System

Abstract

To provide a system that efficiently creates a security software through simulation of attack and defense.SOLUTION: A system according to an embodiment comprises an attack simulation part, a defense simulation part, a result collection part, and a security creation part. The attack simulation part performs attack simulation. The defense simulation part simulates a defense measure on the basis of vulnerability discovered by the attack simulation part. The result collection part collects simulation results of the attack simulation part and the defense simulation part. The security creation part creates a security software on the basis of simulation results collected by the result collection part.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including a description and related instruction sentence regarding the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2022-180282 A Summary of the Invention [Problem to be solved by the invention]

[0004] With conventional technology, the development of security software could easily become a game of cat and mouse between hackers and security teams, making it difficult to come up with effective countermeasures.

[0005] The system according to the embodiment aims to efficiently create countermeasure software through simulation of attacks and defenses. [Means for solving the problem]

[0006] The system according to the embodiment includes an attack simulation unit, a defense simulation unit, a result collection unit, and a countermeasure creation unit. The attack simulation unit performs an attack simulation. The defense simulation unit simulates a defense measure based on a vulnerability discovered by the attack simulation unit. The result collection unit collects simulation results of the attack simulation unit and the defense simulation unit. The countermeasure creation unit creates countermeasure software based on the simulation results collected by the result collection unit. Effect of the Invention

[0007] The system according to the embodiment can efficiently create countermeasure software through simulation of attacks and defenses. [Brief description of the drawings]

[0008] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Diagram 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. FIG. [Diagram 3] FIG. 11 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Diagram 5] FIG. 13 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 13 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 13 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10] 1 shows an emotion map onto which multiple emotions are mapped. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an example of an embodiment of a system according to the technology of the present disclosure will be described with reference to the accompanying drawings.

[0010] First, the terms used in the following description will be explained.

[0011] In the following embodiments, a signed processor (hereinafter simply referred to as a "processor") may be one arithmetic device or a combination of multiple arithmetic devices. Furthermore, a processor may be one type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), an APU (Accelerated Processing Unit), or a TPU (Tensor Processing Unit).

[0012] In the following embodiments, a signed RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by the processor.

[0013] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs and various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0014] In the following embodiments, a communication I / F (Interface) with a code is an interface including a communication processor and an antenna. The communication I / F controls communication between multiple computers. An example of a communication standard applied to the communication I / F is a wireless communication standard including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), or Bluetooth (registered trademark).

[0015] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. In addition, in this specification, the same idea as "A and / or B" is also applied when three or more things are expressed by connecting them with "and / or."

[0016] [First embodiment] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0017] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0018] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0019] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0020] The reception device 38 includes a touch panel 38A and a microphone 38B, and receives user input. The touch panel 38A detects contact with a pointer (e.g., a pen or a finger) to receive user input by the touch of the pointer. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 (see FIG. 2) acquires the data indicating the user input.

[0021] Output device 40 includes a display 40A and a speaker 40B, and presents data to a user by outputting the data in a form of expression that the user can perceive (e.g., voice and / or text). Display 40A displays visible information such as text and images according to instructions from processor 46. Speaker 40B outputs voice according to instructions from processor 46. Camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a Complementary Metal-Oxide-Semiconductor (CMOS) image sensor or a Charge Coupled Device (CCD) image sensor.

[0022] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for transmitting and receiving various types of information between the processor 46 and the processor 28 via the network 54.

[0023] FIG. 2 shows an example of main functions of the data processing device 12 and the smart device 14.

[0024] As shown in Fig. 2, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32. The specific process program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific process program 56 from the storage 32, and executes the read specific process program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific process program 56 executed on the RAM 30.

[0025] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the emotion of the user using the emotion identification model 59 and perform identification processing using the user's emotion. In the emotion estimation function (emotion identification function) using the emotion identification model 59, various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, are performed, but are not limited to such examples. In addition, the estimation and prediction of the emotion also include, for example, analysis of the emotion.

[0026] In the smart device 14, the specific processing is performed by the processor 46. The storage 50 stores a specific processing program 60. The specific processing program 60 is used together with the specific processing program 56 by the data processing system 10. The processor 46 reads the specific processing program 60 from the storage 50 and executes the specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. Note that the smart device 14 has a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can also perform processing similar to that of the specific processing unit 290 using these models.

[0027] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device (e.g., a generation server) may have the data generation model 58. In this case, the data processing device 12 obtains a processing result (prediction result, etc.) using the data generation model 58 by communicating with the server device having the data generation model 58. Also, the data processing device 12 may be a server device, or may be a terminal device (e.g., a mobile phone, a robot, a home appliance, etc.) owned by a user. Next, an example of processing by the data processing system 10 according to the first embodiment will be described.

[0028] (Example 1) The security system according to the embodiment of the present invention is a system that automatically develops a security system by simulating a game of cat and mouse between a hacker and a security side using a generation AI. In this security system, the generation AI is divided into a hacker side and a security side and performs a simulation. The hacker side generation AI performs an attack simulation after incorporating the latest technology and methods. For example, it discovers a new vulnerability and simulates an attack method using the vulnerability. Next, the security side generation AI simulates a defense against the hacker side's attack simulation. For example, it creates a patch for the discovered vulnerability and simulates a method of preventing the attack. In this way, the hacker side and the security side generation AI alternately perform simulations, so that countermeasure software that includes attacks that do not exist in the world today can be automatically created. This makes the development of security software more efficient and enables more advanced security measures. For example, the generation AI is divided into a hacker side and a security side and performs a simulation. The hacker side generation AI performs an attack simulation after incorporating the latest technology and methods. For example, it discovers a new vulnerability and simulates an attack method using the vulnerability. Next, the security side generation AI simulates a defense against the hacker side's attack simulation. For example, it creates a patch for the discovered vulnerability and simulates a method of preventing the attack. In this way, the hacker and security side's generating AI alternate between simulations, making it possible to automatically create countermeasure software that can handle attacks that do not currently exist. This makes security software development more efficient, and enables more advanced security measures. This allows the security system to automatically simulate the cat-and-mouse game between hackers and the security side, and efficiently create countermeasure software.

[0029] The security system according to the embodiment includes an attack simulation unit, a defense simulation unit, a result collection unit, and a countermeasure creation unit. The attack simulation unit performs an attack simulation using a generation AI. The attack simulation unit performs an attack simulation by incorporating, for example, the latest technology and methods. For example, the attack simulation unit can discover a new vulnerability and simulate an attack method using the vulnerability. The attack simulation unit can also generate a new attack method by referring to past attack data. For example, the attack simulation unit can analyze past attack data and generate a new attack method based on a similar pattern. The defense simulation unit performs a defense simulation using a generation AI. The defense simulation unit creates a patch for a discovered vulnerability and simulates a method of preventing an attack. For example, the defense simulation unit can create a patch for a discovered vulnerability and simulate a method of preventing an attack. The defense simulation unit can also generate a new defense method by referring to past defense data. For example, the defense simulation unit can analyze past defense data and generate a new defense method based on a similar pattern. The result collection unit collects the simulation results of the attack simulation unit and the defense simulation unit. The result collection unit can, for example, collect simulation results from the attack simulation unit and the defense simulation unit. The result collection unit can also optimize the collection method by referring to past simulation results. For example, the result collection unit can analyze past simulation results and optimize the collection method based on similar patterns. The countermeasure creation unit creates countermeasure software based on the collected simulation results. For example, the countermeasure creation unit can create countermeasure software based on the collected simulation results. The countermeasure creation unit can also generate a new countermeasure method by referring to past countermeasure data. For example, the countermeasure creation unit can analyze past countermeasure data and generate a new countermeasure method based on similar patterns.As a result, the security system according to the embodiment can automatically simulate the cat-and-mouse game between hackers and security teams, and efficiently create security software.

[0030] The attack simulation unit uses the generation AI to perform attack simulations. Specifically, the generation AI performs simulations after incorporating the latest technologies and methods. For example, the generation AI can refer to the latest vulnerability database and simulate attack methods that exploit newly discovered vulnerabilities. This enables the system to always respond to the latest attack methods. The generation AI can also analyze past attack data and generate new attack methods based on similar patterns. For example, it uses past attack data to predict how a specific attack pattern will evolve and creates a new attack scenario based on that. In addition, the generation AI can generate composite attack scenarios that combine different attack methods. This allows the attack simulation unit to respond to not only a single attack method, but also advanced attacks that combine multiple methods. For example, it can simulate a scenario that combines a phishing attack and a malware infection and evaluate its impact. This allows the attack simulation unit to provide more realistic and complex attack scenarios and strengthen the security of the entire system.

