reads the specific processing program 56 from the memory 32 and executes the read specific processing program 56 on the RAM 30. Specific processing is implemented by the processor 28 operating as a specific processing unit 290 based on the specific processing program 56 executed on the RAM 30.

[0034] The memory 32 stores a data generation model 58 and an emotion-specific model 59. The data generation model 58 and the emotion-specific model 59 are used by the specific processing unit 290. The specific processing unit 290 can use the emotion-specific model 59 to infer the user's emotions and perform specific processing based on the user's emotions. The emotion inference function using the emotion-specific model 59 (emotion-specific function) includes various inferences and predictions related to the user's emotions, but is not limited to this example. Furthermore, emotion inference and prediction also include, for example, emotion analysis (analysis).

[0035] In the smart device 14, the processor 46 performs the receive / output processing. The memory 50 stores the receive / output program 60. The receive / output program 60 is used in conjunction with the data processing system 10 and the specific processing program 56. The processor 46 reads the receive / output program 60 from the memory 50 and executes the read receive / output program 60 on the RAM 48. The receive / output processing is implemented by the processor 46 acting as a control unit 46A based on the receive / output program 60 executed on the RAM 48. Furthermore, the smart device 14 may also have the same data generation model and emotion-specific model as the data generation model 58 and the emotion-specific model 59, and use these models to perform the same processing as the specific processing unit 290. The receive / output processing is implemented by the processor 46 acting as a control unit 46A based on the receive / output program 60 executed on the RAM 48.

[0036] In addition, other devices besides the data processing device 12 may also have a data generation model 58.

[0037] For example, a server device (e.g., a generation server) may have a data generation model 58.

[0038] In this case, the data processing device 12 obtains the processing results (prediction results, etc.) using the data generation model 58 by communicating with a server device that has the data generation model 58. Furthermore, the data processing device 12 can be a server device or a user-owned terminal device (e.g., a mobile phone, robot, home appliance, etc.). Next, an example of the processing performed by the data processing system 10 of the first embodiment will be described.

[0039] (Example 1) The specific processing flow in Example 1 will be described below. Each part of the system described below is implemented by the data processing device 12 and the smart device 14. Furthermore, the data processing device 12 is referred to as the "server" and the smart device 14 is referred to as the "terminal".

[0040] (Implementation methods for carrying out the present invention) The embodiments of the present invention will be described in more specific and detailed manner. The present invention is applied to an IT infrastructure management system consisting of servers and terminals, employing a structure where the main functions of a system management department, a security monitoring department, and a resource optimization department are installed on the server side, and an interface for administrators to operate and browse is installed on the terminal side. The functions of each department, the method of utilizing generative AI, the role division between the server and the terminal, and specific application examples are described comprehensively and in detail below. Specifically, this system performs dynamic allocation and monitoring of hardware resources in a distributed computing environment. The server has multiple computing nodes and a large-capacity storage device. The server deploys multiple neural networks containing large-scale language models and time series prediction models on the main memory. The system management department continuously collects time series indicator data from various information processing devices. The security monitoring department analyzes the packet headers and payloads of network traffic in real time. The resource optimization department predicts future computing load based on the collected indicator data. This system executes these processes at high speed using a parallel computing cluster of graphics processing units. This system achieves autonomous infrastructure control without human intervention. This system extracts nonlinear correlations in high-dimensional spaces that are impossible to achieve in previous rule-based threshold determination methods. This system significantly reduces the false positive rate. It is applied to use cases such as data center operation management and automated control of large-scale cloud infrastructure. This system improves hardware operating efficiency. It suppresses unnecessary consumption of communication bandwidth. It minimizes processor idle time. These technological improvements enhance the sophistication of computer technology itself. This system does not merely improve operational efficiency, but optimizes the management of internal physical resources. It shares tensor data across multiple modules. It performs inter-process communication via shared storage space. This reduces communication overhead between modules. It minimizes overall processing latency in milliseconds.

[0041] First, the system management department, installed on servers, collects diverse data in real time from various information processing devices constituting the IT infrastructure, including physical servers, virtual servers, network devices, storage devices, cloud services, business applications, databases, backup devices, load balancers, firewalls, and VPN devices. This data includes operational status, CPU, memory, disk, and network utilization, running processes, service response times, fault information, event logs, system logs, application logs, job execution history, and structural change history. For example, it combines multiple methods such as SNMP, Syslog, APIs, agent software, and cloud monitoring services to acquire information. This data is then analyzed by generative AI using advanced algorithms such as time series analysis, anomaly detection, clustering, pattern mining, and causal inference. For instance, it can accurately detect complex anomaly patterns that were previously difficult to detect using threshold judgments or simple rule-based methods, such as sudden increases in CPU utilization, gradual increases in utilization caused by memory leaks, disk I / O bottlenecks, network latency, uncontrolled processes, and intermittent service response delays. Generative AI, for example, learns from past failure cases or application history, system architecture information, and external failure databases to automatically infer the cause or scope of anomalies. For instance, it can generate specific alerts or recommended response strategies in natural language, such as "Since the CPU load of virtual server J is similar to past failure patterns, a memory leak in application K is suspected," or "The surge in traffic on network device L is presumed to be caused by a configuration error in the backup operation," and notify the management terminal. Furthermore, even in system architectures spanning multiple locations, or in hybrid cloud and on-premises environments, or environments with multiple vendors' equipment, generative AI can analyze overall correlations, visualizing the risk of failure impact or dependencies, the effectiveness of redundancy structures, and failover status during failures. For example, it can evaluate the overall system robustness from multiple perspectives, such as "The risk of a network failure at location A affecting the business system at location B is high," or "The automatic switchover to on-premises N functioned normally during a failure of cloud service M." Specifically, the system management department obtains thousands of log entries and performance metrics per second from various information processing devices via a data collection agent. The system management department converts the acquired raw data into a multi-dimensional numerical tensor. For example, it normalizes time-series data such as processor utilization or memory usage to achieve zero mean and unit variance. This normalized data is then structured into a 512-dimensional input vector. This input vector is fed into a Transformer-based neural network with a self-attention mechanism. The neural network computes a hidden state vector from the input time-series data. It uses weight parameters learned from past failure patterns to calculate an anomaly score. A specific example of input data to this neural network could be a floating-point array representing the shift in processor utilization over the past 24 hours.As another specific example of input data, a time-series vector representing the memory consumption of a specific process can be given. As a specific example of output data from this neural network, an anomaly probability score ranging from zero to one can be given. As another specific example of output data, an attention weight matrix representing the cause of the anomaly can be given. When the output anomaly probability score exceeds a predetermined threshold, the system management department initiates subsequent diagnostic processing. The system management department inputs the anomaly score and attention weight matrix into a large-scale language model. This large-scale language model combines the input numerical data and metadata of the system structure to generate diagnostic text in natural language. This large-scale language model is a deep learning model with billions of parameters. This large-scale language model is pre-trained using a cross-entropy loss function. This large-scale language model is fine-tuned using the system's inherent usage logs. The system management department sends the generated diagnostic text to the administrator terminal. The system management department further identifies the process that is the cause of the anomaly. The system management department automatically issues a termination command to the identified process. This system, through tensor operations in a high-dimensional space, detects subtle anomalies exceeding the limits of human cognition at an early stage. This system thus achieves the technical effect of preventing system downtime before problems arise. This system is highly effective in use cases such as the accounting systems of financial institutions or the basic monitoring of e-commerce platforms. It fundamentally improves upon previous methods of simple threshold monitoring. The system enables autonomous self-healing capabilities for the computer. To enhance the accuracy of anomaly detection, the system employs a continuous learning algorithm. It dynamically updates the weights of the neural network using newly collected data. This allows the system to adapt to unknown failure modes.

[0042] Next, the security monitoring department also implements real-time collection and accumulation of access logs, communication data, authentication history, file operation history, application logs, system logs, external threat intelligence information, IDS / IPS detection logs, and endpoint antivirus software detection logs on the server. Generative AI, for example, uses natural language processing, anomaly detection algorithms, graph analysis, behavioral analysis, and machine learning-based classification and regression models to detect patterns that differ from typical business access with high precision, such as a large number of accesses late at night, multiple authentication failures in a short period of time, connections from unknown IP addresses, internal users taking out large amounts of files, command and control communications of malware, signs of ransomware, the spread of phishing emails, and suspicious behavior of IoT devices. Furthermore, generative AI, for example, learns from past attack methods or the latest threat intelligence, external security information sharing services, and attack information on the dark web, enabling early detection of unknown attacks or signs of zero-day attacks. Upon detecting a threat, generative AI automatically generates and immediately executes response steps, including cutting off access, isolating the terminal, saving logs, notifying relevant personnel, obtaining forensic data, determining the scope of impact, visualizing the attack path, and proposing strategies to prevent further damage. For example, upon detecting suspicious external communication, it automatically generates and applies appropriate firewall rules, providing administrator terminals with detailed response history in natural language, such as "Port scanning of network device P was detected, and communication from this IP address was cut off," or "Ransomware activity was detected on server Q, the terminal was isolated from the network, and a backup of encrypted files was obtained." Furthermore, for example, upon detecting signs of internal violations, it also immediately responds to human risks such as "User R's account has been temporarily suspended and a detailed investigation has begun because a large number of files were transferred to external storage outside of normal business hours." Specifically, this security monitoring unit obtains data packets from the mirror port of the network switch. This security monitoring unit extracts the header information and payload of the obtained data packets. This security monitoring unit encodes the extracted information into a fixed-length numerical vector. This security monitoring unit inputs the numerical vector into a convolutional neural network and a graph neural network. As a specific example of input data to this neural network, a vector containing a one-hot encoded source Internet Protocol address or destination port number can be given. As another specific example of input data, a multidimensional tensor containing a normalized sequence of bytes of the payload can be given. This neural network performs convolution and pooling operations on the input tensors. This neural network uses an adjacency matrix reflecting the network topology to learn the relationships between nodes. As a specific example of output data from this neural network, a threat score representing the probability that each data packet is malware communication can be given. As another specific example of output data, a classification distribution representing the types of attacks can be given. This security monitoring unit determines whether the output threat score is lower than a security benchmark value.This security monitoring unit immediately executes subsequent defensive actions upon receiving a high threat score. It dynamically generates an access control list (ACC) to cut off the communication flow. This ACCR is then applied to the firewall. Furthermore, it uses a large-scale language model to generate text summarizing the event. This large-scale language model receives threat scores or attack categories as input. It outputs a report in natural language easily understood by administrators. The system completes these processes with millisecond latency. This system achieves autonomous defense without waiting for manual analysis by human security analysts. This results in the physical prevention of the escalation of damage caused by cyberattacks. This system is applicable to use cases protecting confidential networks of government agencies or backbone information systems of enterprises. This system identifies zero-day attacks, which are previously undetectable by signature-based intrusion detection systems, as unknown patterns in a high-dimensional space. This system fundamentally improves the robustness of computer networks. To reduce false positives, this system integrates the outputs of multiple neural networks through ensemble learning. This results in extremely high detection accuracy.

[0043] The resource optimization department, also implemented on servers, continuously collects and analyzes the overall resource utilization of the IT infrastructure, such as CPU, memory, storage, and network bandwidth utilization, virtual machine operation status, load balancing of each application, job scheduler execution plans, business calendars, event information, seasonal variations, and collaboration with external systems. Generative AI, for example, uses time series forecasting, demand forecasting, anomaly detection, optimization algorithms, and reinforcement learning to learn from past utilization history, business calendars, event information, seasonal variations, and other data to predict future load changes. For instance, it can identify the tendency for concentrated utilization of business systems at the end of the month or year and automatically add virtual servers in advance, or reduce resources during periods of low utilization such as nights or rest days, automatically performing dynamic scaling. Furthermore, generative AI can propose or automatically execute optimal resource allocation when a specific application temporarily becomes high-load, such as load balancing to other servers, automatic expansion of storage capacity, priority control of network bandwidth, scheduling changes for backup jobs, real-time migration of virtual machines, and automatic allocation of cloud resources. For example, suggestions for cost optimization or business continuity are made, such as "Automatically enhance the resources of virtual server S starting at 18:00 today," "Automatically expand storage T due to reduced available capacity," "Automatically move backup jobs to late-night hours due to network bandwidth constraints," and "Propose shifting workloads to local V due to high cloud service U utilization costs." These optimization suggestions or implementation results are presented to administrators in a concrete and easily understandable manner using natural language through various interfaces such as dashboards or reports, alert notifications, and chatbots. Specifically, this resource optimization department collects time-series data representing the processor utilization or memory allocation of each virtual machine. This time-series data is input into a Long Short-Term Memory (LSTM) network or a Transformer model. A specific example of input data to this neural network is a three-dimensional tensor representing resource consumption over the past week. Another specific example of input data is a vector encoding calendar information representing the week or time period. This neural network predicts future load changes from this input data. A specific example of output data from this neural network is an array of predicted processor utilization for each time period in the next 24 hours. As another specific example of output data, an integer value representing the required number of virtual machines can be given. This resource optimization unit inputs this prediction result into a reinforcement learning agent. This reinforcement learning agent explores the state space and action space based on a Markov decision process. This reinforcement learning agent learns using a reward function that minimizes the penalties and infrastructure costs caused by resource insufficiency. As a specific example of output data from this reinforcement learning agent, a migration command that moves a specific virtual machine to another physical server can be given.As another specific example of output data, a configuration instruction for expanding storage volume capacity can be given. This resource optimization unit determines the optimal resource allocation based on the action value function of this output. This resource optimization unit executes the determined allocation plan via the application programming interface of the hypervisor. This system thereby maximizes the efficiency of hardware resource utilization. This system reduces power consumption and optimizes data center operating costs. This system is applied to use cases dealing with sudden surges in traffic during promotional periods on e-commerce websites. This system eliminates manual settings based on rules of thumb by human administrators. This system improves the overall throughput of the computer system by combining high-dimensional predictive models and optimization algorithms. This system further uses a large-scale language model to generate text explaining the basis of the optimization. This text is displayed on the monitor of the administrator's terminal.

[0044] The terminal provides an interface for administrators to operate and browse, receiving and displaying in real time alarms, threat detection results, resource optimization suggestions, execution history, fault response history, security incident reports, resource utilization predictions, cost analysis reports, system structure diagrams, dependency diagrams, and fault impact simulation results generated on the server side. For example, it can graphically display the overall system operation status on a dashboard screen, or instantly communicate with administrators via pop-up notifications, email notifications, chat notifications, push notifications to smartphones, and other methods when alarms occur. Furthermore, administrators can interact with the server from the terminal by: approving / rejecting optimization suggestions, adding response instructions, requesting detailed reports, prioritizing fault responses, escalating security incidents, manually adjusting resource allocation, instructing AI model relearning, and setting up linkages with external systems. Specifically, this terminal is an information processing device with a graphics processing unit. It runs a web browser or a dedicated client application. A persistent connection using the WebSocket protocol is established between the terminal and the server. The terminal asynchronously receives JSON-formatted data streams from the server. The terminal binds the received data to a virtual document object model in memory. This terminal utilizes the hardware acceleration of its graphics processing unit to rapidly redraw the screen. Specific examples of input data to this terminal include numerical data representing the importance of an alarm sent from the server. Another example is an array of nodes and edges representing the system's topology. Based on this input data, the terminal dynamically generates charts or graphs on the dashboard. Specific examples of output data from this terminal include the Boolean value of an approval flag generated when a manager clicks a button on the screen. Another example is a query string in natural language entered by the manager. This terminal sends this output data to the server. The server receives the data and initiates subsequent processing pipelines. This system thus achieves seamless interaction between the manager and the autonomous control system. This system enhances information visibility. It reduces the cognitive load on managers and supports rapid decision-making. This system is applicable to use cases such as monitoring operations in large-scale network operations centers. This system is not merely a list of information, but visually represents the semantic relationships between data. This system improves operability by minimizing the rendering latency of the user interface. This system distributes the load on the server side by effectively utilizing the computing resources on the terminal side.

[0045] Furthermore, the application of generative AI is at the core of this invention. For example, in the learning of the anomaly detection model, various data such as past fault logs or application history, security incident information, external threat intelligence, business calendars, event information, system structure information, user action history, and external environmental data (weather, disaster information, social events, etc.) are used to continuously update the model, enabling it to flexibly respond to environmental changes or new threats. For instance, in the event of an unknown attack method, external threat intelligence information can be automatically retrieved to strengthen the AI ​​model. Moreover, by utilizing natural language generation capabilities, easily understandable notifications or reports, suggestions, fault response steps, explanations of security incidents, explanations of resource optimization, and simulation results of cost reduction effects can be automatically generated for managers, allowing even those without specialized knowledge to easily grasp the situation or make informed decisions. Specifically, this system implements a continuous learning pipeline for generative artificial intelligence models. The system accumulates newly collected log data or event reports as learning datasets. This system uses these datasets to periodically update the weight parameters of the neural network. The system employs optimization algorithms such as stochastic gradient descent or adaptive moment estimation. This system calculates cross-entropy error or mean squared error as the loss function during learning. A specific example of input data to this neural network could be a byte array representing the signature of newly discovered malware. Another specific example of input data could be a sequence of text tags representing the system's structural change history. A specific example of output data from this neural network could be a tensor with billions of updated weight parameters. Another specific example of output data could be a graph showing the shift in loss values ​​representing the convergence state of the learning process. This system dynamically deploys the updated model to the inference engine. This results in a continuous improvement in the model's inference accuracy. This system enhances the system's adaptability to environmental changes over the years or new cyber threats. This system is applied to use cases such as automated deployment in continuous integration and continuous delivery environments of cloud infrastructure. This system employs a beam search algorithm or Top-p sampling during the decoding of large-scale language models. This results in the generation of context-aware and technically accurate explanatory text. This system passes the generated text to the subsequent notification module. This system pushes the published information to the administrator's terminal via the notification module. This system makes explicit knowledge by using the tacit knowledge possessed by human experts as weights in a neural network. This system achieves automatic knowledge inheritance using computer technology.

