System

Abstract

A system is provided.SOLUTION: A system, comprising: means for collecting data; means for training an anomaly detection model; means for detecting an anomaly; and means for reporting the detected anomaly.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] Conventional system monitoring relies on the experience and intuition of administrators, making it difficult to accurately and quickly detect anomalies. Furthermore, there is a lack of effective means for monitoring complex IT infrastructures and the latest general-purpose AI. Therefore, to ensure system reliability and security, advanced anomaly detection and real-time response are required. The present invention aims to solve these issues and provide a means for automatically detecting system anomalies and quickly notifying them. [Means for solving the problem]

[0005] The present invention provides a system that includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, and a means for notifying detected anomalies. By using the Isolation Forest algorithm as the anomaly detection model, highly accurate anomaly detection is achieved. Furthermore, by including a means for collecting real-time data and inputting it into the anomaly detection model, the system can quickly notify identified anomalies, improving the safety and reliability of the system.

[0006] "Data collection means" refers to devices or programs for acquiring data on the operational status and performance of a system.

[0007] An "anomaly detection model" is a machine learning algorithm or statistical model used to analyze collected data and identify anomalies that deviate from normal behavior.

[0008] A "training means" is a device or program that uses past data to train the anomaly detection model and executes a process to improve the accuracy of anomaly detection.

[0009] "Means for detecting anomalies" refers to a mechanism or program that uses a trained anomaly detection model to identify anomalies in newly acquired data.

[0010] "Means of notification" refers to devices or programs that notify administrators or system users of detected abnormalities, and includes formats such as alerts, emails, and dashboard displays. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 11] FIG. 3 is a sequence diagram showing a processing flow of the data processing system according to the first embodiment. [Figure 12] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 1. [Figure 13] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system according to the second embodiment when an emotion engine is combined. [Figure 14] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 2 when an emotion engine is combined. DETAILED DESCRIPTION OF THE INVENTION

[0012] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0013] First, the terms used in the following description will be explained.

[0014] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, a processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), and an APU (Accelerated Processing Unit).

[0015] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0016] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0017] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), Bluetooth (registered trademark), etc.

[0018] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0019] [First embodiment]

[0020] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0021] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0022] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0023] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0024] The reception device 38 includes a touch panel 38A, a microphone 38B, and the like, and receives user input. The touch panel 38A detects contact with an indicator (for example, a pen or a finger) to receive user input by the touch of the indicator. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0025] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form of expression that the user 20 can perceive (for example, audio and / or text). The display 40A displays visible information such as text and images in accordance with instructions from the processor 46. The speaker 40B outputs audio in accordance with instructions from the processor 46. The camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0026] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0027] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0028] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0029] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0030] In the smart device 14, the processor 46 performs the reception output process. The storage 50 stores a reception output program 60. The reception output program 60 is used in conjunction with the specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0031] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0032] The present invention relates to a system monitoring system using AI, and includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, and a means for notifying detected anomalies. Below, specific embodiments of the present invention will be described.

[0033] Overview of program processing

[0034] Servers use data collection tools to collect system status and performance data, such as sensors and log file analysis tools that record system logs and performance metrics.

[0035] The collected data is input into a means for training an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model. The server uses this data to train the anomaly detection model and learn normal behavior patterns.

[0036] The server then uses the trained model to analyze newly collected data in real time to detect anomalies, and if an anomaly is detected, the server alerts administrators through notification mechanisms, which may include sending email alerts, displaying warnings on a dashboard, or triggering automated response systems.

[0037] Specific examples

[0038] For example, consider a system that monitors a company's entire IT infrastructure. Here's a specific scenario:

[0039] 1. The server collects log data from various servers and network devices within the company and sends it to a central server using a data collection tool. The data collection tool periodically executes queries to collect the necessary logs.

[0040] 2. The server trains an anomaly detection model based on the collected data. The server uses historical data to fit the Isolation Forest model, learning the normal behavior patterns of the system and establishing criteria for detecting anomalies when they occur.

[0041] 3. The server applies an anomaly detection model to newly collected data in real time to determine whether there are any anomalies. For example, if a specific server's CPU usage rate suddenly increases, this will be detected as an anomaly.

[0042] 4. If an anomaly is detected, the server will use its notification methods to alert the administrator, not only sending an alert email but also displaying the anomaly on the web dashboard and, if necessary, running scripts to automatically fix the anomaly.

[0043] 5. Users receive notifications and access the dashboard to view details of the anomaly, identify the cause of the anomaly, and take the necessary measures promptly.