[0031] The defense simulation unit uses the generation AI to perform defense simulations. Specifically, the generation AI creates patches for discovered vulnerabilities and simulates their effects. For example, the generation AI can automatically generate patches for specific vulnerabilities and verify through simulation whether the patches actually prevent attacks. This makes it possible to provide quick and effective defense measures. The defense simulation unit can also analyze past defense data and generate new defense methods based on similar patterns. For example, it can use past defense data to identify the optimal defense method for a specific attack and propose new defense measures based on that. Furthermore, the defense simulation unit can generate composite defense scenarios that combine different defense methods. This makes it possible to deal with not only a single defense method, but also advanced defense measures that combine multiple methods. For example, it can simulate the cooperation of strengthened firewall settings and intrusion detection systems and evaluate their effects. This makes it possible for the defense simulation unit to provide more realistic and complex defense scenarios and enhance the security of the entire system.

[0032] The result collection unit collects the simulation results of the attack simulation unit and the defense simulation unit. Specifically, the result collection unit centrally manages detailed result data of each simulation and stores it for analysis. For example, as a result of the attack simulation, the result collection unit collects data such as which attack method was successful, which vulnerability was exploited, the success rate of the attack, and the scope of the impact. Similarly, as a result of the defense simulation, the result collection unit collects data such as which defense method was effective, which vulnerability was defended, the success rate of the defense, and the scope of the impact. Furthermore, the result collection unit can also optimize the collection method by referring to past simulation results. For example, by analyzing past simulation results and optimizing the collection method based on similar patterns, data can be collected more efficiently. This allows the result collection unit to improve the accuracy and reliability of the simulation results. In addition, the result collection unit can share the collected data with other systems and departments. For example, the collected data is stored in a cloud server so that the countermeasure creation department and other security departments can access it. This allows the result collection unit to provide important data for improving the security of the entire system.

[0033] The countermeasure creation unit creates countermeasure software based on the collected simulation results. Specifically, the countermeasure creation unit analyzes data collected from the attack simulation unit and the defense simulation unit, and automatically generates optimal countermeasure software. For example, the countermeasure creation unit can create a patch for a specific vulnerability and generate countermeasure software including a procedure for applying the patch. The countermeasure creation unit can also generate a new countermeasure method by referring to past countermeasure data. For example, the countermeasure creation unit can analyze past countermeasure data and propose a new countermeasure method based on a similar pattern. Furthermore, the countermeasure creation unit can generate composite countermeasure software that combines different countermeasure methods. This makes it possible to deal with not only a single countermeasure method, but also advanced countermeasures that combine multiple methods. For example, the countermeasure creation unit can generate countermeasure software that includes strengthening firewall settings and linking with an intrusion detection system, and evaluate the effectiveness of the countermeasure software. This allows the countermeasure creation unit to provide more realistic and complex countermeasure software and strengthen the security of the entire system. Furthermore, the countermeasure creation unit can automatically distribute the generated countermeasure software and apply it to the entire system. This makes it possible to implement security measures quickly and effectively.

[0034] The attack simulation unit can perform an attack simulation by incorporating the latest technologies and techniques. The attack simulation unit can perform an attack simulation by incorporating the latest technologies and techniques, for example. For example, the attack simulation unit can discover a new vulnerability and simulate an attack method that utilizes it. The attack simulation unit can also generate a new attack method by referring to past attack data. For example, the attack simulation unit can analyze past attack data and generate a new attack method based on similar patterns. This makes it possible to perform a more realistic attack simulation by incorporating the latest technologies and techniques.

[0035] The defense simulation unit can create a patch for the discovered vulnerability and simulate a method of preventing an attack. The defense simulation unit, for example, creates a patch for the discovered vulnerability and simulates a method of preventing an attack. For example, the defense simulation unit can create a patch for the discovered vulnerability and simulate a method of preventing an attack. The defense simulation unit can also generate a new defense method by referring to past defense data. For example, the defense simulation unit can analyze past defense data and generate a new defense method based on a similar pattern. In this way, attacks can be effectively prevented by creating a patch for the vulnerability.

[0036] The result collection unit can collect the simulation results of the attack simulation unit and the defense simulation unit. The result collection unit, for example, collects the simulation results of the attack simulation unit and the defense simulation unit. For example, the result collection unit can collect the simulation results of the attack simulation unit and the defense simulation unit. The result collection unit can also optimize the collection method by referring to past simulation results. For example, the result collection unit can analyze past simulation results and optimize the collection method based on similar patterns. In this way, by collecting simulation results, information necessary for creating countermeasure software can be obtained.

[0037] The countermeasure creation unit can create countermeasure software based on the collected simulation results. The countermeasure creation unit can create countermeasure software based on the collected simulation results, for example. For example, the countermeasure creation unit can create countermeasure software based on the collected simulation results. The countermeasure creation unit can also generate new countermeasure methods by referring to past countermeasure data. For example, the countermeasure creation unit can analyze past countermeasure data and generate new countermeasure methods based on similar patterns. This makes it possible to implement effective security measures by creating countermeasure software based on simulation results.

[0038] The attack simulation unit can generate a new attack method by referring to past attack data. The attack simulation unit, for example, generates a new attack method by referring to past attack data. For example, the attack simulation unit can analyze past attack data and generate a new attack method based on a similar pattern. The attack simulation unit can also identify unresolved vulnerabilities from past attack data and generate a new attack method using the identified vulnerabilities. The attack simulation unit can also combine past attack data to generate a new composite attack method. In this way, a more realistic attack simulation can be performed by generating a new attack method based on past attack data.

[0039] The attack simulation unit can perform a simulation taking into account vulnerabilities in different industries and fields. The attack simulation unit performs a simulation taking into account vulnerabilities in different industries and fields, for example. For example, the attack simulation unit can perform a simulation of a phishing attack taking into account vulnerabilities in the financial industry. The attack simulation unit can also perform a simulation of a ransomware attack taking into account vulnerabilities in the medical industry. The attack simulation unit can also perform a simulation of a supply chain attack taking into account vulnerabilities in the manufacturing industry. This allows for more diverse attack simulations by taking into account vulnerabilities in different industries and fields.

[0040] The attack simulation unit can perform a simulation taking into account geographical threat information. The attack simulation unit performs a simulation taking into account, for example, geographical threat information. For example, the attack simulation unit can perform a simulation taking into account trends of cyber attacks occurring in a specific region. The attack simulation unit can also adjust an attack method taking into account vulnerabilities of different geographical regions. The attack simulation unit can also generate an attack scenario for a specific region based on the geographical threat information. As a result, a more realistic attack simulation can be performed by taking into account geographical threat information.

[0041] The attack simulation unit can analyze trends on social media and simulate related attack techniques. The attack simulation unit, for example, analyzes trends on social media and simulates related attack techniques. For example, the attack simulation unit can generate an attack scenario based on vulnerabilities that are hot topics on social media. The attack simulation unit can also analyze trends on social media and simulate related attack techniques. The attack simulation unit can also generate new attack techniques based on information on social media. In this way, the latest attack techniques can be simulated by analyzing trends on social media.

[0042] The defense simulation unit can generate a new defense technique by referring to past defense data. The defense simulation unit, for example, generates a new defense technique by referring to past defense data. For example, the defense simulation unit can analyze past defense data and generate a new defense technique based on similar patterns. The defense simulation unit can also identify unresolved vulnerabilities from past defense data and generate a new defense technique using the identified vulnerabilities. The defense simulation unit can also combine past defense data to generate a new composite defense technique. In this way, a more realistic defense simulation can be performed by generating a new defense technique based on past defense data.

[0043] The defense simulation unit can perform a simulation taking into account defense methods in different industries and fields. The defense simulation unit performs a simulation taking into account defense methods in different industries and fields, for example. For example, the defense simulation unit can perform a defense simulation against a phishing attack taking into account defense methods in the financial industry. The defense simulation unit can also perform a defense simulation against a ransomware attack taking into account defense methods in the medical industry. The defense simulation unit can also perform a defense simulation against a supply chain attack taking into account defense methods in the manufacturing industry. This allows for more diverse defense simulations by taking into account defense methods in different industries and fields.

[0044] The defense simulation unit can perform a simulation taking into account geographical threat information. The defense simulation unit performs a simulation taking into account, for example, geographical threat information. For example, the defense simulation unit can perform a simulation taking into account trends of cyber attacks occurring in a specific region. The defense simulation unit can also adjust a defense method taking into account vulnerabilities of different geographical regions. The defense simulation unit can also generate a defense scenario for a specific region based on the geographical threat information. As a result, a more realistic defense simulation can be performed by taking into account geographical threat information.

[0045] The defense simulation unit can analyze trends on social media and simulate related defense techniques. The defense simulation unit, for example, analyzes trends on social media and simulates related defense techniques. For example, the defense simulation unit can generate defense scenarios based on vulnerabilities that are hot topics on social media. The defense simulation unit can also analyze trends on social media and simulate related defense techniques. The defense simulation unit can also generate new defense techniques based on information on social media. In this way, the latest defense techniques can be simulated by analyzing trends on social media.

[0046] The result collection unit can optimize the collection method by referring to past simulation results. The result collection unit can optimize the collection method by referring to past simulation results, for example. For example, the result collection unit can analyze past simulation results and optimize the collection method based on similar patterns. The result collection unit can also identify unresolved vulnerabilities from past simulation results and optimize the collection method based on the identified vulnerabilities. The result collection unit can also optimize a new collection method by combining past simulation results. This enables more efficient result collection by optimizing the collection method based on past simulation results.