[0046] For example, the System Management Department automatically diagnoses a problem as "due to a sharp increase in the memory usage of server W over the past 24 hours, consistent with past failure patterns, a leak in process X is suspected." The Security Monitoring Department responds immediately by "detecting a brute-force attack on network device Y and automatically cutting off the IP address." The Resource Optimization Department takes actions such as "due to low utilization of virtual server Z, an automatic shutdown is proposed for the night" and "due to the high cost of cloud service AA, a workload transfer to local BB is proposed." These departmental collaborations achieve a high degree of autonomy. Furthermore, for example, when a failure occurs, AI automatically determines the scope of the failure's impact, generates a dependency graph and provides it to administrators, and automatically generates and distributes failure response steps to relevant personnel. In the event of a security incident, AI automatically visualizes the attack path, immediately executes damage amplification prevention strategies, and automatically generates and submits an incident report to management. During resource optimization, AI predicts future business load, automatically generates the optimal resource allocation plan, simulates cost reduction effects or the impact on business continuity, and provides notifications to administrators. Specifically, this system employs a multi-agent architecture with multiple autonomous agents coordinating actions. The system management department's agent analyzes the time-series tensor of memory usage. When an anomaly is detected, the system management agent writes a status flag to the shared storage space. The security monitoring agent monitors this status flag. The security monitoring agent analyzes the packet headers of network traffic and identifies unauthorized access. The security monitoring agent appends the identified Internet Protocol addresses to the cut-off list. The resource optimization agent inputs the load changes caused by these event responses into the predictive model. Specific examples of input data to this predictive model include multi-dimensional vectors of system states collected from various agents. Another example of input data includes numerical data representing the progress rate of currently executing batches. Specific examples of output data from this predictive model include the probability distribution of future loads for each physical server. Another example of output data includes clustering results representing the optimal virtual machine configuration. This system integrates these outputs to generate an overall optimization command. This system issues this command to each hardware component. This system thus achieves a technical effect of global optimization, not local optimization, but system-wide optimization. This system proactively prevents cascading failures caused by multiple faults. This system is applied to use cases such as the base application of network applications employing a large-scale microservice architecture. To minimize communication overhead between modules, this system uses a message queue protocol. This system improves processing parallelism through asynchronous message passing. This system significantly enhances the fault tolerance of the computer system.

[0047] Thus, in this embodiment of the invention, by installing a system management unit, security monitoring unit, and resource optimization unit utilizing generative AI on the server side, and a management interface on the terminal side, it is possible to comprehensively address a variety of complex issues related to the unified and highly automated use of the entire IT infrastructure, security enhancement, resource optimization, cost reduction, improved business continuity, rapid fault response, reduced human risk, automatic inheritance of proprietary technologies, and flexible response to changes in the external environment. Specifically, this system constructs a network-physical system with close hardware and software integration. This system processes massive amounts of sensor data collected from various information processing devices in real time. This system breaks through the limitations of previous heuristic methods by using high-dimensional data analysis through deep learning models. This system maximizes the utilization of processor computing power and large-capacity memory. This system offloads neural network inference processing to a dedicated tensor processing unit. This system thus achieves a significant reduction in inference latency. This system dynamically controls the overall power consumption of the data center. This system improves physical energy efficiency by optimizing the operating rate of cooling devices. This system is applicable to mission-critical use cases such as infrastructure management in smart cities or core network control for large-scale telecommunications operators. This system is not merely about automating business processes; it pushes the efficiency of the computer architecture itself to its limits. It embodies the concept of a self-organizing network. It autonomously constructs alternative paths to handle unknown hardware failures or software vulnerabilities. It maintains system availability at a nines-level. These technical features provide a next-generation autonomous computing platform.

[0048] (System Composition) The system described in this embodiment comprises a system management department, a security monitoring department, a resource optimization department, a data collection department, a user interface department, an AI learning and inference department, and a notification and report generation department. The system management department collects diverse data in real time from various information processing devices, including physical servers, virtual servers, network devices, storage devices, cloud services, business applications, databases, backup devices, load balancers, firewalls, and VPN devices. This data includes operational status, CPU, memory, disk, and network utilization, running processes, service response times, fault occurrence information, event logs, system logs, application logs, job execution history, and structural change history. Information is acquired through various means, such as combining SNMP or Syslog, APIs, agent software, and cloud monitoring services. This data is then used for preprocessing or normalization, outlier correction, and time-series data shaping, which are then fed into generative AI. The System Management Department generates prompts for the generative AI, such as "Analyze the time-series data of CPU, memory, and disk usage of the server cluster over the past 24 hours, and describe the abnormal trends or signs of failure in natural language," and "Extract patterns that differ from normal times from the network device traffic logs and infer the causes," instructing the AI ​​to perform analysis. For example, when the CPU usage of a virtual server rises sharply, the System Management Department generates a prompt such as "Server A's CPU usage has exceeded 90% since 13:00 today. Compare it with past failure patterns, output the causes, and recommend corresponding countermeasures," executing a diagnosis performed by the AI. Furthermore, even in system architectures spanning multiple network sites or in hybrid cloud and on-premises environments, to enable the AI ​​to analyze dependencies or the risk of failure ripple effects, prompts such as "Infer the impact of network failures at site X on the business systems of other network sites and generate a dependency graph" are used. Specifically, this system uses natural language processing technology to comprehensively analyze system logs and indicator data. The System Management Department cleans the collected raw data and fills in missing values. The System Management Department embeds this preprocessed data into text-formatted prompt templates. The system administration department inputs the prompt into a tokenizer, converting it into an array of integer token identifiers. This token array is then input into the embedding layer of a large-scale language model. A specific example of input data to this large-scale language model could be thousands of token identifiers representing the segmentation of a system log string. Another specific example of input data could be numerical tokens representing the conversion of time-series metrics into textual representations. This large-scale language model uses the self-attention mechanism of the Transformer architecture to compute contextual dependencies between tokens. A specific example of output data from this large-scale language model could be a logit vector representing the probability distribution of the next word. Another specific example of output data could be the generated diagnostic result text string.The system management department inputs the output text into a parser. The system management department extracts specific action commands or object node identifiers from the text. Based on the extracted information, the system management department executes subsequent automatic recovery scripts. This system thus brings the technical advantage of processing log messages as unstructured data and indicators as structured data in the same potential space. This system identifies the root causes of complex faults that were missed by previous rule-based log monitoring tools. This system is applied to use cases such as troubleshooting distributed systems in multi-cloud environments. This system uses hint engineering techniques to optimize the inference accuracy of the model. This system significantly improves the computer's self-diagnostic capabilities.

[0049] The Security Monitoring Department collects and accumulates real-time access logs, communication data, authentication history, file operation history, application logs, external threat intelligence, IDS / IPS detection logs, and endpoint antivirus software detection logs from the entire IT infrastructure. It then uses generative AI to generate alerts such as "Analyze access logs and authentication history from 00:00 today to the present, extract unusual access patterns or suspicious behavior, and assess the threat level," "Detect signs of malware infection or command and control communication from communication data, and list the corresponding terminals and communication targets," and "Detect signs of internal users taking out a large number of files, and determine the corresponding users, filenames, and transmission targets," performing multi-faceted threat analysis based on AI. For example, if a large number of authentication failures occur late at night, the Security Monitoring Department generates alerts such as "User B has recorded more than 100 consecutive authentication failures since 2:00 AM. Assess the possibility of a brute-force attack and output recommended response strategies," performing real-time AI-based diagnosis and automatic generation of response strategies. Furthermore, by enabling AI to read external threat intelligence information and utilizing prompts such as "compare the latest ransomware attack methods with the system's communication logs and report any similar patterns," the system can flexibly respond to unknown attacks or zero-day threats. Specifically, the Security Monitoring Department receives log streams in real time from the Security Information Incident Management System. The department extracts features from these log streams and constructs a natural language context. This context is then input into a large-scale language model. A specific example of input data to this model is text data arranged chronologically from authentication failure events of the past hour. Another example is the stringification of a hexadecimal dump of a suspicious payload. The model uses a pre-learned cybersecurity knowledge base to evaluate the input data. A specific example of output data from the model is an integer score from zero to one hundred representing the severity of the threat. Another example is structured data in JSON format describing recommended defensive actions. The department parses this output JSON data. This security monitoring department invokes the firewall's application programming interface (API) based on the parsing results. This department dynamically blocks malicious Internet Protocol (IP) addresses. This system thus achieves the technical effect of reducing the response time to unknown attack patterns to milliseconds. This system is applied to use cases that fully automate the incident response operations of the security operations center. This system algorithmizes the threat hunting process performed manually by human analysts. This system surpasses signature-based detection through pattern matching in a high-dimensional language space. This system establishes a self-defense mechanism for computer networks.

[0050] The Resource Optimization Department continuously collects and analyzes the overall resource utilization of IT infrastructure, such as CPU, memory, storage, and network bandwidth utilization, virtual machine operation status, load balancing status of each application, job scheduler execution plans, business calendars, event information, seasonal changes, and interaction with external systems. Based on this data, the department generates AI-powered suggestions such as "Based on the resource utilization history and business calendar of the past month, predict load changes for the next week and propose resource addition / reduction plans in natural language," "Simulate the optimal load balancing method when a specific application experiences high load and output a recommended structure," "Propose automatic scaling steps and cost optimization strategies when storage capacity is tight," and "Evaluate the feasibility and impact of migrating to on-premises when cloud service usage costs are high." For example, when business system usage is concentrated at the end of the month, the Resource Optimization Department generates suggestions such as "Predict the CPU and memory utilization of the virtual server cluster for the last three days of the month and output the required number of additional servers and scheduling schemes," automatically generating an AI-based dynamic scaling plan. Furthermore, it leverages prompts for various optimization scenarios, such as instructing AI on resource scaling down during nighttime or rest days, optimal scheduling of backup jobs, and workload migration between cloud and on-premises environments. Specifically, this resource optimization department obtains metadata representing resource allocation status from the virtualization infrastructure's management server. This metadata is combined with past performance metrics to generate multimodal prompts. These prompts are then input into a large-scale language model. Specific examples of input data to this large-scale language model include a list of key-value pairs representing the number of processor cores or memory capacity of each virtual machine. Another example of input data is natural language text representing the scheduling of future business events. This large-scale language model integrates this input data to infer the optimal resource allocation plan. Specific examples of output data from this large-scale language model include a numerical matrix representing the increase or decrease in resources for each node. Another example of output data is executable script code describing migration steps. This resource optimization department sends the output script code to the orchestration engine. The orchestration engine interprets the script and automatically performs live migration of virtual machines or horizontal scaling of containers. This system thus brings about the technological effect of evolving the concept of Infrastructure as Code into a dynamic and autonomous process. It prevents resource over-provisioning in cloud computing environments and minimizes costs. It is applied to use cases such as automatic scaling for massive traffic surges in web services. It implements predictive scaling that understands context, rather than scaling based on static thresholds. This system fundamentally improves the flexibility and resilience of computer systems.

[0051] The Data Collection Department collects necessary data in real-time or periodically from various information processing devices or network equipment, cloud services, business applications, external databases, threat intelligence services, etc., and performs data preprocessing, normalization, missing value imputation, outlier detection, format conversion, time series shaping, metadata assignment, etc., before providing it to the AI ​​Learning & Inference Department or other departments. For example, the Data Collection Department handles various data sources such as receiving SNMP traps or Syslog messages, acquiring cloud resource information based on APIs, collecting terminal information based on agent software, automatically acquiring external threat intelligence, and importing business calendars or event information. Specifically, this Data Collection Department uses a distributed stream processing platform to process millions of event data items per second. The department temporarily buffers asynchronous messages sent from various devices into a message queue. It then segments the buffered data into small batches using a specific window size. For missing values, the department applies the K-nearest neighbor algorithm or linear interpolation to impute the data. Finally, it uses Z-score determination or the isolated forest algorithm to remove outliers. Specific examples of input data to this data collection unit include captured data packets in binary format sent from network devices. Another example of input data is unstructured text logs output from an application server. Specific examples of output data from this data collection unit include multidimensional tensors of floating-point numbers that can be directly input into machine learning models. Another example of output data is an array of normalized JSON objects with synchronized timestamps. This data collection unit stores this output data in an in-memory data grid or a time-series database. This system thus enables subsequent artificial intelligence models to infer from high-quality data with low noise. This system hides the computational overhead required for data preprocessing through distributed processing. This system is applied to use cases such as the aggregation and preprocessing of massive amounts of sensor data in IoT environments. This system absorbs the differences in data formats in heterogeneous environments and builds a unified data lake. This system maximizes the efficiency of computer data processing pipelines.

[0052] The user interface unit runs on the administrator's terminal, receiving and displaying in real time alarms, threat detection results, resource optimization suggestions, execution history, fault response history, security incident reports, resource utilization predictions, cost analysis reports, system architecture diagrams, dependency diagrams, and fault impact simulation results generated on the server side. For example, it graphically displays the overall system operation status on the dashboard screen and instantly communicates alarms to administrators via pop-up notifications, email notifications, chat notifications, and push notifications to smartphones. Furthermore, administrators can interact bidirectionally with the server by approving or rejecting optimization suggestions, adding response instructions, requesting detailed reports, prioritizing fault responses, escalating security incidents, manually adjusting resource allocation, instructing AI model relearning, and setting up linkages with external systems. Specifically, this user interface unit is installed as a single-page application. It detects server-side status changes in real time via WebSocket. Based on the received data, it calculates the difference in the virtual document object model. By reflecting only this difference in the actual screen rendering, it minimizes the rendering load. As a specific example of input data to this user interface unit, a JSON payload representing an update of the system status pushed from the server can be given. As another specific example of input data, a natural language report text generated by an artificial intelligence model can be given. As a specific example of output data from this user interface unit, key-value pairs of parameters selected by the administrator on a dashboard can be given. As another specific example of output data, a call request to the application programming interface used to trigger the model's relearning can be given. This user interface unit sends this output data to the server using asynchronous communication. This system thus achieves the technical effect of providing a high-real-time user experience while suppressing network bandwidth consumption. This system enables administrators to intuitively grasp the system status and make rapid command inputs. This system is applied to use cases such as operator consoles in monitoring centers of mission-critical systems. This system utilizes the hardware acceleration of the graphics processing unit to smoothly perform 3D depictions of complex network topologies. This system improves human-computer interface technology.

[0053] The AI ​​Learning and Inference Department runs on a server, using various data provided by the Data Collection Department to learn and infer anomaly detection models, threat detection models, resource optimization models, natural language generation models, etc. For example, it continuously updates models using past fault logs or application history, security incident information, external threat intelligence, business calendars, event information, system architecture information, user action history, and external environmental data, flexibly responding to environmental changes or new threats. The AI ​​Learning and Inference Department receives prompts from the System Management Department, Security Monitoring Department, and Resource Optimization Department, performs parsing, inference, and natural language generation, and returns the results to each department. Specifically, this Learning and Inference Department executes on a parallel computing cluster interconnected with multiple graphics processing units. It uses a deep learning framework to construct the computational graph of a neural network. It uses the backpropagation algorithm to optimize the network's weight parameters. To avoid the vanishing gradient problem, it assembles normalization layers or residual connections into the network architecture. A specific example of input data for this Learning and Inference Department could be a mini-batch tensor containing millions of log entries provided by the Data Collection Department. As another specific example of input data, the prompt string for the inference request sent from each department can be cited. As a specific example of output data from this learning inference department, the output vector of the Softmax function representing the probability of each class obtained as the inference result can be cited. As another specific example of output data, the generated natural language text tag column can be cited. This learning inference department returns this output data to the requesting module with a latency of milliseconds. This system thus achieves the technical effect of efficiently performing large-scale neural network learning and inference on the same basis. This system maximizes the inference throughput of the model and improves the responsiveness of the system. This system is applicable to use cases such as real-time illegal detection systems or dynamic resource allocation engines. This system implements a scheduling algorithm for tensor operations that utilizes the hardware's arithmetic unit to its limits. This system optimizes the computing power of the computer for artificial intelligence tasks.