[0044] In this way, the system of the present invention enables early detection of abnormalities and rapid response, significantly improving the reliability and security of the system, reducing the burden on administrators and improving the operational efficiency of the entire IT infrastructure.

[0045] The processing flow will be explained below.

[0046] Step 1:

[0047] The server collects system performance data and log data. The data collection means periodically acquires necessary log information from each server and network device and stores it in the central server.

[0048] Step 2:

[0049] The server performs initial processing of the collected data, cleansing and standardizing the format, and shaping it into a form suitable for training an anomaly detection model.

[0050] Step 3:

[0051] The server uses the initially processed data to train an anomaly detection model (Isolation Forest algorithm), which learns normal behavior patterns based on past data.

[0052] Step 4:

[0053] The server stores the trained anomaly detection model and begins anomaly detection on newly collected data in real time.

[0054] Step 5:

[0055] The server inputs newly collected data into the anomaly detection model in real time to evaluate whether anomalies exist, and if any are detected, records their index.

[0056] Step 6:

[0057] The server will alert administrators to detected anomalies using notification methods, which may include sending email alerts, displaying warnings on the dashboard, or triggering automated response systems.

[0058] Step 7:

[0059] Users receive a notification and access the dashboard to check detailed information about the anomaly, understand where the anomaly occurred, its details, and take appropriate measures.

[0060] Step 8:

[0061] After the user responds, the server reevaluates the system's operating status and checks whether the abnormality has been resolved. It also performs continuous monitoring to prevent the abnormality from recurring.

[0062] In this way, early detection of abnormalities and countermeasures can be implemented, improving the reliability and security of the system.

[0063] Example 1

[0064] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0065] Conventional system monitoring relies on periodic checks and manual analysis, which makes it difficult to detect abnormalities early and to respond quickly, which not only reduces system reliability but also increases the burden on administrators.

[0066] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0067] In this invention, the server includes means for collecting data using a log collection device, means for training an anomaly detection model using the collected data, means for detecting anomalies in real time using the trained anomaly detection model, and means for notifying an administrator of detected anomalies, thereby enabling early detection of anomalies and rapid response.

[0068] A "log collection device" is a device that collects various system logs and performance metrics and sends them to a central repository.

[0069] "Means for collecting data" refers to the means for aggregating system logs and performance data and transmitting the necessary information to a central server.

[0070] An "anomaly detection model" is a model equipped with an algorithm for detecting anomalies based on collected data.

[0071] "Isolation Forest" is an algorithm that detects anomalies by randomly subsampling data and measuring how isolated that data is from other data points.

[0072] A "training means" is a means for training an anomaly detection model using past data.

[0073] "Means for detecting anomalies in real time" refers to means for detecting anomalies by using a trained anomaly detection model to instantly analyze collected data.

[0074] "Means of notification" refers to the means by which a warning is sent to an administrator about a detected anomaly, including sending an alert email, displaying a warning on a dashboard, or triggering an automated response system.

[0075] The present invention relates to a system monitoring system using AI, which collects data using a log collection device, trains an anomaly detection model, detects anomalies in real time, and notifies an administrator of the anomalies. Hereinafter, specific embodiments of the present invention will be described.

[0076] Servers use log collection devices to collect system status and performance data. Specifically, log collection tools (e.g., Fluentd or Logstash) are used to collect various system logs and performance metrics and send them to a central repository. This aggregates the necessary log data, preparing to visualize the current status of the system.

[0077] Next, the server uses the collected data to train an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model in this process. The server uses the Python scikit-learn library to input past log data and fit the Isolation Forest model to learn normal behavior patterns. The trained model is saved to disk as a file (e.g., trained_model.pkl).

[0078] The server uses the trained anomaly detection model to analyze newly collected data in real time. As data is collected, it runs the data through the anomaly detection model and calculates an anomaly score. Specifically, by using a real-time processing platform (e.g., Kafka), analysis begins as soon as the data arrives.

[0079] If an anomaly is detected, the server will notify the administrator. This notification method can include sending an alert email, displaying a warning on the dashboard, or triggering an automated response system. For example, if the anomaly score exceeds a certain threshold, an alert email will be sent using the SMTP protocol, and JSON-formatted data containing the details of the anomaly will be sent as a POST request to the Webhook URL.

[0080] Finally, users receive a notification and can access the system dashboard to view details of the anomaly. Users can then identify the cause of the anomaly and quickly take necessary measures. This enables early detection of anomalies and rapid response, significantly improving system reliability and security. It also reduces the burden on administrators and improves the operational efficiency of the entire IT infrastructure.

[0081] Prompt Sentence Examples

[0082] "Analyze the server's anomaly detection log and determine whether an anomaly has occurred. If an anomaly has occurred, explain the details."