[0047] The result collection unit can perform collection while taking into consideration geographical threat information. The result collection unit performs collection while taking into consideration, for example, geographical threat information. For example, the result collection unit can perform collection while taking into consideration trends of cyber attacks occurring in a specific region. The result collection unit can also adjust the collection method while taking into consideration vulnerabilities of different geographical regions. The result collection unit can also collect simulation results for a specific region based on the geographical threat information. This allows for more realistic result collection by taking into consideration geographical threat information.

[0048] The countermeasure creation unit can generate a new countermeasure technique by referring to past countermeasure data. The countermeasure creation unit generates a new countermeasure technique by referring to past countermeasure data, for example. For example, the countermeasure creation unit can analyze past countermeasure data and generate a new countermeasure technique based on similar patterns. The countermeasure creation unit can also identify unresolved vulnerabilities from past countermeasure data and generate a new countermeasure technique using the identified vulnerabilities. The countermeasure creation unit can also combine past countermeasure data to generate a new composite countermeasure technique. In this way, more effective countermeasure software can be created by generating a new countermeasure technique based on past countermeasure data.

[0049] The countermeasure creation unit can create countermeasures by taking into account geographical threat information. The countermeasure creation unit creates countermeasures by taking into account, for example, geographical threat information. For example, the countermeasure creation unit can create countermeasures by taking into account trends of cyber attacks occurring in a specific region. The countermeasure creation unit can also adjust countermeasure methods by taking into account vulnerabilities in different geographical regions. The countermeasure creation unit can also create countermeasure software for a specific region based on the geographical threat information. As a result, more realistic countermeasure software can be created by taking into account geographical threat information.

[0050] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0051] The security system may further include a behavior analysis unit that analyzes the behavioral patterns of the user. The behavior analysis unit may, for example, analyze the past behavioral data of the user and identify normal behavioral patterns. The behavior analysis unit may also detect abnormal behavior and issue a warning in real time. Furthermore, the behavior analysis unit may adjust the scenarios of attack and defense simulations based on the user's behavioral patterns. This allows for more effective security measures in accordance with the user's behavioral patterns.

[0052] The security system may further include an anomaly detection unit. The anomaly detection unit may, for example, monitor network traffic and detect abnormal patterns. The anomaly detection unit may also analyze system logs and identify abnormal accesses or operations. Furthermore, the anomaly detection unit may automatically take measures against detected anomalies. This makes it possible to detect anomalies in real time and respond quickly.

[0053] The security system may further include a threat information collection unit that collects threat information from different industries and fields. The threat information collection unit may collect threat information from the financial industry, for example, to strengthen measures against phishing attacks. It may also collect threat information from the medical industry to strengthen measures against ransomware attacks. It may also collect threat information from the manufacturing industry to strengthen measures against supply chain attacks. In this way, by collecting threat information from different industries and fields, more diverse security measures are possible.

[0054] The security system may further include a geographic information collection unit that collects geographic threat information. The geographic information collection unit, for example, collects trends of cyber attacks occurring in a specific region and takes measures specific to that region. It may also collect vulnerabilities in different geographical regions and adjust countermeasure methods. Furthermore, it may also create countermeasure software for a specific region based on the geographic threat information. In this way, by collecting geographical threat information, more realistic security measures may be possible.

[0055] The security system may further include a trend analysis unit that analyzes trends on social media. The trend analysis unit generates an attack scenario based on vulnerabilities that are hot topics on social media, for example. It is also possible to analyze trends on social media and simulate related defense methods. Furthermore, it is also possible to generate new attack methods and defense methods based on information on social media. In this way, it is possible to simulate the latest attack methods and defense methods by analyzing trends on social media.

[0056] The process flow of the first embodiment will be briefly described below.

[0057] Step 1: The attack simulation unit uses the generation AI to perform an attack simulation. For example, it performs an attack simulation by incorporating the latest technologies and methods, discovers new vulnerabilities, and simulates an attack method that utilizes them. It can also generate new attack methods by referring to past attack data. Step 2: The defense simulation unit uses the generation AI to perform a defense simulation. For example, it creates a patch for the discovered vulnerability and simulates how to prevent an attack. It can also generate new defense methods by referring to past defense data. Step 3: The result collection unit collects the simulation results of the attack simulation unit and the defense simulation unit. For example, the collection method can be optimized by referring to past simulation results. Step 4: The countermeasure creation unit creates countermeasure software based on the collected simulation results. For example, it can also generate new countermeasure methods by referring to past countermeasure data.

[0058] (Example 2) The security system according to the embodiment of the present invention is a system that automatically develops a security system by simulating a game of cat and mouse between a hacker and a security side using a generation AI. In this security system, the generation AI is divided into a hacker side and a security side and performs a simulation. The hacker side generation AI performs an attack simulation after incorporating the latest technology and methods. For example, it discovers a new vulnerability and simulates an attack method using the vulnerability. Next, the security side generation AI simulates a defense against the hacker side's attack simulation. For example, it creates a patch for the discovered vulnerability and simulates a method of preventing the attack. In this way, the hacker side and the security side generation AI alternately perform simulations, so that countermeasure software that includes attacks that do not exist in the world today can be automatically created. This makes the development of security software more efficient and enables more advanced security measures. For example, the generation AI is divided into a hacker side and a security side and performs a simulation. The hacker side generation AI performs an attack simulation after incorporating the latest technology and methods. For example, it discovers a new vulnerability and simulates an attack method using the vulnerability. Next, the security side generation AI simulates a defense against the hacker side's attack simulation. For example, it creates a patch for the discovered vulnerability and simulates a method of preventing the attack. In this way, the hacker and security side's generating AI alternate between simulations, making it possible to automatically create countermeasure software that can handle attacks that do not currently exist. This makes security software development more efficient, and enables more advanced security measures. This allows the security system to automatically simulate the cat-and-mouse game between hackers and the security side, and efficiently create countermeasure software.

[0059] The security system according to the embodiment includes an attack simulation unit, a defense simulation unit, a result collection unit, and a countermeasure creation unit. The attack simulation unit performs an attack simulation using a generation AI. The attack simulation unit performs an attack simulation by incorporating, for example, the latest technology and methods. For example, the attack simulation unit can discover a new vulnerability and simulate an attack method using the vulnerability. The attack simulation unit can also generate a new attack method by referring to past attack data. For example, the attack simulation unit can analyze past attack data and generate a new attack method based on a similar pattern. The defense simulation unit performs a defense simulation using a generation AI. The defense simulation unit creates a patch for a discovered vulnerability and simulates a method of preventing an attack. For example, the defense simulation unit can create a patch for a discovered vulnerability and simulate a method of preventing an attack. The defense simulation unit can also generate a new defense method by referring to past defense data. For example, the defense simulation unit can analyze past defense data and generate a new defense method based on a similar pattern. The result collection unit collects the simulation results of the attack simulation unit and the defense simulation unit. The result collection unit can, for example, collect simulation results from the attack simulation unit and the defense simulation unit. The result collection unit can also optimize the collection method by referring to past simulation results. For example, the result collection unit can analyze past simulation results and optimize the collection method based on similar patterns. The countermeasure creation unit creates countermeasure software based on the collected simulation results. For example, the countermeasure creation unit can create countermeasure software based on the collected simulation results. The countermeasure creation unit can also generate a new countermeasure method by referring to past countermeasure data. For example, the countermeasure creation unit can analyze past countermeasure data and generate a new countermeasure method based on similar patterns.As a result, the security system according to the embodiment can automatically simulate the cat-and-mouse game between hackers and security teams, and efficiently create security software.

[0060] The attack simulation unit uses the generation AI to perform attack simulations. Specifically, the generation AI performs simulations after incorporating the latest technologies and methods. For example, the generation AI can refer to the latest vulnerability database and simulate attack methods that exploit newly discovered vulnerabilities. This enables the system to always respond to the latest attack methods. The generation AI can also analyze past attack data and generate new attack methods based on similar patterns. For example, it uses past attack data to predict how a specific attack pattern will evolve and creates a new attack scenario based on that. In addition, the generation AI can generate composite attack scenarios that combine different attack methods. This allows the attack simulation unit to respond to not only a single attack method, but also advanced attacks that combine multiple methods. For example, it can simulate a scenario that combines a phishing attack and a malware infection and evaluate its impact. This allows the attack simulation unit to provide more realistic and complex attack scenarios and strengthen the security of the entire system.

[0061] The defense simulation unit uses the generation AI to perform defense simulations. Specifically, the generation AI creates patches for discovered vulnerabilities and simulates their effects. For example, the generation AI can automatically generate patches for specific vulnerabilities and verify through simulation whether the patches actually prevent attacks. This makes it possible to provide quick and effective defense measures. The defense simulation unit can also analyze past defense data and generate new defense methods based on similar patterns. For example, it can use past defense data to identify the optimal defense method for a specific attack and propose new defense measures based on that. Furthermore, the defense simulation unit can generate composite defense scenarios that combine different defense methods. This makes it possible to deal with not only a single defense method, but also advanced defense measures that combine multiple methods. For example, it can simulate the cooperation of strengthened firewall settings and intrusion detection systems and evaluate their effects. This makes it possible for the defense simulation unit to provide more realistic and complex defense scenarios and enhance the security of the entire system.