[0054] Based on the output of the AI ​​Learning and Inference Department, the Notification and Report Generation Department automatically generates alerts, detailed reports, event descriptions, explanations of resource optimization, simulation results of cost reduction effects, fault response procedures, security incident descriptions, dependency graphs, and fault impact simulation results for administrators using natural language. These are then presented to administrators via the user interface. For example, it automatically generates specific and easy-to-understand explanations such as "Server C's memory usage has increased sharply in the past 24 hours, suspected to be a leak in process D," "Port scanning of network device E was detected, and communication from this IP address was cut off," "Due to low utilization of virtual server F, automatic shutdown at night is proposed," and "Due to the high cost of cloud service G, workload migration to local H is proposed." Specifically, this Notification and Report Generation Department executes a natural language generation pipeline. It converts the structured data received from the Inference Department into prompts for a text generation model. Using these prompts, it executes a beam search decoding algorithm to explore the optimal word arrangement. Specific examples of input data to this notification report generation unit could include a JSON object containing anomaly scores or identifiers of cause nodes from the anomaly detection model. Another example of input data could be the future predicted load tensor from the resource optimization model. A specific example of output data from this notification report generation unit could be a string of event reports formatted in Hypertext Markup Language. Another example of output data could be a Markdown-formatted message payload sent to a webhook in a chat application. This notification report generation unit sends this output data to external systems via Simple Mail Transfer Protocol (SMLP) or various application programming interfaces (APIs). This system thus achieves the technical effect of converting machine-generated inorganic numerical values ​​into context-rich information that humans can instantly understand. This system dramatically reduces initial response time when events occur. This system is applied to use cases such as automating help desk operations in enterprise IT service management. To ensure the accuracy of the generated text, this system integrates a fact-checking module into the pipeline. This system improves the quality of computer-based information delivery.

[0055] Specific examples of the prompts required for generative AI to read when implementing this invention include: "Analyzing time-series data of CPU, memory, and disk usage of the server cluster and describing abnormal trends or signs of failure in natural language," "Analyzing access logs and authentication history from 00:00 today to the present, extracting access patterns or suspicious behaviors that differ from the norm, and assessing the threat level," "Predicting load changes for the next week based on resource utilization history and business calendar for the past month, and proposing resource increase / decrease plans in natural language," "Comparing the latest ransomware attack methods with the communication logs of this system and reporting whether there are similar patterns," "The CPU usage of the virtual server has exceeded 90% since 13:00 today. Compare it with past failure patterns and output the cause and recommended response strategies," and "User B has recorded more than 100 consecutive authentication failures since 2:00 AM. Assess the possibility of brute-force attacks and output recommended response strategies," etc. Specifically, this system has a template engine for dynamically constructing these prompts. This system uses a few-shot prompting technique, embedding similar past cases as context into the prompts. This system thus introduces the in-context learning capability of large-scale language models. A specific example of input data to this template engine is an array of indicator variables representing the current system state. Another specific example of input data is text fragments of past fault response history retrieved from a database. A specific example of output data from this template engine is a complete prompt string with expanded variables and supplemented context. This system processes this prompt string using a tokenizer and inputs it into the model. This system uses regular expressions or a parser to parse the output from the model and extract executable commands. This system thus achieves the technical effect of seamlessly combining natural language-based instructions with the physical control of the computer. This system suppresses model hallucinations and improves the reliability of inferences through prompt optimization. This system is applied to use cases such as the automatic execution script generation of complex system operation steps. This system functions as an interface that accurately translates human intentions into computer actions. This system assembles prompt engineering as an automated process within the system.

[0056] Thus, the system described in this implementation employs interconnected components to collect, analyze, optimize, and notify various types of information. With generative AI at its core, it comprehensively achieves a unified and highly automated IT infrastructure, enhancing security, optimizing resources, reducing costs, improving business continuity, rapidly responding to faults, reducing human error, automatically inheriting proprietary technologies, and flexibly responding to changes in the external environment. Specifically, this system uses an architecture where each module runs independently as a microservice, while asynchronously interconnecting via a message broker. The system maintains the overall system state as a massive multidimensional tensor in memory. Global optimization is achieved by sharing and updating this state tensor among various AI models. To eliminate single points of failure, the system redundancies components and uses a distributed consensus algorithm to maintain state consistency. This results in a highly scalable and fault-tolerant autonomous infrastructure. The system transcends the physical constraints of data centers, dynamically reconfiguring logical resource pools. It is applicable to use cases such as the backend infrastructure of large-scale cloud services deployed globally. The system integrates previously siloed application management tools, providing a single intelligent control plane. This system utilizes the cognitive capabilities of artificial intelligence to address the increasing system complexity that has arisen with the evolution of computer technology. The system performs holistic optimization across the boundaries of hardware and software.

[0057] (Implementation steps) Step 1: Data Collection and Preprocessing. In this step, diverse data is collected in real-time or periodically from various information processing devices, including physical servers, virtual servers, network devices, storage devices, cloud services, business applications, databases, backup devices, load balancers, firewalls, and VPN devices. This data includes operational status, CPU, memory, disk, and network utilization, running processes, service response times, fault information, event logs, system logs, application logs, job execution history, structural change history, access logs, authentication history, file operation history, and external threat intelligence. The collected data undergoes preprocessing such as missing value imputation, outlier detection, normalization, format conversion, time series shaping, and metadata assignment before being provided to the AI ​​Learning and Inference Department or other departments. Specifically, this system constructs a data pipeline and starts the stream processing engine. The system receives raw data from agent programs installed on each information processing device via the Transmission Control Protocol (TCP). The system writes the received raw data into a message queue in memory. The system executes worker processes in parallel and reads data from the message queue. The system performs data type conversion or timestamp standardization on the read data. Specific examples of input data to this system include JSON-formatted log messages sent asynchronously from various devices. Another example of input data is binary-formatted counter values ​​obtained via a simple network management protocol. Specific examples of output data from this system include fixed-length numerical tensors matching the dimension of the input layer of a machine learning model. Another example of output data is matrix data that converts categorical variables into one-hot vectors. This system stores this output data in a feature store and passes it to subsequent inference steps. This system thus achieves the technical effect of mapping uneven and noisy raw data to a high-quality feature space that artificial intelligence can process. The system suppresses the latency required for data preprocessing to microseconds. This system is applicable to use cases such as basic monitoring of high-frequency trading systems or real-time unauthorized access detection. This system optimally utilizes the computer's memory hierarchy to maximize data throughput.

[0058] Step 2: System Status Monitoring and Anomaly Detection (Utilizing Generative AI) In this step, the system management department uses preprocessed data to allow generative AI to analyze the overall system operation status, load status, and signs of failure. Specific examples of prompts for the generative AI include: "Analyze the time-series data of CPU, memory, and disk usage of the server cluster over the past 24 hours, and describe the anomaly trends and signs of failure in natural language," "Extract patterns that differ from normal times from the network device traffic logs and infer the causes," and "The CPU usage of the virtual server has exceeded 90% since 13:00 today. Compare it with past failure patterns, output the causes, and recommend corresponding strategies." Based on these prompts, the AI ​​automatically detects anomaly patterns, infers the causes of failures, and generates recommended response strategies. Specifically, this system feeds the preprocessed feature tensors into the inference pipeline. This system calls upon a large-scale language model and a time-series anomaly detection model deployed on the memory of the graphics processing unit. This system feeds the feature tensors forward to the input layer of the model. This system performs matrix multiplication and nonlinear activation function operations in parallel within the hidden layers of the model. A specific example of input data to this model is a multidimensional time-series matrix combining system metrics from the past few hours. Another specific example of input data is an adjacency matrix representing the topological graph of the system structure. A specific example of output data from this model is a floating-point array representing the probability of each node being in an abnormal state. Another specific example of output data is a text tag column in natural language describing the root cause of the fault. The system applies a softmax function to this output probability array to identify the most probable fault mode. Based on the identified fault mode, the system initiates an alarm release module. This system thus achieves the technical effect of mathematically extracting minute anomalies from massive data streams that are visually imperceptible to human operators. This system enables proactive maintenance to prevent complete system shutdown. This system is applied to use cases such as the operational monitoring of factory automation systems in large-scale manufacturing. This system uses pattern recognition techniques in high-dimensional space to improve the reliability of computer systems.

[0059] Step 3: Security Threat Detection and Automated Response (Utilizing Generative AI) In this step, the security monitoring department inputs access logs, communication data, authentication history, file operation history, IDS / IPS logs, and external threat intelligence information into the generative AI to implement threat detection and automated response. Specific examples of prompts for the generative AI to read include: "Analyze access logs and authentication history from 00:00 today to the present, extract unusual access patterns and suspicious behavior, and assess the threat level," "Detect signs of malware infection and command and control communication from communication data, and list the corresponding terminals and communication targets," "Recorded that User B has experienced more than 100 consecutive authentication failures since 2:00 AM. Assess the possibility of a brute-force attack and output recommended response strategies," and "Compare the latest ransomware attack methods with the system's communication logs and report whether there are similar patterns," etc. Based on these prompts, the AI ​​performs automated responses such as threat detection, identifying attack paths, estimating the scope of damage, and immediately cutting off access and isolating terminals. Specifically, this system executes an automated response pipeline for security orchestration. This system inputs feature vectors extracted from network traffic into a threat detection model. Based on the model's output, the system generates dynamic defense scripts. These scripts are then distributed to the control interfaces of various security devices. Specific examples of input data to the model include the embedding representation of suspicious communication payloads vectorized using natural language processing techniques. Another example is an event sequence arranging user activity history chronologically. Specific examples of output data from the model include the classification distribution of malware families. Another example is a command-line string used to isolate infected endpoints. The system sends this output command-line string to the target switch or router via the Secure Shell protocol for execution. This system achieves the technical effect of providing millisecond-level lead time for network attack detection and defense without human intervention. It also prevents the rapid spread of ransomware through physical network disconnection. Applications include real-time illicit remittance prevention in online banking systems of financial institutions. This system replaces traditional static signature matching with dynamic behavioral analysis and autonomous decision-making algorithms. Finally, this system functions as the computer network's own immune system.

[0060] Step 4: Resource Optimization and Utilization Recommendations (Leveraging Generative AI) In this step, the Resource Optimization Department inputs resource utilization status, business calendar, event information, seasonal changes, and external system interaction status into the generative AI to automatically generate optimal resource allocation and utilization recommendations. Specific examples of prompts for the generative AI include: "Based on the resource utilization history and business calendar of the past month, predict the load changes for the next week and propose resource increase / decrease plans in natural language," "Simulate the optimal load balancing method when a specific application experiences high load and output a recommended structure," "Propose automatic scaling steps and cost optimization strategies when storage capacity is tight," and "Evaluate the feasibility and impact of migrating to on-premises when cloud service utilization costs are high." Based on these prompts, the AI ​​automatically generates dynamic scaling plans, resource reduction schemes, optimal scheduling for backup jobs, and workload migration schemes between the cloud and on-premises environments. Specifically, this system drives a hybrid inference engine that combines a large-scale language model and a reinforcement learning agent. The Resource Optimization Department converts the collected time-series data into multidimensional tensors. The Resource Optimization Department generates input tensors with time step and feature dimension. This resource optimization unit feeds the input tensor into an autoregressive neural network. This neural network predicts future loads based on past patterns of change. The network outputs the predictions as a probability distribution. This resource optimization unit maps this probability distribution into the cue space of a natural language generation model. This natural language generation model analyzes the input content vector. The model outputs a text tag column containing the optimal expansion coefficients and transfer steps. This system parses the output text into structured data. Based on the parsed data, the system sends control commands to the orchestrator. The orchestrator dynamically changes the allocated resources of the virtual machines. Through this process, the system prevents over-provisioning. This system maximizes the efficiency of computing resource utilization. This system achieves the technical effect of reducing cloud utilization costs. This system performs data-driven infrastructure management that does not rely on human intuition. This system derives solutions that satisfy complex constraints through optimization calculations in high-dimensional space.

[0061] Step 5: Notification / Report Generation and Management Interface Integration. In this step, based on the output of the AI ​​Learning and Inference Department, the Notification / Report Generation Department automatically generates alert notifications, detailed reports, event descriptions, explanations of resource optimization, simulation results of cost reduction effects, fault response steps, descriptions of security incidents, dependency graphs, and simulation results of fault impact for managers using natural language. These are then displayed to the management terminal in real time via the user interface. Managers can use the terminal to approve or reject optimization suggestions, add response instructions, request detailed reports, prioritize fault responses, escalate security incidents, manually adjust resource allocation, instruct the AI ​​model to relearn, and set up integration with external systems, enabling two-way interaction. Specifically, this Notification / Report Generation Department executes a Transformer-based natural language generation model. It acquires anomaly scores and resource prediction vectors output from the inference engine. This department converts these numerical data into text embedding vectors. The natural language generation model receives these text embedding vectors as input. The model uses a self-attention mechanism to calculate dependencies between data. This natural language generation model outputs a labeled column describing the root cause of an event and corresponding response steps. The notification / report generation department formats this labeled column into human-readable text and structured data. The user interface department renders this formatted data on a dashboard. The system receives operational inputs from managers, indicating approval or rejection. This operational input is quantified as a reward signal for reinforcement learning. This reward signal is used to fine-tune the weight parameters of the natural language generation model. Through this process, the system continuously improves its ability to generate reports that align with managers' intentions. The system significantly reduces the cognitive load on managers. The system accelerates the decision-making process when failures occur. The system achieves dynamic content generation based on the situation, rather than simply outputting fixed-format text.

[0062] (specific use case) For example, consider a scenario where a single entity manages the overall IT infrastructure of an enterprise spanning multiple locations. In this case, the systems management department collects diverse data in real time from each location's physical servers, virtual servers, network devices, storage devices, cloud services, business applications, databases, backup devices, load balancers, firewalls, VPN devices, etc., including operational status, CPU, memory, disk, and network utilization, running processes, service response times, fault occurrence information, event logs, system logs, application logs, job execution history, and structural change history. For instance, if a sudden increase in CPU utilization and network traffic is observed in a virtual server cluster at a certain location, the systems management department inputs this data into a generative AI for anomaly detection and cause estimation. Specific examples of prompts for the generative AI could include: "Analyze the time-series data of CPU utilization and network traffic of the virtual server cluster, and describe the anomaly trend and fault symptoms in natural language," or "Output the failure modes and recommended response strategies for servers whose CPU utilization exceeded 90% after 1 PM today." Generative AI, while referencing past failure cases and usage history, automatically generates diagnostic results and response strategies, such as "The simultaneous surge in CPU utilization and network traffic of virtual server A is presumably caused by resource contention due to a configuration error in the backup job. It is recommended to re-evaluate the backup job scheduling," and notifies the administrator terminal. Specifically, the system management department executes an analysis pipeline integrating graph neural networks and time series anomaly detection models. The system management department converts the diverse collected data into node feature matrices and edge indices. The system management department generates graph structure data reflecting the network topology. The system management department inputs this graph structure data into the graph neural network. The graph neural network propagates feature vectors between adjacent nodes. The graph neural network outputs the latent performance vectors of each node. The system management department inputs these latent performance vectors into the time series anomaly detection model. The time series anomaly detection model calculates the reconstruction error. The time series anomaly detection model outputs anomaly scores when the reconstruction error exceeds a specified threshold. The system management department dynamically embeds these anomaly scores and related indicator data into the prompts of a large-scale language model. The large-scale language model analyzes the input prompts. This large-scale language model outputs text data representing the root cause of a failure and specific response steps. The system sends this text data to the administrator terminal. Through this processing, the system accurately identifies complex failure cascading events in a specific distributed environment. This system prevents the waste of network bandwidth. This system drastically reduces the mean time to recovery from a failure. This system autonomously discovers unknown failure modes that cannot be detected through rule-based monitoring.

[0063] Furthermore, within the security monitoring department, for example, in situations where a large number of authentication failures occur from specific terminals late at night, and suspicious external communications are observed, access logs, authentication history, and communication data are input into generative AI to determine the presence or absence of threats, the specificity of attack paths, and the estimation of the scope of damage. Specific examples of prompts read by the generative AI include: "Analyze access logs and authentication history from 00:00 today to the present, extract access patterns and suspicious behaviors that differ from the norm, and assess the threat level," and "Analyze the correlation between continuous authentication failures since 2:00 AM and external communications, and specify the attack path and the scope of damage." The generative AI automatically generates specific response strategies, such as "External communications occurring simultaneously with user B's continuous authentication failures late at night are highly likely to be brute-force attacks and malware infections. We recommend network isolation of the relevant terminals and temporary account suspension," and executes these automatic responses in real time. Specifically, this security monitoring department drives a threat analysis engine that combines multilayer perceptrons and natural language processing models. This security monitoring department converts access logs and communication data into numerical vectors. This security monitoring department converts categorical variables such as time periods and IP addresses into embedding vectors. This department then combines these vectors to generate high-dimensional feature vectors. These high-dimensional feature vectors are input into a multilayer perceptron (MLP). The MLP repeatedly performs nonlinear transformations. The MLP outputs a probability distribution for each threat class. This department identifies the threat class with the highest value in this probability distribution. This specific result, along with raw log data, is input into a natural language processing (NLP) model. The NLP model understands the context of the attack. The NLP model outputs structured text describing the attack path progression and recommended defensive actions. The system extracts control commands from this structured text. The system dynamically updates the firewall's access control list. The system invalidates the authentication tokens of the corresponding accounts. Through this process, the system blocks zero-day attacks and advanced targeted attacks in real time. The system physically and logically prevents the escalation of damage. The system fully automates security operations and eliminates human error.