[0083] "Describe the process of training an anomaly detection model based on collected system log data."

[0084] "Please explain in detail how this anomaly detection system works when a server's CPU usage is abnormally high."

[0085] In this way, the system of the present invention incorporates an anomaly detection and notification process using a generative AI model, enabling monitoring of the system's operating status and rapid response when problems occur.

[0086] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0087] Step 1:

[0088] Servers use log collectors to collect system logs and performance metrics. Specifically, log collectors such as Fluentd and Logstash pull data from various systems and send it to a central repository. The input to this process is log data and metrics data, and the output is aggregated data stored in the central repository. The server configures the type and frequency of data to collect and runs queries to keep the data up to date.

[0089] Step 2:

[0090] The server trains an anomaly detection model based on the data stored in the central repository. In this process, the Isolation Forest algorithm is used to build the anomaly detection model. The input is historical system log data, and the output is the trained anomaly detection model. Specifically, the Python scikit-learn library is used to fit the model and learn normal behavior patterns. The training results are saved in a file format (e.g., trained_model.pkl).

[0091] Step 3:

[0092] The server uses the trained anomaly detection model to analyze newly collected data in real time. This process is performed automatically using a real-time processing platform (e.g., Kafka) whenever new log data arrives. The input is the newly collected log data, and the output is an anomaly score. The server applies the model to the collected data to determine whether it is an anomaly.

[0093] Step 4:

[0094] If an anomaly is detected, the server will notify the administrator by sending an alert email, displaying a warning on the dashboard, triggering an automatic response system, etc. The input to this process is the anomaly score generated in step 3, and the output is a notification to the administrator. For example, if the anomaly score exceeds a set threshold, the server will send an alert email to the administrator using the SMTP protocol and send data containing the anomaly details to the Webhook URL as a POST request.

[0095] Step 5:

[0096] The user receives a notification from the server and accesses the system dashboard to check the details of the abnormality. The input is the notification data from the server, and the output is detailed information about the abnormality. The user refers to the dashboard, identifies the cause of the abnormality, and takes necessary measures. The user can click on the abnormality entry to check detailed information and take prompt action.

[0097] This process flow enables the system to detect abnormalities early and respond quickly and appropriately.

[0098] (Application example 1)

[0099] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0100] In today's corporate environment, there is a need to quickly detect system anomalies and security threats and respond immediately. However, conventional monitoring systems have issues with delays in training models to detect anomalies and in notifications, making it difficult to respond in real time. In addition, there are insufficient means to promptly notify administrators of the results of anomaly detection, making it difficult to maintain system reliability and operational efficiency.

[0101] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0102] In this invention, the server includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, a means for notifying detected anomalies, a means for sending a push notification to an administrator using a smartphone, and a means for analyzing data in real time and displaying the data on a dashboard. This enables rapid detection and response to anomalies, enables an administrator to check the details of anomalies in real time, and significantly improves the system security of a company.

[0103] "Data collection means" refers to devices and software for collecting system operation status and performance data on a central server.

[0104] "Means for training an anomaly detection model" refers to the process of using collected data to train an anomaly detection algorithm and define normal operating patterns.

[0105] "Means for detecting anomalies" refers to the process of analyzing newly collected data in real time using a trained anomaly detection model to identify anomalies.

[0106] "Means for notifying detected abnormalities" refers to devices or software that send an alert to an administrator when an abnormality is detected.

[0107] "Means of sending push notifications to administrators using smartphones" refers to a function that immediately notifies administrators via a smartphone application when an abnormality is detected.

[0108] "Means for analyzing data in real time and displaying it on a dashboard" refers to a function for analyzing data collected in real time and displaying the results on a dashboard so that the user can visually confirm them.

[0109] The present invention relates to a system monitoring system using AI, and includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, a means for notifying an administrator of detected anomalies, a means for sending a push notification to an administrator using a smartphone, and a means for analyzing data in real time and displaying it on a dashboard. A specific embodiment of the present invention will be described below.

[0110] Program processing overview

[0111] The server uses data collection means to collect system operation status and performance data. This includes sensors that record system logs and performance metrics, and log file analysis tools. The collected data is input into means for training an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model. The server uses this data to train the anomaly detection model and learns normal operating patterns. The server then uses the trained model to analyze newly collected data in real time and detect anomalies. If an anomaly is detected, the server will alert the administrator through notification means. This can include sending an alert email, displaying a warning on the dashboard, and also sending push notifications via smartphones.