[0062] The result collection unit collects the simulation results of the attack simulation unit and the defense simulation unit. Specifically, the result collection unit centrally manages detailed result data of each simulation and stores it for analysis. For example, as a result of the attack simulation, the result collection unit collects data such as which attack method was successful, which vulnerability was exploited, the success rate of the attack, and the scope of the impact. Similarly, as a result of the defense simulation, the result collection unit collects data such as which defense method was effective, which vulnerability was defended, the success rate of the defense, and the scope of the impact. Furthermore, the result collection unit can also optimize the collection method by referring to past simulation results. For example, by analyzing past simulation results and optimizing the collection method based on similar patterns, data can be collected more efficiently. This allows the result collection unit to improve the accuracy and reliability of the simulation results. In addition, the result collection unit can share the collected data with other systems and departments. For example, the collected data is stored in a cloud server so that the countermeasure creation department and other security departments can access it. This allows the result collection unit to provide important data for improving the security of the entire system.

[0063] The countermeasure creation unit creates countermeasure software based on the collected simulation results. Specifically, the countermeasure creation unit analyzes data collected from the attack simulation unit and the defense simulation unit, and automatically generates optimal countermeasure software. For example, the countermeasure creation unit can create a patch for a specific vulnerability and generate countermeasure software including a procedure for applying the patch. The countermeasure creation unit can also generate a new countermeasure method by referring to past countermeasure data. For example, the countermeasure creation unit can analyze past countermeasure data and propose a new countermeasure method based on a similar pattern. Furthermore, the countermeasure creation unit can generate composite countermeasure software that combines different countermeasure methods. This makes it possible to deal with not only a single countermeasure method, but also advanced countermeasures that combine multiple methods. For example, the countermeasure creation unit can generate countermeasure software that includes strengthening firewall settings and linking with an intrusion detection system, and evaluate the effectiveness of the countermeasure software. This allows the countermeasure creation unit to provide more realistic and complex countermeasure software and strengthen the security of the entire system. Furthermore, the countermeasure creation unit can automatically distribute the generated countermeasure software and apply it to the entire system. This makes it possible to implement security measures quickly and effectively.

[0064] The attack simulation unit can perform an attack simulation by incorporating the latest technologies and techniques. The attack simulation unit can perform an attack simulation by incorporating the latest technologies and techniques, for example. For example, the attack simulation unit can discover a new vulnerability and simulate an attack method that utilizes it. The attack simulation unit can also generate a new attack method by referring to past attack data. For example, the attack simulation unit can analyze past attack data and generate a new attack method based on similar patterns. This makes it possible to perform a more realistic attack simulation by incorporating the latest technologies and techniques.

[0065] The defense simulation unit can create a patch for the discovered vulnerability and simulate a method of preventing an attack. The defense simulation unit, for example, creates a patch for the discovered vulnerability and simulates a method of preventing an attack. For example, the defense simulation unit can create a patch for the discovered vulnerability and simulate a method of preventing an attack. The defense simulation unit can also generate a new defense method by referring to past defense data. For example, the defense simulation unit can analyze past defense data and generate a new defense method based on a similar pattern. In this way, attacks can be effectively prevented by creating a patch for the vulnerability.

[0066] The result collection unit can collect the simulation results of the attack simulation unit and the defense simulation unit. The result collection unit, for example, collects the simulation results of the attack simulation unit and the defense simulation unit. For example, the result collection unit can collect the simulation results of the attack simulation unit and the defense simulation unit. The result collection unit can also optimize the collection method by referring to past simulation results. For example, the result collection unit can analyze past simulation results and optimize the collection method based on similar patterns. In this way, by collecting simulation results, information necessary for creating countermeasure software can be obtained.

[0067] The countermeasure creation unit can create countermeasure software based on the collected simulation results. The countermeasure creation unit can create countermeasure software based on the collected simulation results, for example. For example, the countermeasure creation unit can create countermeasure software based on the collected simulation results. The countermeasure creation unit can also generate new countermeasure methods by referring to past countermeasure data. For example, the countermeasure creation unit can analyze past countermeasure data and generate new countermeasure methods based on similar patterns. This makes it possible to implement effective security measures by creating countermeasure software based on simulation results.

[0068] The attack simulation unit can estimate the user's emotions and adjust the attack simulation scenario based on the estimated user's emotions. The attack simulation unit, for example, estimates the user's emotions and adjusts the attack simulation scenario based on the estimated user's emotions. For example, when the user feels anxious, the attack simulation unit lowers the difficulty of the simulation and configures a scenario centered on basic attack techniques. In addition, when the user is confident, the attack simulation unit can also increase the difficulty of the simulation and configure a scenario including complex attack techniques. In addition, when the user is excited, the attack simulation unit can also speed up the tempo of the simulation and configure a scenario including quick attack techniques. This allows for a more appropriate simulation by adjusting the simulation scenario according to the user's emotions. The emotion estimation is realized using an emotion estimation function using, for example, an emotion engine or a generation AI. The generation AI is, for example, a text generation AI (for example, LLM) or a multimodal generation AI, but is not limited to such examples.

[0069] The attack simulation unit can generate a new attack method by referring to past attack data. The attack simulation unit, for example, generates a new attack method by referring to past attack data. For example, the attack simulation unit can analyze past attack data and generate a new attack method based on a similar pattern. The attack simulation unit can also identify unresolved vulnerabilities from past attack data and generate a new attack method using the identified vulnerabilities. The attack simulation unit can also combine past attack data to generate a new composite attack method. In this way, a more realistic attack simulation can be performed by generating a new attack method based on past attack data.

[0070] The attack simulation unit can perform a simulation taking into account vulnerabilities in different industries and fields. The attack simulation unit performs a simulation taking into account vulnerabilities in different industries and fields, for example. For example, the attack simulation unit can perform a simulation of a phishing attack taking into account vulnerabilities in the financial industry. The attack simulation unit can also perform a simulation of a ransomware attack taking into account vulnerabilities in the medical industry. The attack simulation unit can also perform a simulation of a supply chain attack taking into account vulnerabilities in the manufacturing industry. This allows for more diverse attack simulations by taking into account vulnerabilities in different industries and fields.

[0071] The attack simulation unit can estimate the user's emotions and determine the priority of the attack simulation based on the estimated user's emotions. The attack simulation unit, for example, estimates the user's emotions and determines the priority of the attack simulation based on the estimated user's emotions. For example, when the user feels anxious, the attack simulation unit prioritizes a basic attack method for simulation. Also, when the user is confident, the attack simulation unit can also prioritize a complex attack method for simulation. Also, when the user is excited, the attack simulation unit can also prioritize a quick attack method for simulation. This enables a more appropriate simulation by determining the priority of the simulation according to the user's emotions. The estimation of emotions is realized using an emotion estimation function using, for example, an emotion engine or a generation AI. The generation AI is, for example, a text generation AI (for example, LLM) or a multimodal generation AI, but is not limited to such examples.

[0072] The attack simulation unit can perform a simulation taking into account geographical threat information. The attack simulation unit performs a simulation taking into account, for example, geographical threat information. For example, the attack simulation unit can perform a simulation taking into account trends of cyber attacks occurring in a specific region. The attack simulation unit can also adjust an attack method taking into account vulnerabilities of different geographical regions. The attack simulation unit can also generate an attack scenario for a specific region based on the geographical threat information. As a result, a more realistic attack simulation can be performed by taking into account geographical threat information.

[0073] The attack simulation unit can analyze trends on social media and simulate related attack techniques. The attack simulation unit, for example, analyzes trends on social media and simulates related attack techniques. For example, the attack simulation unit can generate an attack scenario based on vulnerabilities that are hot topics on social media. The attack simulation unit can also analyze trends on social media and simulate related attack techniques. The attack simulation unit can also generate new attack techniques based on information on social media. In this way, the latest attack techniques can be simulated by analyzing trends on social media.

[0074] The defense simulation unit can estimate the user's emotion and adjust the defense simulation scenario based on the estimated user's emotion. The defense simulation unit, for example, estimates the user's emotion and adjusts the defense simulation scenario based on the estimated user's emotion. For example, when the user feels anxious, the defense simulation unit configures a scenario centered on a basic defense technique. In addition, when the user is confident, the defense simulation unit can also configure a scenario including a complex defense technique. In addition, when the user is excited, the defense simulation unit can also configure a scenario including a quick defense technique. This enables a more appropriate defense simulation by adjusting the simulation scenario according to the user's emotion. The emotion estimation is realized using an emotion estimation function using, for example, an emotion engine or a generation AI. The generation AI is, for example, a text generation AI (for example, LLM) or a multimodal generation AI, but is not limited to such examples.