[0064] Furthermore, within the resource optimization department, for example, during periods of increased business load such as the end of the month or year, when it is predicted that virtual server or storage resources will become strained, past resource utilization history, business calendars, and event information are input into the generative AI to automatically generate future load change predictions and optimal resource allocation plans. Specific examples of prompts for the generative AI include, "Based on the resource utilization history and business calendar of the past month, predict the load changes for the next week and propose resource increase / decrease plans in natural language," and "Propose automatic expansion steps and cost optimization strategies when storage capacity is tight." The generative AI automatically generates specific optimization suggestions, such as, "Since the average CPU and memory utilization of the virtual server cluster is predicted to exceed 80% for the last three days of the month, it is recommended to add two virtual servers and automatically expand storage capacity. Due to reduced utilization at night, automatically implement resource reduction," and displays these suggestions on the administrator's terminal. Specifically, this resource optimization department executes an autoregressive time series forecasting model. This resource optimization department extracts past resource utilization rates as continuous value vectors. This resource optimization department converts business calendar and event information into one-hot encoded vectors. This resource optimization unit combines these vectors to construct an input tensor. This autoregressive time series forecasting model receives this input tensor. This autoregressive time series forecasting model calculates predicted resource utilization values ​​across multiple future time steps. This autoregressive time series forecasting model generates a probability output vector containing confidence intervals for the predicted values. This resource optimization unit inputs this probability output vector into a large-scale language model. This large-scale language model compares the predicted data with cost constraints. This large-scale language model outputs an allocation plan text containing the optimal virtual machine instance type and storage configuration. This system parses this allocation plan text. This system sends an API request for resource allocation changes to the hypervisor. Through this process, this system proactively prevents performance degradation during peak times. This system minimizes power consumption during idle periods. This system autonomously maintains the optimal balance between infrastructure costs and system service quality. This system achieves dynamic and predictive resource management that cannot be achieved through static threshold-based control.

[0065] In this way, the various departments work together, leveraging generative AI to highly automate the overall system's monitoring, anomaly detection, fault cause estimation, security threat detection, attack path identification, resource optimization, cost reduction, and business continuity assurance. This significantly reduces the burden on administrators while dramatically improving the security, efficiency, and flexibility of IT infrastructure. Specifically, this system has an orchestration layer that integrates the functions of each department. This orchestration layer executes multi-agent reinforcement learning algorithms. This orchestration layer collects state vectors output from the system management and security monitoring departments. This orchestration layer maps these state vectors to the global state space. This orchestration layer allows each agent to calculate the action value function. Each agent outputs the optimal action vector based on its own policy network. This orchestration layer mediates the competition between the action vectors of each agent. This orchestration layer synchronously updates the overall system settings parameters. This system applies this update result as an action to the environment. This system receives feedback from the environment as a reward signal. This system uses the reward signal to update the policy networks of each agent. Through this process, this system avoids getting trapped in local optima. This system ensures the autonomous and stable operation of the entire system. This system provides a comprehensive and mathematical solution to the challenges of utilizing complex and interconnected IT infrastructures. It offers a computer system capable of continuous self-evolution without human intervention.

[0066] (Application Example 1) The specific processing flow corresponding to Use Case 1 will be described below. The various parts of the system described below are implemented by the data processing device 12 and the intelligent device 14. Furthermore, the data processing device 12 is referred to as the "server" and the intelligent device 14 is referred to as the "terminal".

[0067] (Implementation methods for carrying out the present invention) The embodiments used to implement this invention will be described in more detail below. This invention targets various infrastructure devices in a data center, such as servers, network equipment, power supply equipment, air conditioning equipment, storage devices, and security equipment. Using generative AI as its core, it is a unified and automated system that enables real-time monitoring, anomaly detection, resource optimization, preventative maintenance planning, fault response, energy management, and security enhancement. Specifically, this system constructs a digital twin environment that mimics the overall physical and logical state of the data center. The system continuously receives multi-dimensional time-series tensors from a group of sensors installed in each infrastructure device. The system integrates these multi-dimensional time-series tensors with coordinate data from a 3D spatial model. The system inputs the integrated data into a deep learning model. This deep learning model calculates a temperature distribution heatmap and a power consumption prediction matrix within the space. The deep learning model outputs these prediction data in real time. Based on this output data, the system dynamically adjusts the operating parameters of each device. The system sends optimal airflow and cooling water temperature indications to the air conditioning control unit. The system sends load balancing control signals to the power supply equipment. Through this process, the system significantly improves the power efficiency of the data center. This system eliminates localized heat buildup and extends hardware lifespan. It realizes a cyber-physical system that highly integrates cyberspace and physical space. Breaking away from traditional vertically segmented device management, this system provides a holistically optimized, autonomously managed infrastructure.

[0068] First, the server monitoring department collects real-time data on the operational status of physical servers, virtual servers, storage devices, network equipment, power supply equipment, air conditioning equipment, and security equipment within the data center. This data includes CPU usage, memory usage, disk I / O, network traffic, temperature, humidity, power consumption, fault occurrence information, event logs, system logs, application logs, access logs, and unauthorized intrusion detection information. For example, it combines various methods such as SNMP, Syslog, REST API, agent software, cloud monitoring services, and IoT sensors to acquire information. Specifically, it monitors server A's CPU utilization exceeding 90%, network device B's traffic reaching 95%, storage device C's I / O latency exceeding a threshold, air conditioning device D's temperature exceeding 30 degrees Celsius, power supply device E's power consumption exceeding 90% of its rated capacity, and unauthorized intrusion detection system F detecting anomalies, thus instantly grasping the status changes of all devices. These data are analyzed by generative AI using advanced algorithms such as time series analysis, anomaly detection, pattern recognition, clustering, and causal inference. Examples include: "The high CPU load on server A is presumed to be caused by resource contention due to a backup job configuration error"; "The surge in traffic on network device B is a sign of an external DDoS attack"; "The I / O latency on storage device C is a precursor to disk failure"; "The temperature rise on air conditioning device D is caused by reduced cooling efficiency due to filter blockage"; "The surge in power consumption on power supply device E is due to peak load caused by the simultaneous startup of the server cluster"; and "The alarm from the unauthorized intrusion detection system F is suspicious access by internal users." This high-precision detection and diagnosis of complex anomalies or fault signs is remarkable. Upon detecting anomalies or high loads, the AI ​​automatically generates alarms and provides real-time notifications via administrator terminals, smartphones, chat tools, emails, and other means. Specifically, this server monitoring unit employs a distributed processing architecture that links edge computing nodes with the central AI cluster. This server monitoring unit connects to the indicator data collected from various devices. For example, this server monitoring unit generates a 1024-dimensional high-dimensional feature vector. The server monitoring unit inputs the high-dimensional feature vector into an autoencoder-based anomaly detection model. This anomaly detection model compresses the input vector into a low-dimensional latent space. It then reconstructs the original vector from the latent space. The model calculates a reconstruction error vector, which is the difference between the input vector and the reconstructed vector. The server monitoring unit identifies the feature dimensions with high anomaly contribution from this reconstruction error vector. This identified feature dimension and the original data are then input into a causal inference network. This causal inference network generates a directed acyclic graph representing the causal relationships between variables. The network identifies the nodes that are root causes and outputs their probability scores. Finally, the server monitoring unit inputs these probability scores and the graph structure into a large-scale language model.This large-scale language model outputs diagnostic results as natural language text. The system formats this text into an alert message, which is then distributed to various notification channels via a message broker. This process significantly reduces the communication bandwidth to the central server. The system detects anomalies with millisecond-level latency. While minimizing false positives, the system effectively captures genuine threats or faults.

[0069] Next, the Equipment Optimization Department inputs usage data or historical data from server clusters, network equipment, air conditioning equipment, power supply equipment, storage devices, security equipment, etc., and external environmental data (external temperature, electricity costs, demand forecasts, etc.) into the generative AI to automatically propose and execute optimal resource allocation or usage modes. For example, when the CPU load of the server cluster is high, the AI ​​proposes automatic workload distribution or the addition of virtual servers; conversely, during periods of low utilization such as nighttime or rest days, it recommends automatic server downsizing or switching to power-saving modes. For example, when the temperature of the air conditioning equipment is high, the AI ​​proposes enhanced cooling or changes to the operating mode of the air conditioning equipment, automatically generating the optimal cooling strategy based on changes in external temperature or humidity. For example, when the power consumption of the power supply equipment is high, the AI ​​proposes that some servers switch to power-saving modes or peak-shaving operations to reduce electricity costs. For example, when the network equipment experiences traffic congestion, the AI ​​proposes traffic path optimization or QoS control, and changes to the scheduling of backup jobs. For example, when the storage device capacity is limited, the AI ​​proposes automatic deletion of unnecessary data or storage expansion, data compression, and automatic migration to cloud storage. These optimization suggestions or automated execution results are presented in an easily understandable manner to the management terminal, allowing the manager to immediately approve, reject, or add instructions. Specifically, the equipment optimization unit possesses a control engine that executes deep reinforcement learning algorithms. The unit constructs a state vector representing the current environmental state. This state vector is, for example, a 256-dimensional numerical array containing data such as temperature, load, and electricity price. The unit inputs this state vector into a policy network. The policy network outputs a probability distribution of operations for each device. The unit samples the optimal action vector from this probability distribution. This action vector contains continuous or discrete values ​​representing changes in air conditioning setpoint temperature or shifts in workload target nodes. The unit converts this action vector into specific control commands. The unit sends these control commands to the actuators or management APIs of each device. The system observes the environmental changes after control execution. The system calculates a reward value based on the reduction in power consumption and the achievement of service level agreements. The system uses this reward value to update the weights of the policy network. Through this process, the system maintains optimal operation in the face of dynamically changing external environments. The system simultaneously maximizes energy efficiency and performance amidst complex trade-offs. This system solves multivariate optimization problems that are impossible for human operators to calculate in real time.

[0070] Furthermore, the maintenance planning department inputs the operating status, anomaly history, resource usage trends, fault precursor data, equipment lifespan data, and external maintenance information of each device into the generative AI. This enables the prioritization of preventative maintenance and inspections, automatic generation of maintenance schedules, equipment lifespan prediction, notification to maintenance personnel, component replacement plans, and automatic generation of response procedures in the event of a fault. For example, if server B's CPU or memory is under high load, it is set to "AI recommends preventative maintenance for server B"; if air conditioning device D has a high temperature, it is set to "AI recommends checking air conditioning device D"; if power supply device E has high power consumption, it is set to "AI recommends checking power supply device E," and so on, automatically generating specific maintenance plans for each device. For example, if storage device C's I / O latency is increasing, "disk replacement for storage device C is recommended"; if network device B experiences frequent abnormal traffic, "firmware update for network device B is recommended"; if security device F's alarm frequency is increasing, "sensor check for security device F" is recommended, and so on, automatically formulating detailed maintenance plans. The maintenance plan is automatically distributed to the terminals of managers or maintenance personnel, achieving high efficiency in maintenance operations and preventing potential failures. Specifically, this maintenance planning department executes a prediction engine that combines a lifespan analysis model and a recurrent neural network. The department extracts equipment uptime or past failure history as time-series data. This time-series data is then input into the recurrent neural network. The recurrent neural network learns temporal dependencies and generates hidden state vectors. These hidden state vectors are then input into the lifespan analysis model. The lifespan analysis model calculates the risk function for each piece of equipment. It outputs the predicted remaining useful life as a continuous value. The maintenance planning department identifies equipment whose predicted value is below a pre-set safety threshold. The identifier and predicted data for these identified equipment are input into a large-scale language model. This large-scale language model outputs a maintenance plan text containing a list of required replacement parts or specific work steps. The system converts this maintenance plan text into structured data. The system automatically registers new work orders in the maintenance management database. The system automatically orders the required parts by calling the parts ordering system's API. This process minimizes unplanned system downtime. It also optimizes component inventory management costs. Furthermore, it establishes standardized maintenance practices that do not rely on the tacit knowledge of skilled technicians.

[0071] Furthermore, the application of generative AI is at the core of this invention. For example, in the learning of the anomaly detection model, various data such as past fault logs, usage history, security incident information, external threat intelligence, business calendars, event information, equipment structure information, user action history, and external environmental data (weather, disaster information, social events, etc.) are used. By continuously updating the model, it can flexibly respond to environmental changes or new threats. For example, in the event of an unknown attack method, external threat intelligence information can be automatically obtained to strengthen the AI ​​model. Moreover, by utilizing natural language generation capabilities, easily understandable notifications or reports, suggestions, fault response steps, explanations of security incidents, explanations of resource optimization, and simulation results of cost reduction effects can be automatically generated for managers, enabling even those without professional knowledge to easily grasp the situation or make decisions. Specifically, this system uses an advanced data extension pipeline based on generative adversarial networks. This system extracts normal log data or indicator data as a multidimensional tensor. This system adds Gaussian noise to this multidimensional tensor. This system extracts text-tagged sequences from external threat intelligence as conditional vectors and inputs them into a generator. The generator produces synthetic anomalous data that mimics unknown attack patterns or extreme load conditions. This synthetic anomalous data, along with actual observation data, is then input into a discriminator. The discriminator outputs a probability value indicating whether the input data is real or synthetic. The system enables the generator and discriminator to perform adversarial learning. The system updates the weight parameters to minimize cross-entropy error. The system uses the learned model to relearn the classifier. The relearned classifier is then deployed to the inference environment. Through this process, the system fundamentally solves the problem of imbalanced learning data. The system significantly improves generalization performance against previously unobserved zero-day attacks or unknown faults. The system prevents model obsolescence, providing a self-evolving defense mechanism that is always adapted to the latest threat environment.

[0072] For example, the server monitoring department automatically diagnoses that "the memory usage of server G has increased sharply in the past 24 hours, and since it is consistent with past failure patterns, a leak in process H is suspected." The equipment optimization department automatically generates optimization suggestions such as "due to the low utilization of virtual server I, automatic shutdown at night is recommended," "due to the reduced cooling efficiency of air conditioning equipment J, filter cleaning is recommended," and "due to the peak power consumption of power supply equipment K, peak shaving operation is automatically performed." The maintenance planning department automatically formulates recommendations such as "due to the increased I / O latency of storage device L, disk replacement is recommended." Preventive maintenance plans for each device include "Recommended firmware update for network device M" and "Recommended sensor check for security device N". Specifically, this system possesses a graph-based mediation engine that comprehensively processes diagnostic results or suggestions generated across multiple modules. This mediation engine inputs text data output from each module into a natural language processing model. This natural language processing model converts the text data into a high-dimensional group of embedding vectors. This mediation engine constructs a directed acyclic graph (DAG) with this group of embedding vectors as nodes. This mediation engine calculates the edge weights based on the dependencies or resource contention between nodes. This mediation engine performs topological sorting on this DAG. This mediation engine determines the execution order of action plans that do not conflict as a whole within the system. This mediation engine sends a command queue to the task scheduler according to this execution order. This task scheduler executes each command sequentially. This system issues a restart command for process H. This system calls the shutdown API of virtual server I. This system sends a peak-shaving signal to the inverter control unit of power supply device K. Through this processing, this system safely mediates competing control commands issued by multiple autonomous modules. This system effectively performs complex automated operations while maintaining overall system consistency. It completely prevents unexpected system crashes during operation.

[0073] Furthermore, for example, in the case of managing multiple sites within a data center, the system collects equipment data from each site in a unified manner via the cloud. AI then analyzes the overall resource status and failure trends horizontally, thereby achieving resource sharing among sites, minimizing the risk of failure ripple effects, and overall optimization. For instance, if site A's server cluster is under high load while site B has surplus resources, AI can propose workload relocation or automatic cloud resource allocation. Similarly, if site C experiences an air conditioning malfunction, AI can automatically generate the optimal cooling strategy or failure response steps by referencing the cooling capacity of other sites or external temperature data. AI can also analyze the power consumption data of all sites to propose peak shaving, renewable energy utilization, and power cost optimization. Specifically, this system uses a federated learning architecture to perform model synchronization and insight sharing among multiple sites. Local inference nodes configured at each site use the site's equipment data to learn local models. Each local inference node calculates the learned weight update vector. Each local inference node encrypts this weight update vector and sends it to the central cloud integrated server. The cloud integrated server aggregates the multiple weight update vectors received. This cloud-based integrated server updates the weight parameters of the global model using a federated averaging algorithm. The updated global model is then redistributed to each site. The system uses this global model for resource optimization calculations between sites. The system input is a state matrix representing the overload state of site A and the remaining state of site B. The system outputs an optimal scheduling vector that considers network latency between sites for workload transfer. Based on this scheduling vector, the system performs real-time virtual machine migration. This process protects data privacy by preventing the transmission of raw data from each site to external sources. The system significantly reduces communication bandwidth between sites. This system constructs an AI model with advanced generalization performance that integrates operational data from all sites.