[0075] The defense simulation unit can generate a new defense technique by referring to past defense data. The defense simulation unit, for example, generates a new defense technique by referring to past defense data. For example, the defense simulation unit can analyze past defense data and generate a new defense technique based on similar patterns. The defense simulation unit can also identify unresolved vulnerabilities from past defense data and generate a new defense technique using the identified vulnerabilities. The defense simulation unit can also combine past defense data to generate a new composite defense technique. In this way, a more realistic defense simulation can be performed by generating a new defense technique based on past defense data.

[0076] The defense simulation unit can perform a simulation taking into account defense methods in different industries and fields. The defense simulation unit performs a simulation taking into account defense methods in different industries and fields, for example. For example, the defense simulation unit can perform a defense simulation against a phishing attack taking into account defense methods in the financial industry. The defense simulation unit can also perform a defense simulation against a ransomware attack taking into account defense methods in the medical industry. The defense simulation unit can also perform a defense simulation against a supply chain attack taking into account defense methods in the manufacturing industry. This allows for more diverse defense simulations by taking into account defense methods in different industries and fields.

[0077] The defense simulation unit can estimate the user's emotion and determine the priority of the defense simulation based on the estimated user's emotion. The defense simulation unit, for example, estimates the user's emotion and determines the priority of the defense simulation based on the estimated user's emotion. For example, when the user feels anxious, the defense simulation unit prioritizes a basic defense technique and simulates it. Also, when the user is confident, the defense simulation unit can also prioritize a complex defense technique and simulate it. Also, when the user is excited, the defense simulation unit can also prioritize a quick defense technique and simulate it. This enables a more appropriate defense simulation by determining the priority of the simulation according to the user's emotion. The emotion estimation is realized using an emotion estimation function using, for example, an emotion engine or a generation AI. The generation AI is, for example, a text generation AI (for example, LLM) or a multimodal generation AI, but is not limited to such examples.

[0078] The defense simulation unit can perform a simulation taking into account geographical threat information. The defense simulation unit performs a simulation taking into account, for example, geographical threat information. For example, the defense simulation unit can perform a simulation taking into account trends of cyber attacks occurring in a specific region. The defense simulation unit can also adjust a defense method taking into account vulnerabilities of different geographical regions. The defense simulation unit can also generate a defense scenario for a specific region based on the geographical threat information. As a result, a more realistic defense simulation can be performed by taking into account geographical threat information.

[0079] The defense simulation unit can analyze trends on social media and simulate related defense techniques. The defense simulation unit, for example, analyzes trends on social media and simulates related defense techniques. For example, the defense simulation unit can generate defense scenarios based on vulnerabilities that are hot topics on social media. The defense simulation unit can also analyze trends on social media and simulate related defense techniques. The defense simulation unit can also generate new defense techniques based on information on social media. In this way, the latest defense techniques can be simulated by analyzing trends on social media.

[0080] The result collection unit can estimate the user's emotion and determine the priority of the simulation results to be collected based on the estimated user's emotion. The result collection unit, for example, estimates the user's emotion and determines the priority of the simulation results to be collected based on the estimated user's emotion. For example, the result collection unit prioritizes collecting basic simulation results when the user feels anxious. In addition, the result collection unit can also prioritize collecting complex simulation results when the user is confident. In addition, the result collection unit can also prioritize collecting quick simulation results when the user is excited. This enables more appropriate result collection by determining the priority of the simulation results according to the user's emotion. The emotion estimation is realized using an emotion estimation function using, for example, an emotion engine or a generation AI. The generation AI is, for example, a text generation AI (for example, LLM) or a multimodal generation AI, but is not limited to such examples.

[0081] The result collection unit can optimize the collection method by referring to past simulation results. The result collection unit can optimize the collection method by referring to past simulation results, for example. For example, the result collection unit can analyze past simulation results and optimize the collection method based on similar patterns. The result collection unit can also identify unresolved vulnerabilities from past simulation results and optimize the collection method based on the identified vulnerabilities. The result collection unit can also optimize a new collection method by combining past simulation results. This enables more efficient result collection by optimizing the collection method based on past simulation results.

[0082] The result collection unit can estimate the user's emotion and adjust the display method of the collected simulation results based on the estimated user's emotion. The result collection unit, for example, estimates the user's emotion and adjusts the display method of the collected simulation results based on the estimated user's emotion. For example, the result collection unit provides a simple and highly visible display method when the user feels anxious. In addition, the result collection unit can also provide a display method including detailed information when the user is confident. In addition, the result collection unit can also provide a visually stimulating display method when the user is excited. This allows for more appropriate result display by adjusting the display method according to the user's emotion. The emotion estimation is realized using an emotion estimation function using, for example, an emotion engine or a generation AI. The generation AI is, for example, a text generation AI (for example, LLM) or a multimodal generation AI, but is not limited to such examples.

[0083] The result collection unit can perform collection while taking into consideration geographical threat information. The result collection unit performs collection while taking into consideration, for example, geographical threat information. For example, the result collection unit can perform collection while taking into consideration trends of cyber attacks occurring in a specific region. The result collection unit can also adjust the collection method while taking into consideration vulnerabilities of different geographical regions. The result collection unit can also collect simulation results for a specific region based on the geographical threat information. This allows for more realistic result collection by taking into consideration geographical threat information.

[0084] The countermeasure creation unit can estimate the user's emotion and adjust the countermeasure software creation method based on the estimated user's emotion. The countermeasure creation unit, for example, estimates the user's emotion and adjusts the countermeasure software creation method based on the estimated user's emotion. For example, when the user feels anxious, the countermeasure creation unit creates countermeasure software focusing on basic countermeasure techniques. In addition, when the user is confident, the countermeasure creation unit can also create countermeasure software including complex countermeasure techniques. In addition, when the user is excited, the countermeasure creation unit can also create countermeasure software including quick countermeasure techniques. As a result, by adjusting the creation method according to the user's emotion, more appropriate countermeasure software can be created. The emotion estimation is realized using an emotion estimation function using, for example, an emotion engine or a generation AI. The generation AI is, for example, a text generation AI (for example, LLM) or a multimodal generation AI, but is not limited to such examples.

[0085] The countermeasure creation unit can generate a new countermeasure technique by referring to past countermeasure data. The countermeasure creation unit generates a new countermeasure technique by referring to past countermeasure data, for example. For example, the countermeasure creation unit can analyze past countermeasure data and generate a new countermeasure technique based on similar patterns. The countermeasure creation unit can also identify unresolved vulnerabilities from past countermeasure data and generate a new countermeasure technique using the identified vulnerabilities. The countermeasure creation unit can also combine past countermeasure data to generate a new composite countermeasure technique. In this way, more effective countermeasure software can be created by generating a new countermeasure technique based on past countermeasure data.

[0086] The countermeasure creation unit can estimate the user's emotion and determine the priority order of countermeasure software based on the estimated user's emotion. The countermeasure creation unit, for example, estimates the user's emotion and determines the priority order of countermeasure software based on the estimated user's emotion. For example, when the user feels anxious, the countermeasure creation unit creates countermeasure software by prioritizing a basic countermeasure technique. Also, when the user is confident, the countermeasure creation unit can also create countermeasure software by prioritizing a complex countermeasure technique. Also, when the user is excited, the countermeasure creation unit can also create countermeasure software by prioritizing a quick countermeasure technique. In this way, by determining the priority order according to the user's emotion, more appropriate countermeasure software can be created. The estimation of emotion is realized using an emotion estimation function using, for example, an emotion engine or a generation AI. The generation AI is, for example, a text generation AI (for example, LLM) or a multimodal generation AI, but is not limited to such examples.

[0087] The countermeasure creation unit can create countermeasures by taking into account geographical threat information. The countermeasure creation unit creates countermeasures by taking into account, for example, geographical threat information. For example, the countermeasure creation unit can create countermeasures by taking into account trends of cyber attacks occurring in a specific region. The countermeasure creation unit can also adjust countermeasure methods by taking into account vulnerabilities in different geographical regions. The countermeasure creation unit can also create countermeasure software for a specific region based on the geographical threat information. As a result, more realistic countermeasure software can be created by taking into account geographical threat information.

[0088] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0089] The security system may further include a behavior analysis unit that analyzes the behavioral patterns of the user. The behavior analysis unit may, for example, analyze the past behavioral data of the user and identify normal behavioral patterns. The behavior analysis unit may also detect abnormal behavior and issue a warning in real time. Furthermore, the behavior analysis unit may adjust the scenarios of attack and defense simulations based on the user's behavioral patterns. This allows for more effective security measures in accordance with the user's behavioral patterns.

[0090] The security system may further include an anomaly detection unit. The anomaly detection unit may, for example, monitor network traffic and detect abnormal patterns. The anomaly detection unit may also analyze system logs and identify abnormal accesses or operations. Furthermore, the anomaly detection unit may automatically take measures against detected anomalies. This makes it possible to detect anomalies in real time and respond quickly.

[0091] The security system may further include an interface adjustment unit that estimates the user's emotion and adjusts the system interface based on the estimated user's emotion. For example, the interface adjustment unit may provide a simple and intuitive interface when the user feels anxious. Also, the interface adjustment unit may provide an interface including detailed information when the user feels confident. Furthermore, the interface adjustment unit may provide a visually stimulating interface when the user feels excited. In this way, a more comfortable user experience can be achieved by providing an interface according to the user's emotion.

[0092] The security system may further include a notification adjustment unit that estimates the user's emotion and adjusts the notification method based on the estimated user's emotion. For example, the notification adjustment unit provides a simple and clear notification when the user feels anxious. Also, the notification adjustment unit may provide a notification including detailed information when the user feels confident. Furthermore, the notification adjustment unit may provide a visually stimulating notification when the user is excited. This allows for more effective information transmission by providing a notification method according to the user's emotion.

[0093] The security system may further include a training adjustment unit that estimates the user's emotions and adjusts the training program based on the estimated user's emotions. For example, the training adjustment unit may provide a basic training program when the user feels anxious. Also, the training adjustment unit may provide a complex training program when the user feels confident. Furthermore, the training adjustment unit may provide a quick training program when the user is excited. This allows for more effective learning by providing a training program according to the user's emotions.

[0094] The security system may further include a threat information collection unit that collects threat information from different industries and fields. The threat information collection unit may collect threat information from the financial industry, for example, to strengthen measures against phishing attacks. It may also collect threat information from the medical industry to strengthen measures against ransomware attacks. It may also collect threat information from the manufacturing industry to strengthen measures against supply chain attacks. In this way, by collecting threat information from different industries and fields, more diverse security measures are possible.

[0095] The security system may further include a geographic information collection unit that collects geographic threat information. The geographic information collection unit, for example, collects trends of cyber attacks occurring in a specific region and takes measures specific to that region. It may also collect vulnerabilities in different geographical regions and adjust countermeasure methods. Furthermore, it may also create countermeasure software for a specific region based on the geographic threat information. In this way, by collecting geographical threat information, more realistic security measures may be possible.

[0096] The security system may further include a trend analysis unit that analyzes trends on social media. The trend analysis unit generates an attack scenario based on vulnerabilities that are hot topics on social media, for example. It is also possible to analyze trends on social media and simulate related defense methods. Furthermore, it is also possible to generate new attack methods and defense methods based on information on social media. In this way, it is possible to simulate the latest attack methods and defense methods by analyzing trends on social media.

[0097] The security system may further include an operation adjustment unit that estimates the user's emotions and adjusts the system's operation based on the estimated user's emotions. For example, the operation adjustment unit stabilizes the system's operation and provides predictable operation when the user feels anxious. Also, the operation adjustment unit may make the system's operation flexible and enable complex operations when the user feels confident. Furthermore, the operation adjustment unit may make the system's operation quicker and provide instant feedback when the user is excited. This allows for a more comfortable user experience by providing the system's operation according to the user's emotions.

[0098] The security system may further include a performance adjustment unit that estimates the user's emotions and adjusts the system performance based on the estimated user's emotions. For example, the performance adjustment unit stabilizes the system performance and provides predictable operation when the user feels anxious. Also, the performance adjustment unit may improve the system performance and enable complex operations when the user feels confident. Furthermore, the performance adjustment unit may speed up the system performance and provide instant feedback when the user is excited. This allows for a more comfortable user experience by providing the system performance according to the user's emotions.

[0099] The process flow of the second embodiment will be briefly described below.

[0100] Step 1: The attack simulation unit uses the generation AI to perform an attack simulation. For example, it performs an attack simulation by incorporating the latest technologies and methods, discovers new vulnerabilities, and simulates an attack method that utilizes them. It can also generate new attack methods by referring to past attack data. Step 2: The defense simulation unit uses the generation AI to perform a defense simulation. For example, it creates a patch for the discovered vulnerability and simulates how to prevent an attack. It can also generate new defense methods by referring to past defense data. Step 3: The result collection unit collects the simulation results of the attack simulation unit and the defense simulation unit. For example, the collection method can be optimized by referring to past simulation results. Step 4: The countermeasure creation unit creates countermeasure software based on the collected simulation results. For example, it can also generate new countermeasure methods by referring to past countermeasure data.

[0101] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires a voice indicating a user input for the result of the specific processing. The control unit 46A transmits the voice data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0102] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (registered trademark) (Internet search<URL: https: / / openai.com / blog / chatgpt> ) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating a voice, text data indicating a text, and image data indicating an image (e.g., still image data or video data) are input. The data generation model 58 infers the input inference data according to the instruction indicated by the prompt, and outputs the inference result in one or more data formats of voice data, text data, and image data. The data generation model 58 includes, for example, a text generation AI, an image generation AI, and a multimodal generation AI. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specification processing unit 290 performs the above-mentioned specification processing while using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction, and in this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. In the data processing device 12 and the like, the data generation model 58 includes a plurality of types, and the data generation model 58 includes an AI other than the generation AI. The AI ​​other than the generation AI is, for example, a linear regression, a logistic regression, a decision tree, a random forest, a support vector machine (SVM), a k-means clustering, a convolutional neural network (CNN), a recurrent neural network (RNN), a generative adversarial network (GAN), or a naive Bayes, and can perform various processes, but is not limited to such examples. The AI ​​may also be an AI agent. In addition, when the processes of each of the above-mentioned parts are performed by an AI, the processes are performed in part or in whole by the AI, but are not limited to such examples.In addition, processing performed by AI including the generation AI may be replaced with rule-based processing, and rule-based processing may be replaced with processing performed by AI including the generation AI.

[0103] Furthermore, the above-described processing by the data processing system 10 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart device 14, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart device 14. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the smart device 14 or an external device, and the smart device 14 acquires or collects information required for processing from the data processing device 12 or an external device.

[0104] Each of the multiple elements including the attack simulation unit, defense simulation unit, result collection unit, and countermeasure creation unit described above is realized, for example, by at least one of the smart device 14 and the data processing device 12. For example, the attack simulation unit is realized by the processor 46 of the smart device 14, and performs an attack simulation incorporating the latest technology and methods. The defense simulation unit is realized, for example, by the specific processing unit 290 of the data processing device 12, and creates a patch for a discovered vulnerability and simulates a method of preventing an attack. The result collection unit is realized, for example, by the control unit 46A of the smart device 14, and collects the simulation results of the attack simulation unit and the defense simulation unit. The countermeasure creation unit is realized, for example, by the specific processing unit 290 of the data processing device 12, and creates countermeasure software based on the collected simulation results. The correspondence between each unit and the device or control unit is not limited to the above example, and various changes are possible.

[0105] [Second embodiment] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0106] 3, the data processing system 210 includes the data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0107] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0108] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0109] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs the voice according to instructions from the processor 46.

[0110] Camera 42 is a small digital camera equipped with an optical system including a lens, an aperture, and a shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (e.g., an imaging range defined by an angle of view equivalent to the width of the field of vision of an average healthy person).

[0111] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is performed in a secure state.

[0112] Fig. 4 shows an example of main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0113] The processor 28 reads the specific processing program 56 from the storage 32, and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0114] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the emotion of the user using the emotion identification model 59 and perform identification processing using the user's emotion. In the emotion estimation function (emotion identification function) using the emotion identification model 59, various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, are performed, but are not limited to such examples. In addition, the estimation and prediction of the emotion also include, for example, analysis of the emotion.

[0115] In the smart glasses 214, the specific processing is performed by the processor 46. The storage 50 stores a specific processing program 60. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. Note that the smart glasses 214 have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can also perform processing similar to that of the specific processing unit 290 using these models.

[0116] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 obtains a processing result (such as a prediction result) using the data generation model 58 by communicating with the server device having the data generation model 58. In addition, the data processing device 12 may be a server device, or may be a terminal device (such as a mobile phone, a robot, or a home appliance) owned by a user.

[0117] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires a voice indicating a user input for the result of the specific processing. The control unit 46A transmits the voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0118] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating a voice, text data indicating a text, and image data indicating an image (e.g., still image data or video data) is input. The data generation model 58 infers the input inference data according to the instruction indicated by the prompt, and outputs the inference result in one or more data formats of voice data, text data, and image data. The data generation model 58 includes, for example, a text generation AI, an image generation AI, and a multimodal generation AI. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specification processing unit 290 performs the above-mentioned specification processing while using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction, and in this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. In the data processing device 12 and the like, the data generation model 58 includes a plurality of types, and the data generation model 58 includes an AI other than the generation AI. The AI ​​other than the generation AI is, for example, a linear regression, a logistic regression, a decision tree, a random forest, a support vector machine (SVM), a k-means clustering, a convolutional neural network (CNN), a recurrent neural network (RNN), a generative adversarial network (GAN), or a naive Bayes, and can perform various processes, but is not limited to such examples. The AI ​​may be an AI agent. In addition, when the processes of each part described above are performed by an AI, the processes are performed in part or in whole by the AI, but are not limited to such examples. In addition, the processes performed by the AI ​​including the generation AI may be replaced with rule-based processes, and the rule-based processes may be replaced with processes performed by the AI ​​including the generation AI.