[0074] Furthermore, for example, to enhance data center security, AI comprehensively analyzes access logs or surveillance camera footage, entry and exit history, authentication history, and external threat information to detect early signs of internal misconduct or external attacks. It then performs actions such as isolating relevant users or terminals, automatically changing access permissions, providing immediate notifications to relevant personnel, and automatically generating event reports. For instance, if someone enters or exits the room at night via a route different from the usual one, AI immediately issues a warning, automatically extracts and analyzes surveillance camera footage, and reports to administrators. Similarly, in the event of a detected external DDoS attack, AI automatically changes network device settings or blocks traffic, visualizing the attack path or scope of impact. Specifically, this system employs a comprehensive security monitoring engine using multimodal neural networks. This monitoring engine converts image frames acquired from surveillance cameras into 3D tensors. It converts entry and exit logs or authentication history into text embedding vectors. The engine inputs the image tensors into a convolutional neural network and extracts image feature vectors. It inputs the text embedding vectors into a Transformer encoder and extracts text feature vectors. Finally, the engine calculates the cosine similarity score between these two feature vectors. This monitoring engine identifies an anomaly when the similarity score is below a threshold, i.e., when there is a contradiction between the image and the log. The engine outputs the bounding box coordinates of the image area where abnormal activity was detected. The system combines this coordinate information with log data to generate an event report. The system sends an immediate locking command to the electronic lock in the corresponding area. The system executes an API call to invalidate the network access permissions of the corresponding user. Through this process, the system achieves comprehensive defense that eliminates the boundaries between physical and network security. This system effectively exposes subtle internal misconduct that cannot be detected through a single data source. This system significantly reduces the false alarm rate and prevents the waste of security resources.

[0075] Thus, in this embodiment of the invention, the server monitoring department, equipment optimization department, and maintenance planning department work together with generative AI as the core, comprehensively addressing diverse and complex issues in data center operations, including overall data center monitoring, anomaly detection, fault precursor analysis, resource optimization, energy management, security enhancement, preventative maintenance planning, automated fault response, cost reduction, business continuity improvement, automatic inheritance of proprietary technologies, and flexible response to changes in the external environment. Specifically, this system executes an automatic update mechanism for the AI ​​model through a pipeline of continuous integration and continuous deployment. This system continuously measures the difference between the inference results and the actual system state. This system quantifies this difference as an error vector. This system triggers a relearning signal when the moving average of this error vector exceeds an acceptable threshold. This system begins learning a new model in the background using the latest collected data. This system assigns a version label to the newly learned model. This system uses shadow deployment to connect the new model to the production environment's data stream in parallel. This system compares and evaluates the inference accuracy of the old and new models in real time. When the system determines that the performance improvement of the new model is statistically significant, it switches traffic routing to the new model. This process completely eliminates manual model update tasks performed by human engineers. The system continuously and autonomously adapts to changes in the data center operating environment. It significantly reduces long-term operating costs. The system consistently maintains a high-performance inference engine, ensuring its self-evolution.

[0076] (System Composition) The system described in this embodiment includes a server monitoring unit, an equipment optimization unit, a maintenance planning unit, a data collection unit, an AI learning and inference unit, a user interface unit, and a notification and report generation unit. The server monitoring unit collects real-time data on the operating status, CPU utilization, memory utilization, disk I / O, network traffic, temperature, humidity, power consumption, fault occurrence information, event logs, system logs, application logs, access logs, and unauthorized intrusion detection information from various infrastructure devices within the data center, such as physical servers, virtual servers, storage devices, network devices, power supply equipment, air conditioning equipment, and security equipment. For example, it combines multiple methods such as SNMP or Syslog, REST API, agent software, cloud monitoring services, and IoT sensors to acquire information. This allows for real-time monitoring of changes in the status of all devices, such as when server A's CPU utilization exceeds 90%, network device B's traffic reaches 95%, storage device C's I / O latency exceeds a threshold, air conditioning device D's temperature exceeds 30 degrees Celsius, power supply device E's power consumption exceeds 90% of its rated capacity, and unauthorized intrusion detection system F detects anomalies. The server monitoring department also performs preprocessing or normalization, outlier correction, and time-series data shaping for inputting this data into the generative AI. For example, it generates prompts such as "Analyze the time-series data of CPU, memory, and disk usage of the server cluster, and describe the anomaly trend or symptoms of failure in natural language," "Extract patterns that differ from normal times from the network device traffic logs and infer the cause," and "The CPU usage of the virtual server has exceeded 90% since 13:00 today. Compare it with past failure patterns and output the cause and recommended response strategies," instructing the AI ​​to perform analysis. Specifically, the data collection department and the server monitoring department utilize a distributed message queue stream processing engine. The data collection department asynchronously receives millions of raw indicator data points per second. The data collection department divides this raw data into time windows. The data collection department aggregates the data within each time window and generates a feature tensor. The server monitoring department applies Z-score normalization to this feature tensor. The server monitoring department uses a linear interpolation algorithm to fill in missing values. The server monitoring department inputs the preprocessed, clean tensor data into a Transformer-based anomaly detection model. This anomaly detection model uses a multi-head attention mechanism to calculate the correlation between various indicators. The model outputs an array of anomaly scores. The server monitoring unit extracts data points whose anomaly scores exceed a threshold. This extracted data point is then inserted into a natural language prompt word template. The prompt word is then sent to the API endpoint of the large-scale language model. Through this process, the system establishes a high-throughput, low-latency data processing pipeline. The system also prevents processing delays or data loss for sudden traffic spikes.This system fully ensures scalability in large-scale data centers.

[0077] The Equipment Optimization Department inputs usage data from server clusters, network equipment, air conditioning equipment, power supply equipment, storage devices, security equipment, and other resources, along with historical data and external environmental data (external temperature, electricity costs, demand forecasts, etc.), into the generative AI to automatically propose and execute optimal resource allocation and utilization modes. For example, when the CPU load of the server cluster is high, the AI ​​suggests automatic workload distribution or adding virtual servers; conversely, during periods of low utilization such as nighttime or rest days, it recommends automatic server downsizing or switching to power-saving modes. When the air conditioning equipment operates at high temperatures, the AI ​​suggests enhanced cooling or changing the air conditioning equipment's operating mode, automatically generating the optimal cooling strategy based on changes in external temperature or humidity. When power consumption of power supply equipment is high, the AI ​​suggests switching some servers to power-saving modes or peak-shaving operations to reduce electricity costs. When network equipment experiences traffic congestion, the AI ​​suggests optimizing traffic paths, implementing QoS control, and changing the scheduling of backup operations.

[0078] When storage capacity is limited, the AI ​​proposes automatic deletion of unnecessary data or storage expansion, data compression, and automatic migration to cloud storage. The Equipment Optimization Department generates optimization instructions for the AI, such as "Based on the resource utilization history and business calendar of the past month, predict load changes for the next week and propose resource increase / decrease plans using natural language," "Based on the temperature trends of air conditioning equipment and external temperature data, propose cooling efficiency improvement strategies," "Based on the network traffic variation patterns of the past week, propose peak-hour countermeasures," and "Based on the utilization rate and fault history of power equipment, predict the next inspection period." Specifically, this Equipment Optimization Department executes a hybrid engine that integrates a mathematical optimization solver and a neural network for solving constrained nonlinear optimization problems. The Equipment Optimization Department formulates the power consumption model for each device. The Equipment Optimization Department defines the performance requirements based on the Service Level Agreement as a constraint matrix. The Equipment Optimization Department inputs this constraint matrix and the current environmental state vector into the neural network. The neural network outputs an initial solution vector that minimizes the total operating cost as the objective function. The Equipment Optimization Department sets this initial solution vector as the initial value for the mathematical optimization solver. This mathematical optimization solver uses gradient descent to explore a rigorous optimal solution vector. This optimal solution vector is a set of specific setting values ​​for each device. The device optimization unit inputs this optimal solution vector into a large-scale language model. This large-scale language model generates natural language suggestion text describing the reasons for the setting change and the expected effect. While displaying this suggestion text to the administrator, the system executes an API call based on the setting value vector to simultaneously change the settings. Through this process, the system derives optimal solutions under complex constraints quickly and accurately. This system completely prevents system failures caused by operational errors. This system makes the judgment criteria of the easily black-boxed AI transparent, gaining the trust of the administrator.

[0079] The maintenance planning department inputs the operating status, anomaly history, resource usage trends, fault precursor data, equipment lifespan data, and external maintenance information of each device into the generative AI. This enables the prioritization of preventative maintenance and inspections, automatic generation of maintenance schedules, equipment lifespan prediction, notification to maintenance personnel, component replacement plans, and automatic generation of response procedures in the event of a fault. For example, if server B's CPU or memory is under high load, it is set to "AI recommends preventative maintenance for server B"; if air conditioning device D has a high temperature, it is set to "AI recommends checking air conditioning device D"; if power supply device E consumes a lot of power, it is set to "AI recommends checking power supply device E," and so on, automatically generating specific maintenance plans for each device. If storage device C's I / O latency tends to increase, it is set to "Recommend disk replacement for storage device C"; if network device B experiences frequent abnormal traffic, it is set to "Recommend firmware update for network device B"; if security device F's alarm frequency increases, it is set to "Recommend sensor check for security device F," and so on, automatically creating detailed maintenance plans. The maintenance planning department generates data such as: "Analyze the failure history and resource usage trends of the server cluster, and output the priority of the next preventive maintenance in natural language," "Based on the temperature anomalies and filter cleaning history of the air conditioning equipment, propose the optimal inspection period," and "Analyze the increase in I / O latency and disk lifespan data of storage devices, and output the recommended replacement period." The system provides maintenance plan instructions to the AI, including prompts such as "Automatically generate maintenance plans based on network device traffic anomalies and firmware update history." Specifically, this maintenance planning department executes a dynamic maintenance manual generation engine using a natural language processing model. The department vectorizes the target device's model number or predicted failure mode. It converts past response history text into embedded vectors. These vectors are then combined to generate a context vector. This context vector is input into a Transformer-based text generation model. The model outputs a sequence of labeled steps representing specific, step-by-step operations. The system analyzes this sequence to generate structured step-by-step data containing necessary tools and safety verifications. This step-by-step data is streamed to wearable devices worn by maintenance personnel in the field. The system tracks the maintenance personnel's progress in real time using voice or image recognition. It immediately issues warnings upon detecting delays or errors in procedures. This process homogenizes and standardizes the quality of maintenance work. It significantly reduces operation time. The system provides an environment where even inexperienced operators can complete maintenance tasks with the same precision as experienced operators.

[0080] The Data Collection Department collects necessary data in real-time or periodically from various information processing devices and network equipment, cloud services, business applications, external databases, threat intelligence services, etc., and performs data preprocessing, normalization, missing value imputation, outlier detection, format conversion, time series shaping, metadata assignment, etc., before providing it to the AI ​​Learning & Inference Department and other departments. This includes data from various sources such as SNMP trap or Syslog message reception, cloud resource information acquisition via API, terminal information collection via agent software, automatic acquisition of external threat intelligence, and import of business calendar or event information. Specifically, the Data Collection Department executes a feature engineering pipeline using an automated machine learning framework. The department expands the raw multidimensional data arrays collected from multiple sources in memory. It applies statistical filtering to this data array and removes outliers. It applies a K-nearest neighbor-based imputation algorithm to missing values. It converts categorical data into one-hot vectors. It normalizes continuous value data using minimum-maximum scaling. These processes generate clean tensor data. The data collection unit inputs the tensor data into the feature selection algorithm. This algorithm calculates the variable importance of the random forest. It also removes redundant dimensions that do not contribute to inference and performs dimensionality reduction. The data collection unit outputs the optimized feature tensor to a shared memory region. The system then transmits data at high speed to the AI ​​learning and inference unit via this shared memory region. Through this processing, the system maximizes the inference accuracy of the subsequent AI model. This system suppresses unnecessary consumption of computational resources and improves processing efficiency. This system fully automates manual data preprocessing tasks previously performed by data scientists.

[0081] The AI ​​Learning and Inference Department uses various data provided by the Data Collection Department to perform learning and inference on anomaly detection models, threat detection models, resource optimization models, and natural language generation models. For example, it continuously updates models using past fault logs or application history, security incident information, external threat intelligence, business calendars, event information, device structure information, user action history, and external environmental data, enabling flexible responses to environmental changes or new threats. The AI ​​Learning and Inference Department receives prompts from various departments, performs analysis, inference, and natural language generation, and returns the results to each department. Specifically, this AI Learning and Inference Department controls a parallel computing cluster using multiple image processing semiconductors. It divides the large-scale learning dataset into mini-batch tensors. The department uses a data parallelization algorithm to distribute the mini-batch tensors to each computing node. Each computing node uses the allocated data to perform forward and backward propagation calculations. Each computing node calculates the gradient vector relative to the weight parameters of the loss function. The department uses a cyclic full reduction algorithm to synchronize the gradient vectors across all nodes. This AI learning and inference unit calculates the average of the synchronized gradients. It uses this average gradient to drive the optimizer and update the global weight parameters. The unit then processes the inference request using the updated model. It tokenizes the input prompts and feeds them into the model. Finally, it decodes the optimal text sequence from the output probability distribution. This process significantly reduces the learning time of massive neural networks with billions of parameters. The system guarantees millisecond-level response times for real-time inference. It leverages advanced computing power to achieve fully intelligent infrastructure management.

[0082] The user interface unit runs on the administrator's terminal, receiving and displaying in real-time alerts, threat detection results, resource optimization suggestions, execution history, fault response history, security incident reports, resource utilization predictions, cost analysis reports, system architecture diagrams, dependency diagrams, and fault impact simulation results generated on the server side. The overall system operation status is graphically displayed on the dashboard screen, and alerts are instantly communicated to administrators via pop-up notifications, email notifications, chat notifications, and push notifications to smartphones. Administrators can approve or reject server optimization suggestions, add response instructions, request detailed reports, prioritize fault responses, escalate security incidents, manually adjust resource allocation, instruct AI model relearning, and configure linkage with external systems from the terminal. Specifically, this user interface unit runs on the memory of the administrator's terminal, which has a graphics processing unit. This user interface unit receives serialized JSON format data streams sent from the server side. This data stream contains floating-point scores representing the importance of alerts, probability distribution vectors for threat detection, and multidimensional tensor data for resource optimization. This user interface unit decodes the received data stream. This user interface unit converts the decoded data into a two-dimensional pixel array. This user interface unit outputs the pixel array to the display device. This user interface unit captures input operations from the administrator. These input operations are acquired as mouse click coordinates or keyboard keystrokes. This user interface unit converts the input operation data into a specific command vector. This user interface unit sends this command vector to the server via a secure communication protocol. The server receives the command vector. The server dynamically updates the hyperparameters of the large-scale language model based on this command vector. This large-scale language model possesses a self-attention mechanism based on the Transformer architecture. Through this update process, the system improves the inference accuracy of the AI ​​model. This structure goes beyond simply displaying information; it also forms a feedback loop between the administrator and the AI ​​model. This feedback loop optimizes the model's relearning process. Through this optimization, the system achieves the technical effect of reducing computational resource consumption while improving the convergence speed of inference. This technical effect is achieved through dynamic control of gradient descent in a high-dimensional vector space, which is impossible to achieve in human mental activity. This system applies this user interface unit to the specific use case of a comprehensive monitoring console in a large-scale data center. Through this application, the system minimizes the latency of event response.

[0083] Based on the output of the AI ​​Learning and Inference Department, the Notification and Report Generation Department automatically generates alerts, detailed reports, event descriptions, explanations of resource optimization, simulation results of cost reduction effects, fault response procedures, security incident descriptions, dependency graphs, and fault impact simulation results for administrators using natural language. These are then presented to administrators via the user interface. For example, it automatically generates specific and easy-to-understand explanations such as "Server C's memory usage has increased sharply in the past 24 hours, suspected to be a leak in process D," "Port scanning of network device E was detected, and communication from this IP address was cut off," "Due to low utilization of virtual server F, automatic shutdown at night is proposed," and "Due to the high cost of cloud service G, workload migration to local H is proposed." Specifically, this Notification and Report Generation Department obtains a high-dimensional hidden state vector output from the AI ​​Learning and Inference Department. This hidden state vector is constructed as a 512-dimensional array of floating-point numbers. The Notification and Report Generation Department inputs this hidden state vector into a natural language generation model. This natural language generation model is a pre-trained Transformer network with billions of parameters. This natural language generation model processes the input hidden state vector using a decoder network. The decoder network outputs a probability distribution of words in the lexical space. The notification / report generation unit applies a beam search algorithm to this probability distribution. This beam search algorithm autoregressively generates the sequence of words with the highest probabilities. Through this generation process, the notification / report generation unit converts machine-readable log data into human-understandable natural language text. The generation unit maps the generated text into a structured report format. This report format is encoded as binary data in HTML or PDF format. The notification / report generation unit sends this binary data to the administrator terminal. In this process, the natural language generation model is fine-tuned using a large-scale corpus containing past event response history. This fine-tuning involves updating the weight parameters in a way that minimizes the cross-entropy error function. Through this structure, the system achieves context-dependent, dynamic report generation, rather than simply a combination of fixed sentences. This dynamic generation effectively reduces the cognitive load on administrators and improves the speed of fault response decisions. This technical effect is achieved through a nonlinear transformation mechanism that maps complex system states to a low-dimensional natural language space. This system applies the notification and report generation function to the specific use case of automated application services for cloud infrastructure. Through this application, the system significantly reduces application costs.