[0119] The data processing system 210 according to the second embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 210 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart glasses 214, but may be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart glasses 214. In addition, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the smart glasses 214 or an external device, and the smart glasses 214 acquires or collects information required for processing from the data processing device 12 or an external device.

[0120] Each of the multiple elements including the attack simulation unit, defense simulation unit, result collection unit, and countermeasure creation unit described above is realized, for example, by at least one of the smart glasses 214 and the data processing device 12. For example, the attack simulation unit is realized by the processor 46 of the smart glasses 214, and performs an attack simulation incorporating the latest technology and methods. The defense simulation unit is realized, for example, by the specific processing unit 290 of the data processing device 12, and creates a patch for a discovered vulnerability and simulates a method of preventing an attack. The result collection unit is realized, for example, by the control unit 46A of the smart glasses 214, and collects the simulation results of the attack simulation unit and the defense simulation unit. The countermeasure creation unit is realized, for example, by the specific processing unit 290 of the data processing device 12, and creates countermeasure software based on the collected simulation results. The correspondence between each unit and the device or control unit is not limited to the above example, and various changes are possible.

[0121] [Third embodiment] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[0122] 5, the data processing system 310 includes the data processing device 12 and a headset type terminal 314. An example of the data processing device 12 is a server.

[0123] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0124] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[0125] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs the voice according to instructions from the processor 46.

[0126] Camera 42 is a small digital camera equipped with an optical system including a lens, an aperture, and a shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (e.g., an imaging range defined by an angle of view equivalent to the width of the field of vision of an average healthy person).

[0127] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is performed in a secure state.

[0128] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0129] The processor 28 reads the specific processing program 56 from the storage 32, and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0130] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the emotion of the user using the emotion identification model 59 and perform identification processing using the user's emotion. In the emotion estimation function (emotion identification function) using the emotion identification model 59, various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, are performed, but are not limited to such examples. In addition, the estimation and prediction of the emotion also include, for example, analysis of the emotion.

[0131] In the headset type terminal 314, the specific processing is performed by the processor 46. The storage 50 stores a specific program 60. The processor 46 reads the specific program 60 from the storage 50, and executes the read specific program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific program 60 executed on the RAM 48. Note that the headset type terminal 314 has a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can also perform processing similar to that of the identification processing unit 290 using these models.

[0132] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 obtains a processing result (such as a prediction result) using the data generation model 58 by communicating with the server device having the data generation model 58. In addition, the data processing device 12 may be a server device, or may be a terminal device (such as a mobile phone, a robot, or a home appliance) owned by a user.

[0133] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input for the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0134] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating a voice, text data indicating a text, and image data indicating an image (e.g., still image data or video data) is input. The data generation model 58 infers the input inference data according to the instruction indicated by the prompt, and outputs the inference result in one or more data formats of voice data, text data, and image data. The data generation model 58 includes, for example, a text generation AI, an image generation AI, and a multimodal generation AI. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specification processing unit 290 performs the above-mentioned specification processing while using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction, and in this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. In the data processing device 12 and the like, the data generation model 58 includes a plurality of types, and the data generation model 58 includes an AI other than the generation AI. The AI ​​other than the generation AI is, for example, a linear regression, a logistic regression, a decision tree, a random forest, a support vector machine (SVM), a k-means clustering, a convolutional neural network (CNN), a recurrent neural network (RNN), a generative adversarial network (GAN), or a naive Bayes, and can perform various processes, but is not limited to such examples. The AI ​​may be an AI agent. In addition, when the processes of each part described above are performed by an AI, the processes are performed in part or in whole by the AI, but are not limited to such examples. In addition, the processes performed by the AI ​​including the generation AI may be replaced with rule-based processes, and the rule-based processes may be replaced with processes performed by the AI ​​including the generation AI.

[0135] The data processing system 310 according to the third embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 310 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the headset type terminal 314, but may be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the headset type terminal 314. In addition, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the headset type terminal 314 or an external device, and the headset type terminal 314 acquires or collects information required for processing from the data processing device 12 or an external device.

[0136] Each of the multiple elements including the attack simulation unit, defense simulation unit, result collection unit, and countermeasure creation unit described above is realized, for example, by at least one of the headset type terminal 314 and the data processing device 12. For example, the attack simulation unit is realized by the processor 46 of the headset type terminal 314, and performs an attack simulation incorporating the latest technology and methods. The defense simulation unit is realized, for example, by the specific processing unit 290 of the data processing device 12, and creates a patch for a discovered vulnerability and simulates a method of preventing an attack. The result collection unit is realized, for example, by the control unit 46A of the headset type terminal 314, and collects the simulation results of the attack simulation unit and the defense simulation unit. The countermeasure creation unit is realized, for example, by the specific processing unit 290 of the data processing device 12, and creates countermeasure software based on the collected simulation results. The correspondence between each unit and the device or control unit is not limited to the above example, and various changes are possible.

[0137] [Fourth embodiment] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[0138] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0139] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0140] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[0141] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs the voice according to instructions from the processor 46.

[0142] Camera 42 is a small digital camera equipped with an optical system including a lens, an aperture, and a shutter, and an imaging element such as a CMOS image sensor or a CCD image sensor, and captures images of the user's surroundings (e.g., an imaging range defined by an angle of view equivalent to the width of the field of vision of a typical healthy person).

[0143] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is performed in a secure state.

[0144] The control object 443 includes a display device, LEDs in the eyes, and motors for driving the arms, hands, and legs. The posture and behavior of the robot 414 are controlled by controlling the motors of the arms, hands, and legs. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[0145] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0146] The processor 28 reads the specific processing program 56 from the storage 32, and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0147] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the emotion of the user using the emotion identification model 59 and perform identification processing using the user's emotion. In the emotion estimation function (emotion identification function) using the emotion identification model 59, various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, are performed, but are not limited to such examples. In addition, the estimation and prediction of the emotion also include, for example, analysis of the emotion.

[0148] In the robot 414, the specific processing is performed by the processor 46. The storage 50 stores a specific program 60. The processor 46 reads out the specific program 60 from the storage 50, and executes the specific program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific program 60 executed on the RAM 48. The robot 414 has a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can also perform processing similar to that of the specific processing unit 290 using these models.

[0149] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 obtains a processing result (such as a prediction result) using the data generation model 58 by communicating with the server device having the data generation model 58. In addition, the data processing device 12 may be a server device, or may be a terminal device (such as a mobile phone, a robot, or a home appliance) owned by a user.

[0150] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires a voice indicating a user input for the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0151] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating a voice, text data indicating a text, and image data indicating an image (e.g., still image data or video data) is input. The data generation model 58 infers the input inference data according to the instruction indicated by the prompt, and outputs the inference result in one or more data formats of voice data, text data, and image data. The data generation model 58 includes, for example, a text generation AI, an image generation AI, and a multimodal generation AI. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specification processing unit 290 performs the above-mentioned specification processing while using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction, and in this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. In the data processing device 12 and the like, the data generation model 58 includes a plurality of types, and the data generation model 58 includes an AI other than the generation AI. The AI ​​other than the generation AI is, for example, a linear regression, a logistic regression, a decision tree, a random forest, a support vector machine (SVM), a k-means clustering, a convolutional neural network (CNN), a recurrent neural network (RNN), a generative adversarial network (GAN), or a naive Bayes, and can perform various processes, but is not limited to such examples. The AI ​​may be an AI agent. In addition, when the processes of each part described above are performed by an AI, the processes are performed in part or in whole by the AI, but are not limited to such examples. In addition, the processes performed by the AI ​​including the generation AI may be replaced with rule-based processes, and the rule-based processes may be replaced with processes performed by the AI ​​including the generation AI.

[0152] The data processing system 410 according to the fourth embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 410 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the robot 414, but may be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the robot 414. In addition, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the robot 414 or an external device, etc., and the robot 414 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0153] Each of the multiple elements including the attack simulation unit, defense simulation unit, result collection unit, and countermeasure creation unit described above is realized, for example, by at least one of the robot 414 and the data processing device 12. For example, the attack simulation unit is realized by the processor 46 of the robot 414, and performs an attack simulation incorporating the latest technology and methods. The defense simulation unit is realized, for example, by the specific processing unit 290 of the data processing device 12, and creates a patch for a discovered vulnerability and simulates a method of preventing an attack. The result collection unit is realized, for example, by the control unit 46A of the robot 414, and collects the simulation results of the attack simulation unit and the defense simulation unit. The countermeasure creation unit is realized, for example, by the specific processing unit 290 of the data processing device 12, and creates countermeasure software based on the collected simulation results. The correspondence between each unit and the device or control unit is not limited to the above example, and various changes are possible.

[0154] The emotion identification model 59 as an emotion engine may determine the emotion of the user according to a specific mapping. Specifically, the emotion identification model 59 may determine the emotion of the user according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the emotion of the robot, and the identification processing unit 290 may perform identification processing using the emotion of the robot.

[0155] FIG. 9 is a diagram showing an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. The closer to the center of the concentric circles, the more primitive emotions are arranged. The more outside the concentric circles, the more emotions that represent states and actions that arise from a state of mind are arranged. Emotions are a concept that includes emotions and mental states. On the left side of the concentric circles, emotions that are generally generated from reactions that occur in the brain are arranged. On the right side of the concentric circles, emotions that are generally induced by situational judgment are arranged. On the upper and lower sides of the concentric circles, emotions that are generally generated from reactions that occur in the brain and are induced by situational judgment are arranged. In addition, on the upper side of the concentric circles, emotions of "pleasure" are arranged, and on the lower side, emotions of "discomfort" are arranged. In this way, in the emotion map 400, multiple emotions are mapped based on the structure in which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[0156] These emotions are distributed in the 3 o'clock direction of emotion map 400 and usually fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[0157] The inside of emotion map 400 represents what is going on inside one's mind, and the outside of emotion map 400 represents behavior, so the further out you go on emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[0158] Here, human emotions are based on various balances such as posture and blood sugar level, and when these balances are far from the ideal, it indicates an unpleasant state, and when they are close to the ideal, it indicates a pleasant state. Emotions can also be created for robots, cars, motorcycles, etc., based on various balances such as posture and battery level, so that when these balances are far from the ideal, it indicates an unpleasant state, and when they are close to the ideal, it indicates a pleasant state. The emotion map may be generated, for example, based on the emotion map of Dr. Mitsuyoshi (Research on speech emotion recognition and emotion brain physiological signal analysis system, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). On the left half of the emotion map, emotions belonging to an area called "reaction" where sensation is dominant are lined up. On the right half of the emotion map, emotions belonging to an area called "situation" where situation recognition is dominant are lined up.

[0159] The emotion map defines two emotions that promote learning. The first is the negative emotion around the middle of "repentance" or "remorse" on the situation side. In other words, this is when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is the positive emotion around "desire" on the response side. In other words, this is when the robot has positive feelings such as "I want more" or "I want to know more."

[0160] The emotion identification model 59 inputs the user input to a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the emotion of the user. This neural network is pre-trained based on multiple learning data that are combinations of the user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in Fig. 10. Fig. 10 shows an example in which multiple emotions, "relief," "calm," and "encouraging," have similar emotion values.

[0161] In the above embodiment, an example was given in which a specific process is performed by one computer 22, but the technology disclosed herein is not limited to this, and distributed processing of the specific process may be performed by multiple computers, including computer 22.

[0162] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable computer-readable non-transitory storage medium such as a Universal Serial Bus (USB) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[0163] In addition, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 upon request from the data processing device 12.

[0164] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[0165] As the hardware resource for executing the specific process, various processors as shown below can be used. An example of the processor is a CPU, which is a general-purpose processor that functions as a hardware resource for executing the specific process by executing software, i.e., a program. Another example of the processor is a dedicated electric circuit, which is a processor having a circuit configuration designed exclusively for executing a specific process, such as a Field-Programmable Gate Array (FPGA), a Programmable Logic Device (PLD), or an Application Specific Integrated Circuit (ASIC). Each processor has a built-in or connected memory, and each processor executes the specific process by using the memory.

[0166] The hardware resource that executes the specific process may be one of these various processors, or may be a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific process may be a single processor.

[0167] As an example of a configuration using one processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a configuration using a processor that realizes the functions of the entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[0168] Furthermore, more specifically, the hardware structure of these various processors can be an electric circuit that combines circuit elements such as semiconductor elements. The above specific processes are merely examples. It goes without saying that unnecessary steps may be deleted, new steps may be added, or the order of processes may be changed without departing from the spirit of the invention.

[0169] In the above example, the first to fourth embodiments are described separately, but some or all of these embodiments may be combined. The smart device 14, the smart glasses 214, the headset terminal 314, and the robot 414 are only examples, and they may be combined with each other, or may be other devices. In the above example, the first and second embodiments are described separately, but they may be combined.

[0170] The above description and illustrations are detailed descriptions of the parts related to the technology of the present disclosure, and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, function, action, and effect is an example of the configuration, function, action, and effect of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replaced with respect to the description and illustrations shown above, within the scope of the gist of the technology of the present disclosure. In addition, in order to avoid confusion and to facilitate understanding of the parts related to the technology of the present disclosure, the description and illustrations shown above omit explanations of technical common sense that do not require particular explanation in enabling the implementation of the technology of the present disclosure.

[0171] All publications, patent applications, and standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, and standard was specifically and individually indicated to be incorporated by reference.

[0172] (Appendix 1) an attack simulation unit that performs an attack simulation; a defense simulation unit that simulates a defense measure based on the vulnerability discovered by the attack simulation unit; a result collection unit that collects simulation results of the attack simulation unit and the defense simulation unit; A countermeasure creation unit that creates countermeasure software based on the simulation results collected by the result collection unit. A system characterized by: (Appendix 2) The attack simulation unit: Conduct attack simulations by specifically incorporating the latest technologies and methods 2. The system of claim 1, (Appendix 3) The defense simulation unit Create patches for discovered vulnerabilities and simulate how to prevent attacks 2. The system of claim 1, (Appendix 4) The result collection unit: Collect the simulation results of the attack simulation part and the defense simulation part 2. The system of claim 1, (Appendix 5) The measure creation unit Create countermeasure software based on the collected simulation results 2. The system of claim 1, (Appendix 6) The attack simulation unit: Estimate user emotions and adjust attack simulation scenarios based on the estimated user emotions. 2. The system of claim 1, (Appendix 7) The attack simulation unit: Generate new attack methods by referencing past attack data 2. The system of claim 1, (Appendix 8) The attack simulation unit: Conduct simulations that consider vulnerabilities in specific industries and fields 2. The system of claim 1, (Appendix 9) The attack simulation unit: Estimate user emotions and prioritize attack simulations based on the estimated user emotions. 2. The system of claim 1, (Appendix 10) The attack simulation unit: Conduct simulations taking into account geographic threat information 2. The system of claim 1, (Appendix 11) The attack simulation unit: Analyzing social media trends and simulating related attack methods 2. The system of claim 1, (Appendix 12) The defense simulation unit To estimate a user's emotion and adjust a defense simulation scenario based on the estimated user's emotion. 2. The system of claim 1, (Appendix 13) The defense simulation unit Generate new defense methods by referencing past defense data 2. The system of claim 1, (Appendix 14) The defense simulation unit Conduct simulations taking into account defense methods from different industries and fields 2. The system of claim 1, (Appendix 15) The defense simulation unit To estimate a user's emotion and determine a priority of a defense simulation based on the estimated user's emotion. 2. The system of claim 1, (Appendix 16) The defense simulation unit Conduct simulations taking into account geographic threat information 2. The system of claim 1, (Appendix 17) The defense simulation unit Analyze social media trends and simulate related defense techniques 2. The system of claim 1, (Appendix 18) The result collection unit: Estimate user's emotions and determine the priority of simulation results to be collected based on the estimated user's emotions. 2. The system of claim 1, (Appendix 19) The result collection unit: Refer to past simulation results to specifically improve collection methods 2. The system of claim 1, (Appendix 20) The result collection unit: Estimate user emotions and adjust the display method of collected simulation results based on the estimated user emotions. 2. The system of claim 1, (Appendix 21) The result collection unit: Consider geographic threat information collection 2. The system of claim 1, (Appendix 22) The measure creation unit Estimate user emotions and adjust the way the software is created based on the estimated user emotions 2. The system of claim 1, (Appendix 23) The measure creation unit Generate new countermeasures by referencing past countermeasure data 2. The system of claim 1, (Appendix 24) The measure creation unit Estimate user emotions and prioritize security software based on the estimated user emotions 2. The system of claim 1, (Appendix 25) The measure creation unit Develop countermeasures taking geographic threat information into account 2. The system of claim 1, [Explanation of symbols]

[0173] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot

Claims

1. an attack simulation unit that performs an attack simulation; a defense simulation unit that simulates a defense measure based on the vulnerability discovered by the attack simulation unit; a result collection unit that collects simulation results of the attack simulation unit and the defense simulation unit; A countermeasure creation unit that creates countermeasure software based on the simulation results collected by the result collection unit. A system characterized by:

2. The defense simulation unit Create patches for discovered vulnerabilities and simulate how to prevent attacks 2. The system of claim 1 .

3. The attack simulation unit: Estimate user emotions and adjust attack simulation scenarios based on the estimated user emotions.

2. The system of claim 1 .

4. The attack simulation unit: Generate new attack methods by referencing past attack data 2. The system of claim 1 .

5. The measure creation unit Develop countermeasures taking geographic threat information into account 2. The system of claim 1 .

6. The defense simulation unit Analyze social media trends and simulate related defense techniques 2. The system of claim 1 .

Images