[0084] Specific examples of the prompts required for the generative AI to read when implementing this invention include: "Analyze the time-series data of CPU, memory, and disk usage of the server cluster, and describe abnormal trends or signs of failure in natural language," "Analyze access logs and authentication history from 0:00 today to the present, extract access patterns or suspicious behaviors that are different from the usual, and assess the threat level," "Based on the resource utilization history and business calendar of the past month, predict the load changes for the next week, and propose resource increase / decrease plans in natural language," "Compare the latest ransomware attack methods with the communication logs of this system, and report whether there are similar patterns," "The CPU usage of the virtual server has exceeded 90% since 13:00 today. Compare it with past failure patterns, output the cause, and recommend a response strategy," and "Records that user B has experienced more than 100 consecutive authentication failures since 2:00 AM. Assess the possibility of a brute-force attack and output a recommended response strategy," etc. Specifically, this system does not treat these prompts as simple strings, but as sequences of tokenized integer IDs input into the generative AI. This system uses a byte-pair encoding algorithm to tokenize the prompts. This system converts each tag ID into a multi-dimensional word embedding vector. The system then adds a positional encoding vector to this word embedding vector. This addition process preserves the sequential information of the input sequence. Together with the prompt text, the system combines the time-series metrics data of the target system as a numerical tensor. For example, the system includes the CPU usage rate of the past 24 hours as a one-dimensional tensor consisting of 1440 floating-point numbers in the input. The generative AI inputs this combined input tensor into a self-attention mechanism. This self-attention mechanism performs matrix multiplication operations using the query matrix, key matrix, and value matrix. Through this operation, the generative AI extracts long-distance dependencies within the input data. As output, the generative AI generates a probability distribution of text tags representing recommended coping strategies. The system samples the tag sequence with the highest likelihood from this probability distribution. The system decodes the sampled tag sequence to generate an executable script or setting change command. The system automatically issues this command to the target server or network device. Through this structure, the system achieves a seamless transition from natural language-based instructions to specific system control commands. This conversion process enables fully automated closed-loop control that eliminates human intervention. This closed-loop control achieves the technical effect of reducing fault recovery time to milliseconds. This technical effect is achieved through a mechanism that directly connects the inferential capabilities of a large-scale language model with physical hardware control. This system applies this prompting mechanism to the specific use case of dynamic access control in zero-trust networks.

[0085] As described above, the system according to the present embodiment adopts the linkage of each unit to collect, analyze, optimize and notify various types of information, takes generative AI as the core, and fully realizes a configuration that enables unified and advanced automatic operation of the entire data center, security enhancement, resource optimization, cost reduction, business continuity improvement, rapid failure response, human risk reduction, automatic inheritance of operation know-how, and flexible response to external environment changes. Specifically, this system employs an architecture that couples a plurality of independent processing modules via a high-speed internal bus and a shared memory space. This system uses an asynchronous message passing interface between modules to exchange data. This system is equipped with a dedicated tensor processing unit cluster for hosting generative AI. This tensor processing unit cluster drives thousands of arithmetic cores in parallel. This system stores the collected massive telemetry data in a distributed file system. This system inputs the telemetry data into a real-time stream processing engine. This stream processing engine uses a sliding window algorithm to divide the data into blocks at fixed time intervals. This system sequentially supplies the blocked data to the inference pipeline of the generative AI. This generative AI performs a forward propagation operation on the input data, and extracts a latent representation vector of the system state. This system inputs the latent representation vector into a clustering algorithm, and classifies the current system state into any one of a plurality of known operation modes. Based on the classification result, this system autonomously changes the dynamic resource allocation strategy. With this configuration, this system optimizes the operation state of the entire data center from a macroscopic perspective. This optimization processing achieves overall optimization that exceeds the sum of optimizations of individual devices. This overall optimization exerts the technical effects of dramatically reducing the total power consumption of the data center and extending the mean time between failures of hardware. These technical effects are achieved by a composite mechanism of pattern recognition in a high-dimensional data space performed by generative AI and optimal policy exploration performed by a reinforcement learning agent. This system applies this integrated architecture to the specific use case of integrated management of a global cloud infrastructure spanning multiple regions. Through this application, this system maximizes the utilization efficiency of geographically dispersed resources.

[0086] >(Implementation Steps) Step 1: Data Collection and Preprocessing. In this step, diverse data is collected in real-time or periodically from all devices within the data center, including physical servers, virtual servers, storage devices, network equipment, power supply equipment, air conditioning equipment, and security equipment. This data includes CPU utilization, memory utilization, disk I / O, network traffic, temperature, humidity, power consumption, fault occurrence information, event logs, system logs, application logs, access logs, and unauthorized intrusion detection information. SNMP, Syslog, REST API, agent software, cloud monitoring services, and IoT sensors are utilized to acquire the data. Preprocessing is performed, including missing value imputation, outlier detection, normalization, format conversion, time series shaping, and metadata assignment, before being provided to the AI ​​Learning & Inference Department and other departments. Specifically, this data collection department periodically receives heartbeat signals and indicator data from agent programs configured on each device. The received data is temporarily stored in a circular buffer in an in-memory database. The data collection department reads the data from this circular buffer and feeds it into the preprocessing pipeline. This preprocessing pipeline first executes the missing value imputation module. This missing value imputation module statistically estimates and interpolates missing data points using a Kalman filter or an autoregressive moving average model. The preprocessing pipeline then executes an outlier detection module. This outlier detection module uses an isolated forest algorithm to identify statistically significant outliers and remove them as noise. The preprocessing pipeline then executes a normalization module. This normalization module standardizes the values ​​of each indicator to have zero mean and unit variance. This normalization process is essential to ensure that sensor data with different scales can be processed by the same neural network. Finally, the preprocessing pipeline executes a time series shaping module. This time series shaping module converts continuous data points into a 3D tensor with fixed-length time steps. This 3D tensor has three axes: batch size, number of time steps, and feature dimension. The data collection unit transmits this 3D tensor to the input interface of the AI ​​learning and inference unit. Through this structure, the system transforms noisy raw sensor data into a high-quality feature representation that can be processed by machine learning models. This transformation process significantly improves the inference accuracy of subsequent AI models and reduces the false detection rate. This technique achieves its effect through a mathematical transformation mechanism that filters noise components while preserving the topological structure of the data space. This system applies this preprocessing method to the specific use case of real-time anomaly detection in an edge computing environment.

[0087] Step 2: System Status Monitoring and Anomaly Detection (Utilizing Generative AI) In this step, the server monitoring unit inputs preprocessed data into the generative AI, enabling it to analyze the overall system operation status, load status, and signs of failure. Specific examples of prompts for the generative AI to read include: "Analyze the time-series data of CPU, memory, and disk usage of the server cluster, and describe the abnormal trends and signs of failure in natural language," "Extract patterns that differ from normal times from the network device traffic logs and infer the causes," and "The CPU usage of the virtual server has exceeded 90% since 13:00 today. Compare it with past failure patterns, output the causes, and recommend corresponding solutions." Based on these prompts, the AI ​​automatically detects abnormal patterns, infers the causes of failures, and generates recommended solutions. Specifically, the server monitoring unit inputs preprocessed 3D tensor data into the encoder network of the generative AI. This encoder network consists of multiple convolutional layers and long short-term memory layers. This encoder network extracts temporal and spatial features from the time-series data and generates a fixed-length context vector. This server monitoring unit combines the context vector with the embedded vector after the prompt text has been tokenized. The combined vector is then input into the decoder network of a generative AI. This decoder network employs a Transformer architecture. Based on the input vector, the decoder network autoregressively generates text tags representing the diagnostic results of the system state. As output, the generative AI generates a continuous value score from 0 to 1 representing the probability of an anomaly, a classification label representing the root cause of the anomaly, and natural language text representing recommended response steps. For example, this generative AI detects periodic spike patterns from the input CPU usage tensor and outputs a root cause label of "resource exhaustion caused by competition for backup processes." When the continuous value score exceeds a preset threshold, the server monitoring unit triggers an automatic repair module. This automatic repair module analyzes the generated recommended response steps and issues a system call to lower the priority of the corresponding process. Through this structure, the system dynamically identifies complex anomaly patterns that were previously undetectable by static threshold-based monitoring. This dynamic identification achieves the technical effect of preventing system downtime and improving availability. The effectiveness of this technology stems from a nonlinear feature extraction mechanism based on a deep learning model for high-dimensional time series data. This system applies this anomaly detection mechanism to the specific use case of monitoring a financial institution's critical transaction system.

[0088] Step 3: Equipment Optimization and Utilization Recommendations (Leveraging Generative AI) In this step, the Equipment Optimization Department inputs resource utilization status, business calendar, event information, external temperature, electricity costs, demand forecasts, and external system linkage status into the generative AI to automatically generate optimal resource allocation and utilization recommendations. Specific examples of prompts for the generative AI include: "Based on the resource utilization history and business calendar of the past month, predict load changes for the next week and propose resource increase / decrease plans using natural language," "Based on the temperature trends of air conditioning equipment and external temperature data, propose cooling efficiency improvement strategies," "Based on the network traffic variation patterns of the past week, propose countermeasures for future peak periods," and "Based on the utilization rate and fault history of power supply equipment, predict the next inspection period," etc. Based on these prompts, the AI ​​automatically generates dynamic scaling plans, resource reduction schemes, air conditioning operation optimization, electricity cost reduction strategies, network path optimization, and storage expansion schemes. Specifically, the Equipment Optimization Department integrates time-series data on resource utilization status, event markers from the business calendar, and numerical data on external temperature to construct a multivariate time-series tensor. The device optimization unit inputs this multivariate time series tensor into the generative AI prediction model. This prediction model has a hybrid architecture combining graph neural networks and self-attention mechanisms. The model represents the physical and logical dependencies between devices as an adjacency matrix and performs graph convolution operations. It predicts the resource requirements of each device at multiple future time steps and outputs a tensor of predicted values. The device optimization unit inputs this tensor of predicted values ​​as the environmental state of the reinforcement learning agent. This reinforcement learning agent learns using a policy gradient method based on Markov decision processes. The agent outputs the optimal action vector to maximize the reward function, aiming to minimize power consumption and maximize system performance. This action vector includes the ID of the migration target node for each virtual machine, the increase or decrease of the set temperature of the air conditioning equipment, and the bandwidth limit of the network switch. The device optimization unit converts this action vector into specific control commands, which are applied to each device via the orchestration engine. Through this structure, the system achieves data-driven device control that does not rely on human experience rules. This data-driven control optimizes the overall energy efficiency of the data center and reduces operating costs. The effectiveness of this technology is achieved through a mechanism that combines spatial dependency modeling based on graph neural networks with long-term reward optimization based on reinforcement learning. This system applies this optimization mechanism to a specific use case: a green data center integrated with a district heating and cooling system in a smart city.

[0089] Step 4: Maintenance Planning and Preventive Maintenance (Utilizing Generative AI) In this step, the maintenance planning department inputs the operating status of each device, anomaly history, resource usage trends, fault precursor data, equipment lifespan data, and external maintenance information into the generative AI. This enables the prioritization of preventive maintenance and inspections, automatic generation of maintenance schedules, equipment lifespan prediction, notification to maintenance personnel, component replacement plans, and automatic generation of response procedures in case of faults. Specific examples of prompts for the generative AI include: "Analyze the fault history and resource usage trends of the server cluster and output the priority of the next preventive maintenance in natural language," "Based on temperature anomalies and filter cleaning history of air conditioning equipment, propose the optimal inspection period," "Analyze I / O latency increases and disk lifespan data of storage devices and output recommended replacement periods," and "Automatically generate maintenance plans based on traffic anomalies and firmware update history of network devices." Based on these prompts, the AI ​​automatically generates preventive maintenance plans, inspection schedules, component replacement periods, and fault response procedures for each device. Specifically, this maintenance planning department constructs a multi-dimensional feature vector containing the operating time, temperature cycle, vibration data, and past fault history of each device. This maintenance planning department inputs the feature vector into a generative AI-based lifespan analysis model. This lifespan analysis model is a parameterized deep learning network that assumes a Weibull distribution. Based on the input feature vector, this lifespan analysis model predicts the remaining useful life of each device. As output, this lifespan analysis model generates curve data representing the probability of failure for each device within a specific period, representing a risk function. This maintenance planning department analyzes the curve data of this risk function to determine the date and time when the failure probability exceeds an acceptable threshold. This maintenance planning department then inputs the determined date and time, along with maintenance personnel scheduling and replacement parts inventory data, as constraints into a mixed-integer linear programming solver. This solver calculates the optimal maintenance schedule that minimizes the total cost of maintenance operations while avoiding system downtime. This maintenance planning department inputs the calculated schedule into the generative AI's language model, enabling it to generate specific work instructions for maintenance personnel using natural language. These work instructions include the part numbers of the replacement objects, the required tools, and safety precautions. This maintenance planning department automatically sends these work instructions to the maintenance personnel's mobile terminals. This system achieves a paradigm shift from reactive to predictive maintenance. This predictive maintenance effectively prevents unexpected system downtime and optimizes component inventory management costs. These benefits stem from a combined mechanism of high-precision lifespan prediction based on deep learning and scheduling based on mathematical optimization algorithms. This system applies this preventive maintenance mechanism to the specific use case of fleet management for industrial robot swarms in large-scale manufacturing.

[0090] Step 5: Notification / Report Generation and Management Interface Integration. In this step, based on the output of the AI ​​Learning and Inference Department, the Notification / Report Generation Department automatically generates alert notifications, detailed reports, event descriptions, explanations of resource optimization, simulation results of cost reduction effects, fault response steps, descriptions of security incidents, dependency graphs, and simulation results of fault impact for managers using natural language. These are then displayed to the management terminal in real time via the user interface. Managers can use the terminal to approve or reject optimization suggestions, add response instructions, request detailed reports, prioritize fault responses, escalate security incidents, manually adjust resource allocation, instruct the AI ​​model to relearn, and set up integration with external systems, enabling two-way interaction. Specifically, the Notification / Report Generation Department obtains the probability tensor of anomaly detection and optimization action vectors output from the AI ​​Learning and Inference Department. This data is then input into a hybrid pipeline of a template-based rule engine and a large-scale language model. This hybrid pipeline evaluates the importance of the data and immediately generates short alert text in cases of high urgency. This hybrid pipeline generates lengthy reports with detailed context in low-urgency scenarios. The notification / report generation unit, along with the generated text data, sends data points to the user interface unit to depict a time-series graph representing the system's state transitions. This user interface unit is installed as a single-page application running on a web browser. Using the received data points, the user interface unit renders dynamic charts on canvas elements. When an administrator clicks on a specific data point on the chart, the user interface unit sends an API call to the server requesting a snapshot of the system at that moment. The server retrieves the requested snapshot data, inputs it into the generative AI to perform detailed causal analysis, and returns the analysis results to the user interface unit. The user interface unit packages the administrator's input approval commands or parameter adjustment commands as a JSON payload and sends it to the server. The server analyzes this payload and issues control commands for the target device. Through this structure, the system builds a seamless "human-in-the-loop" system that integrates the autonomous inference of AI with professional human judgment. This integration serves to prevent the black box effect of full automation and ensures the transparency and controllability of the system. This technical effect is achieved through a real-time state synchronization mechanism using an asynchronous communication protocol. This system applies this interface linkage mechanism to the specific use case of a security operations center for critical infrastructure.

[0091] (specific use case) For example, imagine a large-scale infrastructure environment in a data center where multiple physical and virtual servers coexist, along with network equipment, storage devices, power supplies, air conditioning, and security equipment. In this environment, a server monitoring unit collects real-time data on each server's CPU utilization, memory utilization, disk I / O, network traffic, temperature, fault occurrence information, event logs, system logs, and application logs. For instance, by providing a generative AI with prompts such as "Analyze the time-series data of the server cluster's CPU, memory, and disk utilization, and describe the abnormal trends and fault symptoms in natural language," the AI ​​can automatically generate diagnoses such as "Server A's CPU utilization has averaged over 90% in the past 24 hours, presumably due to resource contention caused by a backup job configuration error." Specifically, this server monitoring unit obtains hardware-level sensor data from the baseboard management controllers of each physical server via the IPMI protocol. It also obtains data on the resource allocation and consumption status of each virtual machine via the hypervisor's API. This server monitoring unit standardizes this heterogeneous data into a common data model, constructing a multi-dimensional time-series tensor synchronized with timestamps. This multidimensional time series tensor is, for example, represented as a massive matrix containing 1000 servers × 50 features × data points at a 1-minute granularity over the past 24 hours. The server monitoring unit inputs this multidimensional time series tensor into the Transformer encoder of the generative AI. This Transformer encoder uses a self-attention mechanism to calculate the hidden correlation between CPU spikes on a specific server and disk I / O latency on another server. The generative AI analyzes the weight matrix of this correlation to determine that the root cause of the anomaly is lock contention caused by concurrent access to network shared storage. The generative AI outputs the determined cause as a diagnostic report in natural language. This diagnostic report includes the specific process ID that caused the anomaly, a list of affected virtual machines, and recommended storage I / O bandwidth limits. The server monitoring unit pushes this diagnostic report to the administrator's dashboard. Through this structure, the system can detect early, complex cascading failures that cannot be detected by threshold monitoring of a single indicator, spanning the entire system. This early detection serves to prevent the development of large-scale failures and ensure compliance with service level agreements. The effectiveness of this technology stems from global context modeling based on the Transformer architecture and cross-modal feature extraction mechanisms for heterogeneous data. This system applies this diagnostic tool to the specific use case of monitoring a multi-tenant environment provided by a public cloud provider.

[0092] Furthermore, the Equipment Optimization Department provides prompts to the generative AI, such as "Based on the resource utilization history and business calendar of the past month, predict the load changes for the next week and propose resource increase / decrease plans in natural language." The AI ​​automatically generates optimization suggestions such as "Since the average CPU and memory utilization of the virtual server cluster is predicted to exceed 80% in the last three days of the month, it is recommended to add two virtual servers and automatically expand storage capacity. Due to the reduced utilization at night, resource reduction is automatically implemented." Furthermore, regarding air conditioning equipment, prompts are given to "Based on the temperature changes of the air conditioning equipment and external temperature data, propose strategies to improve cooling efficiency." The AI ​​outputs specific application suggestions such as "Since the cooling efficiency of air conditioning equipment D is reduced, filter cleaning and changes to the operating mode are recommended." Specifically, the Equipment Optimization Department extracts the resource utilization history of the past month as a time series numerical vector. The Equipment Optimization Department converts the business calendar information into one-hot encoded classification vectors. The Equipment Optimization Department combines these vectors and inputs them into the generative AI's time series prediction model. This time series prediction model is an ensemble learning model combining an autoregressive integral moving average model and a long short-term memory network. This time series forecasting model learns by separating seasonality, trend, and residual components from the input data. It outputs CPU and memory demand forecasts for each time period of the next week as floating-point tensors. The Equipment Optimization Department inputs these demand forecast tensors into the Resource Allocation Engine. 30 minutes before the predicted demand peak, the Resource Allocation Engine issues an API call to automatically start the required number of virtual machine instances. During the nighttime period when demand decreases, the Resource Allocation Engine identifies low-utilization virtual machines and executes scripts to safely shut them down. Furthermore, the Equipment Optimization Department integrates temperature sensor data from the air conditioning equipment and external temperature data obtained from an external meteorological data API, inputting it into the thermal fluid simulation model. This thermal fluid simulation model calculates the temperature distribution within the data center as 3D voxel data. The Equipment Optimization Department inputs this voxel data into a generative AI, which calculates the optimal air conditioning settings to maximize cooling efficiency. To eliminate hotspots around specific racks, the generative AI outputs control commands to increase the speed of air conditioning fans in that area. Through this structure, the system comprehensively controls IT resources and facility resources. This integrated control system dramatically improves power efficiency and minimizes operating costs. This effect is achieved through a linkage mechanism that integrates multimodal predictive modeling and physical simulation of heterogeneous domain data. This system applies this optimization mechanism to the specific use case of autonomous operation in an edge data center.

[0093] In the maintenance planning department, for example, when the generative AI is given prompts such as "Analyze the failure history and resource usage trends of the server cluster, and output the priority of the next preventive maintenance in natural language," or "Analyze the increase in I / O latency and disk lifespan data of storage devices, and output the recommended replacement period," the AI ​​automatically generates maintenance plans such as "Due to the persistently high memory usage of server B, which is consistent with past failure patterns, preventive maintenance should be prioritized," and "The I / O latency of storage device C shows an increasing trend; based on disk lifespan data, it is recommended to replace it within 2 weeks." Specifically, this maintenance planning department collects the frequency distribution of error codes extracted from the server cluster's system logs, as well as the physical degradation indicators of storage obtained from SMART attributes. This maintenance planning department standardizes this data and calculates a multi-dimensional health score vector representing the health status of each component. This maintenance planning department inputs this health score vector into the anomaly detection autoencoder of the generative AI. This autoencoder is pre-learned using only data from normal operation. This autoencoder compresses the input health score vector into a low-dimensional latent space and restores it to its original dimensions. This maintenance planning department calculates the reconstruction error between the input vector and the restored vector. If the reconstruction error exceeds a specified threshold, the maintenance planning department determines that the corresponding component has entered an unknown degradation mode. The department uses cosine similarity to compare this determination with a knowledge base that has vectorized past failure cases. Through this comparison, the department identifies the past failure case most similar to the current degradation mode. The department inputs the solution steps for the identified failure case into a generative AI language model, generating a maintenance plan text with adjusted parameters suitable for the current system environment. This maintenance plan text includes the physical slot number of the disk to be replaced, the RAID rebuild command for data migration, and the scheduled date and time of the job. The department registers this maintenance plan text in the maintenance management database and automatically issues the relevant work order. Through this structure, the system achieves state baseline preservation based on actual degradation state, rather than simply replacing components based on lifespan. This state baseline preservation effectively prevents excessive component replacement while avoiding fatal system failures. This technical effect is achieved through unsupervised anomaly detection based on autoencoders and a similar case extraction mechanism based on vector retrieval. This system applies this maintenance planning organization to the specific use case of availability management for large-scale storage area networks.

[0094] Furthermore, regarding network devices, the AI ​​provides suggestions such as "propose countermeasures for future peak periods based on the network traffic variation patterns over the past week," and "since network device B's traffic exceeds 95% during a specific time period, it is recommended to change the scheduling of backup operations and optimize traffic paths." Specifically, the device optimization unit obtains sampled packet header data from the network switch's sFlow or NetFlow protocol. This sampled data is analyzed to construct a multidimensional tensor of the traffic flow, including the source IP, destination IP, port number, and protocol type. This multidimensional tensor is then input into the generative AI's graph convolutional network. This graph convolutional network models the network topology as a graph structure of nodes and edges. It learns the temporal variations of traffic at each edge and predicts the probability of future traffic congestion. The generative AI calculates the optimal routing path to avoid predicted congestion points. This calculation is performed using Dijkstra's algorithm or a reinforcement learning-based path exploration algorithm. The generative AI generates BGP or OSPF routing table update commands to implement the calculated optimal path. Furthermore, this generative AI identifies the backup jobs that account for the majority of traffic and generates suggested text to shift the job execution schedule to a time period with sufficient network bandwidth. The device optimization department sends this update command to the software-defined network controller, dynamically changing the network device settings. Through this structure, the system overcomes the limitations of static bandwidth allocation, achieving adaptive network control that follows dynamic changes in traffic. This adaptive control minimizes packet loss and reduces end-to-end communication latency. This effect is achieved through the integration of spatial traffic pattern recognition based on graph neural networks and programmable path control based on software-defined networks. This system applies this network optimization mechanism to the specific use case of slicing control in a 5G mobile core network.

[0095] In addition, regarding security devices, a prompt is given to "analyze access logs and authentication history from 00:00 today to the present, extract access patterns and suspicious behaviors that differ from the norm, and assess the threat level." The AI ​​automatically generates specific response strategies such as "Due to a large number of authentication failures occurring from a specific terminal late at night, and suspicious external communications observed, there is a high suspicion of brute-force attacks and malware infection. Network isolation of this terminal and temporary account suspension are recommended." Specifically, this security monitoring department collects raw log data from firewalls, intrusion detection systems, and Active Directory. This security monitoring department extracts timestamps, user IDs, source IP addresses, accessed target resources, and authentication result status codes from this log data. This security monitoring department, in conjunction with the input format of a natural language processing model, tokenizes the extracted data and converts it into sequence data. This security monitoring department inputs this sequence data into a generative AI anomaly detection Transformer model. This anomaly detection Transformer model pre-learns the behavior profiles of normal users. This anomaly detection Transformer model calculates an anomaly score indicating how much the input sequence data deviates from the normal profile. For example, this model detects a pattern of consecutive authentication failures from the same source IP address using different user IDs within a short period, assigning a high anomaly score. When this anomaly score exceeds a threshold, the generative AI classifies the attack as a brute-force attack. Based on the classification result, the generative AI generates an update command to cut off communication from that IP address to the access control list, and an API call to lock the user account's directory service. This security monitoring department sends these commands to the security orchestration, automation, and response platform for immediate execution. Through this architecture, the system can detect and cut off unknown attack methods or subtle behavioral changes caused by internal crimes that cannot be addressed by signature-based detection in real time. This real-time cutoff minimizes the risk of information leakage and protects the confidentiality of the system. This technical effect is achieved through the linkage mechanism of context-dependent action analysis using a self-attention mechanism and an automated response pipeline. This system is applied to the specific use case of defending a government agency's confidential information management system.

[0096] In this way, the interconnected systems leverage generative AI to highly automate the status monitoring, anomaly detection, fault cause estimation, resource optimization, energy management, preventative maintenance planning, security enhancement, and fault response automation of various infrastructure devices such as servers, network equipment, storage devices, air conditioning equipment, power supply equipment, and security equipment. This significantly reduces the burden on administrators while dramatically improving the overall security, efficiency, and flexibility of the data center. Specifically, this system possesses a central orchestration engine that integrates all these subsystems. This central orchestration engine aggregates the state vectors, anomaly scores, and optimization suggestions asynchronously sent from each subsystem into a global state tensor on shared memory. This central orchestration engine then inputs this global state tensor into the top-level meta-generative AI model. This meta-generative AI model evaluates the side effects of optimizing individual subsystems on other subsystems. For example, the meta-generative AI model calculates the trade-off between the power reduction effect of server centralization and the accompanying risk of localized heat buildup. Based on the concept of Pareto optimality, the meta-generative AI model determines the global control strategy that maximizes the overall utility function of the data center. This central orchestration engine decomposes the predetermined global control strategy into local parameter sets executable by each subsystem and distributes them to each unit. Each unit autonomously controls the hardware within its assigned domain based on the received parameter sets. Through this architecture, the system breaks down the limitations of isolated, individual management tools, enabling the data center to function as a giant, autonomous computer. This autonomous capability completely eliminates manual intervention by human operators, achieving a near-zero system failure rate due to operational errors. This technological effect is achieved through distributed collaborative inference and a global state synchronization mechanism using multiple layered AI models. This system applies this integrated architecture to the ultimate use case of fully autonomous operation in unmanned, dark data centers. Through this application, the system lays the foundation for next-generation IT infrastructure.

[0097] The specific processing unit 290 sends the result of the specific processing obtained in Embodiment 1 or Application Example 1 described above to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires voice representing the user's input on the result of the specific processing. The control unit 46A sends the voice data representing the user's input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0098] Data generation model 58 is what is known as generative AI (Artificial Intelligence).

[0099] One example of data generation model 58 includes ChatGPT (registered trademark) (Internet search).<URL: https: / / openai.com / blog / chatgpt> Generative AI, etc.

[0100] The data generation model 58 is obtained by performing deep learning on a neural network. A prompt containing instructions is input to the data generation model 58, along with inference data such as speech data representing speech, text data representing text, and image data representing images (e.g., data from still images or moving images). The data generation model 58 infers the input inference data based on the instructions shown in the prompt and outputs the inference result in one or more data forms, such as speech data, text data, and image data. The data generation model 58 may include, for example, text generation AI, image generation AI, and multimodal generation AI. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specific processing unit 290 performs the aforementioned specific processing while using the data generation model 58. The data generation model 58 may also be a fine-tuned model to output inference results from prompts without instructions; in this case, the data generation model 58 can output inference results from prompts without instructions. The data processing device 12, etc., includes multiple data generation models 58, including AI other than generative AI. AI other than generative AI includes, but is not limited to, linear regression, logistic regression, decision trees, random forests, support vector machines (SVM), k-means clustering, convolutional neural networks (CNN), recurrent neural networks (RNN), generative adversarial networks (GAN), or Naive Bayes. Furthermore, AI can also act as an AI agent. Additionally, when the processing described above is performed by AI, this processing may be partially or entirely performed by AI, but is not limited to this example. Moreover, processing performed by AI, including generative AI, can be replaced by rule-based processing, and vice versa.

[0101] Furthermore, the processing performed by the data processing system 10 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart device 14, but it can also be executed jointly by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart device 14. In addition, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the smart device 14 or external devices, and the smart device 14 acquires or collects information required for processing from the data processing device 12 or external devices.

[0102] In the above embodiments, examples of specific processing performed by the data processing device 12 are given, but the technology disclosed herein is not limited to this, and specific processing may also be performed by the smart device 14.

[0103] [Second Implementation] Figure 3 An example of the configuration of the data processing system 210 according to the second embodiment is shown.

[0104] like Figure 3 As shown, the data processing system 210 includes a data processing device 12 and smart glasses 214. One example of the data processing device 12 is a server.

[0105] The data processing apparatus 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" as understood in this disclosure. The computer 22 includes a processor 28, RAM 30, and memory 32. The processor 28, RAM 30, and memory 32 are connected to a bus 34. Furthermore, the database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. An example of the network 54 includes a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0106] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, RAM 48, and memory 50. The processor 46, RAM 48, and memory 50 are connected to a bus 52. Furthermore, the microphone 238, speaker 240, camera 42, and communication I / F 44 are also connected to the bus 52.

[0107] Microphone 238 receives instructions from user 20 by receiving the sounds emitted by user 20. Microphone 238 captures the sounds emitted by user 20, converts the captured sounds into speech data, and outputs it to processor 46. Speaker 240 outputs sound according to the instructions from processor 46.

[0108] Camera 42 is a small digital camera equipped with an optical system such as a lens, aperture and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, used to capture the area around user 20 (e.g., the shooting range defined by an angle of view equivalent to the field of vision of an average healthy person).

[0109] Communication I / F 44 is connected to network 54. Communication I / F 44 and 26 are responsible for the transmission and reception of various information between processor 46 and processor 28 via network 54. The transmission and reception of various information between processor 46 and processor 28 using communication I / F 44 and 26 is performed in a secure state.

[0110] Figure 4 An example of the main functions of the data processing device 12 and the smart glasses 214 is shown. Figure 4 As shown, in the data processing device 12, specific processing is performed by the processor 28. The memory 32 stores a specific processing program 56.

[0111] The specific processing program 56 is an example of a "program" as disclosed herein. The processor 28 reads the specific processing program 56 from the memory 32 and executes the read specific processing program 56 on the RAM 30. Specific processing is implemented by the processor 28 operating as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0112] The memory 32 stores a data generation model 58 and an emotion-specific model 59. The data generation model 58 and the emotion-specific model 59 are used by the specific processing unit 290. The specific processing unit 290 can use the emotion-specific model 59 to infer the user's emotions and perform specific processing based on the user's emotions. The emotion inference function using the emotion-specific model 59 (emotion-specific function) includes various inferences and predictions related to the user's emotions, but is not limited to this example. Furthermore, emotion inference and prediction also include, for example, emotion analysis (analysis).

[0113] In the smart glasses 214, the processor 46 performs the receive / output processing. The memory 50 stores the receive / output program 60. The processor 46 reads the receive / output program 60 from the memory 50 and executes the read receive / output program 60 on the RAM 48. The receive / output processing is implemented by the processor 46 operating as a control unit 46A based on the receive / output program 60 executed on the RAM 48. Furthermore, the smart glasses 214 may also have the same data generation model and emotion-specific model as the data generation model 58 and the emotion-specific model 59, and use these models to perform the same processing as the specific processing unit 290.

[0114] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. Each part of the system described below is implemented by the data processing device 12 and the smart glasses 214. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0115] (Example 1) Since the specific processing flow is the same as that in Embodiment 1 described in the first embodiment above, the description is omitted.

[0116] (Application Example 1) Since the specific processing flow is the same as that in Application Example 1 described in the first embodiment above, the description is omitted.

[0117] The specific processing unit 290 sends the result of the specific processing obtained in Embodiment 1 or Application Example 1 described above to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires voice representing the user's input on the specific processing result. The control unit 46A sends the voice data representing the user's input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0118] Furthermore, the processing performed by the aforementioned data processing system 10 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart glasses 214, but it can also be executed jointly by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart glasses 214. Additionally, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the smart glasses 214 or external devices, and the smart glasses 214 acquires or collects information required for processing from the data processing device 12 or external devices.

[0119] In the above embodiments, examples of specific processing performed by the data processing device 12 are given, but the technology disclosed herein is not limited to this, and specific processing may also be performed by the smart glasses 214.

[0120] [Third Implementation] Figure 5 An example of the configuration of the data processing system 310 according to the third embodiment is shown.

[0121] like Figure 5 As shown, the data processing system 310 includes a data processing device 12 and a head-mounted terminal 314. An example of the data processing device 12 is a server.

[0122] The data processing apparatus 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" as understood in this disclosure. The computer 22 includes a processor 28, RAM 30, and memory 32. The processor 28, RAM 30, and memory 32 are connected to a bus 34. Furthermore, the database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. An example of the network 54 includes a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0123] The head-mounted terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, RAM 48, and memory 50. The processor 46, RAM 48, and memory 50 are connected to a bus 52. Furthermore, the microphone 238, speaker 240, camera 42, display 343, and communication I / F 44 are also connected to the bus 52.

[0124] Microphone 238 receives instructions from user 20 by receiving the sounds emitted by user 20. Microphone 238 captures the sounds emitted by user 20, converts the captured sounds into speech data, and outputs it to processor 46. Speaker 240 outputs sound according to the instructions from processor 46.

[0125] Camera 42 is a small digital camera equipped with an optical system such as a lens, aperture and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, used to capture the area around user 20 (e.g., the shooting range defined by an angle of view equivalent to the field of vision of an average healthy person).

[0126] Communication I / F 44 is connected to network 54. Communication I / F 44 and 26 are responsible for the transmission and reception of various information between processor 46 and processor 28 via network 54. The transmission and reception of various information between processor 46 and processor 28 using communication I / F 44 and 26 is performed in a secure state.

[0127] Figure 6 An example of the main functions of the data processing device 12 and the head-mounted terminal 314 is shown. Figure 6 As shown, in the data processing device 12, specific processing is performed by the processor 28. The memory 32 stores a specific processing program 56.

[0128] The specific processing program 56 is an example of a "program" as disclosed herein. The processor 28 reads the specific processing program 56 from the memory 32 and executes the read specific processing program 56 on the RAM 30. Specific processing is implemented by the processor 28 operating as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0129] The memory 32 stores a data generation model 58 and an emotion-specific model 59. The data generation model 58 and the emotion-specific model 59 are used by the special processing unit 290.

[0130] In the head-mounted terminal 314, the processor 46 performs the receiving and output processing.

[0131] The memory 50 stores a receive / output program 60. The processor 46 reads the receive / output program 60 from the memory 50 and executes the read receive / output program 60 on the RAM 48. The receive / output processing is implemented by the processor 46 operating the control unit 46A based on the receive / output program 60 executed on the RAM 48.

[0132] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. Each part of the system described below is implemented by the data processing device 12 and the head-mounted terminal 314. In the following description, the data processing device 12 will be referred to as the "server" and the head-mounted terminal 314 will be referred to as the "terminal".

[0133] (Example 1) Since the specific processing flow is the same as that in Example 1 described in the first embodiment above, the description is omitted.

[0134] (Application Example 1) Since the specific processing flow is the same as that in Application Example 1 described in the first embodiment above, the description is omitted.

[0135] The specific processing unit 290 sends the result of the specific processing obtained in Embodiment 1 or Application Example 1 described above to the head-mounted terminal 314. In the head-mounted terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires voice representing the user's input on the specific processing result. The control unit 46A sends the voice data representing the user's input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0136] Furthermore, the processing performed by the aforementioned data processing system 10 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the head-mounted terminal 314, but it can also be executed jointly by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the head-mounted terminal 314. Additionally, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the head-mounted terminal 314 or external devices, and the head-mounted terminal 314 acquires or collects information required for processing from the data processing device 12 or external devices.

[0137] In the above embodiments, examples of specific processing performed by the data processing device 12 are given, but the technology disclosed herein is not limited to this, and specific processing may also be performed by the head-mounted terminal 314.

[0138] [Fourth Implementation] Figure 7 An example of the configuration of the data processing system 410 according to the fourth embodiment is shown.

[0139] like Figure 7 As shown, the data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0140] The data processing apparatus 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" as understood in this disclosure. The computer 22 includes a processor 28, RAM 30, and memory 32. The processor 28, RAM 30, and memory 32 are connected to a bus 34. Furthermore, the database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. An example of the network 54 includes a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0141] Robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control object 443. Computer 36 includes a processor 46, RAM 48, and memory 50. The processor 46, RAM 48, and memory 50 are connected to a bus 52. Furthermore, the microphone 238, speaker 240, camera 42, control object 443, and communication I / F 44 are also connected to the bus 52.

[0142] Microphone 238 receives instructions from user 20 by receiving the sounds emitted by user 20. Microphone 238 captures the sounds emitted by user 20, converts the captured sounds into speech data, and outputs it to processor 46. Speaker 240 outputs sound according to the instructions from processor 46.

[0143] Camera 42 is a small digital camera equipped with an optical system such as a lens, aperture and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, used to capture the area around user 20 (e.g., the shooting range defined by an angle of view equivalent to the field of vision of an average healthy person).

[0144] Communication I / F 44 is connected to network 54. Communication I / F 44 and 26 are responsible for the transmission and reception of various information between processor 46 and processor 28 via network 54. The transmission and reception of various information between processor 46 and processor 28 using communication I / F 44 and 26 is performed in a secure state.

[0145] The controlled object 443 includes a display device, LEDs for the eyes, and motors for driving the arms, hands, and feet. The posture and movements of the robot 414 are controlled by controlling the motors for the arms, hands, and feet. Some of the robot 414's emotions can be expressed by controlling these motors. In addition, facial expressions of the robot 414 can also be expressed by controlling the illumination state of the LEDs for the robot 414's eyes.

[0146] Figure 8 An example of the main functions of the data processing device 12 and the robot 414 is shown. For example... Figure 8 As shown, in the data processing device 12, specific processing is performed by the processor 28. The memory 32 stores a specific processing program 56.

[0147] The specific processing program 56 is an example of a "program" as disclosed herein. The processor 28 reads the specific processing program 56 from the memory 32 and executes the read specific processing program 56 on the RAM 30. Specific processing is implemented by the processor 28 operating as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0148] The memory 32 stores a data generation model 58 and an emotion-specific model 59. The data generation model 58 and the emotion-specific model 59 are used by the special processing unit 290.

[0149] In robot 414, the processor 46 performs the receive / output processing. The memory 50 stores the receive / output program 60. The processor 46 reads the receive / output program 60 from the memory 50 and executes the read receive / output program 60 on RAM 48. The receive / output processing is implemented by the processor 46 operating the control unit 46A based on the receive / output program 60 executed on RAM 48.

[0150] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. Each part of the system described below is implemented by the data processing device 12 and the robot 414. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 will be referred to as the "terminal".

[0151] (Example 1) Since the specific processing flow is the same as that in Example 1 described in the first embodiment above, the description is omitted.

[0152] (Application Example 1) Since the specific processing flow is the same as that in Application Example 1 described in the first embodiment above, the description is omitted.

[0153] The specific processing unit 290 sends the result of the specific processing obtained in Embodiment 1 or Application Example 1 described above to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the controlled object 443 to output the result of the specific processing. The microphone 238 acquires voice representing the user's input on the specific processing result. The control unit 46A sends the voice data representing the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0154] Furthermore, the processing performed by the data processing system 10 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the robot 414, but it can also be executed jointly by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the robot 414. Additionally, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the robot 414 or external devices, and the robot 414 acquires or collects information required for processing from the data processing device 12 or external devices.

[0155] In the above embodiments, examples of specific processing performed by the data processing device 12 are given, but the technology disclosed herein is not limited to this, and specific processing may also be performed by the robot 414.

[0156] Furthermore, the emotion-specific model 59, serving as an emotion engine, can determine the user's emotion based on a specific mapping. Specifically, the emotion-specific model 59 can determine the user's emotion based on an emotion graph that serves as a specific mapping (see...). Figure 9 The system determines the user's emotions. In addition, the emotion-specific model 59 can also determine the robot's emotions in the same way, and the specific processing unit 290 can also perform specific processing using the robot's emotions.

[0157] Figure 9This is a diagram representing an emotion map 400 that maps various emotions. In the emotion map 400, emotions are arranged radially from the center in concentric circles. The closer to the center of the concentric circles, the more primitive the emotion is. Further out on the concentric circles, emotions are arranged representing states or actions arising from mood. Emotion is a concept that includes both feelings and mental states. To the left of the concentric circles, emotions generated by reactions occurring in the brain are arranged roughly. To the right of the concentric circles, emotions guided by situational judgments are arranged roughly. Above and below the concentric circles, emotions generated by reactions occurring in the brain and guided by situational judgments are arranged roughly. Furthermore, the emotion of "pleasure" is arranged above the concentric circles, and the emotion of "unpleasantness" is arranged below. Thus, in the emotion map 400, various emotions are mapped according to the structure of emotion generation, while easily generated emotions are mapped nearby.

[0158] These emotions are distributed at the 3 o'clock position on the Emotion Chart 400, and usually fluctuate between peace and unease. In the right half of the Emotion Chart 400, because situational awareness is more dominant than internal feelings, it gives a sense of calm.

[0159] The inner side of the emotion diagram 400 represents the mind, and the outer side of the emotion diagram 400 represents actions. Therefore, the further you go to the outer side of the emotion diagram 400, the more the emotion can be seen (manifested in actions).

[0160] Here, human emotions are based on a balance of various factors such as posture and blood sugar levels. When these balances deviate from the ideal, it indicates unhappiness; when they approach the ideal, it indicates pleasure. In robots, cars, and motorcycles, emotions can also be created based on a balance of factors such as posture and remaining battery power. When these balances deviate from the ideal, it indicates unhappiness; when they approach the ideal, it indicates pleasure. Emotion maps can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on Speech Emotion Recognition and Brain Physiological Signal Analysis Systems for Emotion, Tokushima University, Doctoral Dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). In the left half of the emotion map, emotions belonging to the "Reaction" domain, where sensation is dominant, are arranged. Furthermore, in the right half of the emotion map, emotions belonging to the "Situation" domain, where situational cognition is dominant, are arranged.

[0161] The emotion map defines two types of emotions that promote learning. One is a negative emotion located near the middle of "repentance" or "reflection" on the situation side. That is, when the robot experiences negative emotions such as "I never want to feel this way again" or "I never want to be scolded again." The other is a positive emotion located near "desire" on the response side. That is, when the robot experiences positive feelings such as "wanting more" or "wanting to know more."

[0162] The emotion-specific model 59 feeds user input into a pre-learned neural network to obtain emotion values ​​representing each emotion shown in the emotion graph 400, and determines the user's emotion. This neural network is pre-learned based on multiple learning data sets that combine user input with emotion values ​​representing each emotion shown in the emotion graph 400. Furthermore, this neural network is learned to... Figure 10 As shown in sentiment graph 900, sentiment values ​​in nearby configurations are similar to each other. Figure 10 Examples show that multiple emotions such as "peace of mind", "stability", and "reassurance" have similar emotional values.

[0163] The above description primarily focuses on the functions of the data processing device 12 to illustrate the system disclosed herein. However, the system disclosed herein may not necessarily be implemented on a server. The system disclosed herein can be implemented as a general information processing system. For example, it can be implemented as a software program running on a personal computer, an application running on a smartphone, etc. The methods disclosed herein can be provided to users in the form of SaaS (Software as a Service).

[0164] In the above embodiments, an example of specific processing performed by a single computer 22 is given. However, the technology disclosed herein is not limited to this, and distributed processing of specific processes by multiple computers, including computer 22, is also possible. For example, the data generation model 58 may also be provided in an external device of the data processing apparatus 12, where data is generated based on input data.

[0165] In the above embodiments, an example of storing a specific processing program 56 in memory 32 is illustrated, but the technology disclosed herein is not limited thereto. For example, the specific processing program 56 may also be stored in a portable computer-readable non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 performs specific processing according to the specific processing program 56.

[0166] Alternatively, the specific processing program 56 can be stored in a storage device such as a server connected to the data processing device 12 via a network 54, and the specific processing program 56 can be downloaded and installed into the computer 22 upon request from the data processing device 12.

[0167] Furthermore, it is not necessary to store the entire specific process 56 in a storage device such as a server connected to the data processing device 12 via the network 54, nor is it necessary to store the entire specific process 56 in the memory 32; a portion of the specific process 56 may also be stored.

[0168] As a hardware resource for performing specific processing, various processors can be used. For example, a CPU can be listed as a processor; it is a general-purpose processor that functions as a hardware resource for performing specific processing by executing software, i.e., a program. Furthermore, as a processor, a dedicated circuit can be listed as a processor; it is a processor with a circuit structure specifically designed for performing specific processing, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit).

[0169] Every processor has built-in or connected memory, and every processor performs specific processes by using memory.

[0170] The hardware resources for performing a specific process can consist of one of these various processors, or a combination of two or more processors of the same or different types (e.g., a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Furthermore, the hardware resources for performing a specific process can also be a single processor.

[0171] As an example of a single processor, the first type consists of a combination of one or more CPUs and software, which functions as a hardware resource to perform specific processing. The second type uses a processor, such as a System-on-a-chip (SoC), which implements the entire system functionality, including multiple hardware resources performing specific processing, using a single IC chip. In this case, the specific processing is implemented using one or more of the aforementioned processors that serve as hardware resources.

[0172] Furthermore, as the hardware architecture of these various processors, more specifically, circuits combining semiconductor elements and other circuit components can be used. Moreover, the specific process described above is merely an example. Therefore, it goes without saying that, without departing from the main point, unnecessary steps can be removed, new steps can be added, or the processing order can be changed.

[0173] The foregoing descriptions and illustrations are detailed explanations of the parts covered by this disclosure and are merely one example of this disclosure. For instance, the descriptions of the above-described structure, function, role, and effect are just one example of the structure, function, role, and effect of the parts covered by this disclosure. Therefore, it goes without saying that, without departing from the spirit of this disclosure, unnecessary parts can be deleted, new elements can be added, or replacements can be made to the foregoing descriptions and illustrations. Furthermore, to avoid confusion and facilitate understanding of the parts covered by this disclosure, explanations of technical common sense that does not require special explanation for implementing this disclosure have been omitted from the foregoing descriptions and illustrations.

[0174] All documents, patent applications and technical standards described in this specification are incorporated herein by reference as if they were specifically and individually described as incorporated by reference.

[0175] In addition, the following notes further explain the above explanation.

[0176] (Note 1) A data center management system includes a server monitoring department, an equipment optimization department, and a maintenance planning department. The server monitoring department has the following functions: it collects real-time data on the operating status, resource utilization, fault occurrence information, temperature, power consumption, traffic, and illegal intrusion detection information from various infrastructure devices within the data center, such as multiple servers, network devices, power supply equipment, air conditioning equipment, storage devices, and security equipment; it analyzes this data using generative AI to perform anomaly detection, fault precursor analysis, early detection of resource shortages, and automatic detection of security risks; and it immediately generates alarm information and notifies the management terminal when anomalies or high loads are detected. The equipment optimization department has the following functions: it uses generative AI... The system analyzes the usage data and historical data of server clusters, network equipment, air conditioning equipment, power supply equipment, etc., and provides optimization suggestions or automatically executes them, such as server load balancing, automatic addition and reduction of virtual servers, enhanced cooling of air conditioning equipment, automatic switching to power-saving mode, network traffic path optimization, and energy cost reduction strategies. The results are then displayed to the management terminal. The maintenance planning department has the following functions: using generative AI to analyze the operating status and anomaly history of each device, resource usage trends, and fault precursor data, it automatically plans and executes the priority ranking of preventive maintenance and inspection, automatic generation of maintenance schedules, equipment life prediction, notification to maintenance personnel, etc., and displays the maintenance plan content to the management terminal.

[0177] (Note 2) The data center management system described in Appendix 1 is characterized by having the following functions: based on the operating status and anomaly detection results of various devices collected by the server monitoring department using generative AI, it automatically generates cause analysis, determines the scope of impact, and recommends response strategies when a fault occurs, and provides a detailed report to the management terminal.

[0178] (Note 3) The data center management system described in Appendix 1 is characterized by having the following functions: the equipment optimization unit uses generative AI to analyze the overall resource utilization history, energy consumption history, external environment data, and future utilization prediction data of the data center. Based on the predicted load changes, failure risks, and energy cost changes, it pre-optimizes the resource allocation and utilization mode of servers and network equipment, air conditioning equipment, power supply equipment, etc., and visually prompts the optimization results and their basis to the management terminal.

Claims

1. A system comprising a system management department, a security monitoring department, and a resource optimization department, characterized in that, The system management department has the following functions: real-time collection of the overall status and load information of the IT infrastructure, including multiple information processing devices and network equipment; analysis of the operating status of each device and whether any abnormalities have occurred using generative AI; and immediate generation of alarm information and notification to the administrator terminal when an abnormality or high load is detected. The security monitoring department has the following functions: using generative AI to analyze the access logs and communication data of the IT infrastructure; accurately detecting threats such as unauthorized access or malware infection from external and internal sources; automatically executing response actions such as cutting off access or isolation for detected threats; and recording the response history. The resource optimization department has the following functions: using generative AI to analyze the resource utilization status of each information processing device; automatically scaling up virtual servers or storage capacity when the load is high; and proposing or automatically scaling down or stopping resources when the load is low, and providing these optimization suggestions and execution results to the administrator terminal.

2. The system as described in claim 1, characterized in that, It also has the following functions: based on the IT infrastructure operation status and anomaly detection results collected by the system management department using generative AI, it automatically generates cause analysis and recommended response strategies when an anomaly occurs, and provides a detailed report to the management terminal.

3. The system as described in claim 1, characterized in that, It also has the following functions: The resource optimization department uses generative AI to analyze the overall resource utilization history and future utilization prediction data of the IT infrastructure. Based on the predicted load changes, it automatically plans and executes the addition, reduction or structural changes of resources in advance, and visually prompts the optimization results and prediction basis to the management terminal.

Images