[0112] Hardware and software used

[0113] Hardware: Servers, smartphones, sensors

[0114] Software: Python, Flask, scikit-learn, smartphone application

[0115] Data processing and calculation

[0116] The server collects log data from network devices and systems, preprocesses it, and inputs it into an anomaly detection model. The main algorithm used is Isolation Forest, which uses past log data to train the anomaly detection model. The resulting model analyzes real-time data and detects anomalies. Detected anomalies are immediately sent to the administrator's smartphone as a push notification. The analysis results are then visually displayed on a dashboard, allowing the administrator to check the details.

[0117] Specific examples

[0118] For example, consider a system that monitors a company's entire IT infrastructure. The server collects log data from various servers and network devices within the company and sends it to a central server using a data collection method. An anomaly detection model is trained based on the collected data. The server uses past data to fit an Isolation Forest model and learns the normal operating patterns of the system. This model is applied to newly collected data in real time to determine whether an anomaly exists. For example, a sudden increase in CPU usage on a specific server is detected as an anomaly. If an anomaly is detected, the server sends a warning to the administrator using a notification method. In addition to sending an alert email, a push notification is sent to the administrator's smartphone and the anomaly is displayed on a web dashboard. The administrator receives the notification and accesses the dashboard to check the details of the anomaly. This allows the cause of the anomaly to be identified and necessary measures to be taken promptly.

[0119] Prompt Sentence Examples

[0120] "Analyze new data using an anomaly detection model and notify me if there are any anomalies:

[0121] CPU usage, memory usage, network traffic"

[0122] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0123] Step 1: Data collection

[0124] The server collects system operation status and performance data. Specifically, it periodically collects log data from network devices and servers and sends it to a central server. The input data is the log files and sensor data of each device, and the output is data stored on the central server.

[0125] Step 2: Data Preprocessing

[0126] The server preprocesses the collected raw data, specifically filtering the raw data, imputing missing values, removing noise, etc. The input is the raw data collected in step 1, and the output is the preprocessed, clean data.

[0127] Step 3: Training the anomaly detection model

[0128] The server uses the preprocessed data to train an anomaly detection model. Specifically, it uses the Isolation Forest algorithm to learn normal behavior patterns. The input is the preprocessed data from step 2, and the output is the trained anomaly detection model.

[0129] Step 4: Analyzing real-time data

[0130] The server applies the anomaly detection model to newly collected data in real time. Specifically, the collected data is input into the model to determine whether there are any anomalies. The input is the raw data collected in real time, and the output is the anomaly detection result.

[0131] Step 5: Notification of abnormalities

[0132] If an abnormality is detected, the server will issue a warning to the administrator using a notification method. Specifically, in addition to sending an email or displaying a warning on the dashboard, it will also send a push notification to the smartphone. The input is the abnormality detection result in step 4, and the output is a notification to the administrator.

[0133] Step 6: Display the data in a dashboard

[0134] The server displays the analysis results on a dashboard. Specifically, it visually displays the anomaly detection results so that administrators can check them in real time. The input is the data obtained in steps 4 and 5, and the output is the analysis results displayed on the dashboard.

[0135] Step 7: Administrator Action

[0136] The user (administrator) receives the notification and accesses the dashboard to check the details of the anomaly. Specifically, based on the anomaly data on the dashboard, the user identifies the cause of the anomaly and takes necessary measures. The input is the notification and data display in Step 5 and Step 6, and the output is the measures to be taken against the anomaly.

[0137] Furthermore, an emotion engine that estimates the user's emotion may be combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0138] The present invention combines an AI-based system monitoring system with an emotion engine that recognizes user emotions, and describes a system that includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, a means for notifying detected anomalies, and an emotion engine.

[0139] Overview of program processing

[0140] The server uses data collection methods to collect system status and performance data, including sensors and log file analysis tools that capture system logs and performance metrics.

[0141] The collected data is input into a means for training an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model. The server uses this data to train the anomaly detection model and learn normal behavior patterns.

[0142] The server then uses the trained model to analyze newly collected data in real time to detect anomalies, and if any are detected, the server alerts administrators through notification mechanisms, which may include sending email alerts, displaying warnings on a dashboard, or triggering automated response systems.

[0143] The emotion engine collects user emotional data and dynamically changes the notification method for anomalies based on that information. For example, if a user is feeling stressed, the notification content can be made more detailed or the notification method can be flexibly changed. Emotion data is also used to train anomaly detection models, enabling more accurate anomaly detection.

[0144] Specific examples

[0145] For example, consider a system that monitors a company's entire IT infrastructure. Here's a specific scenario:

[0146] 1. The server collects log data from various servers and network devices within the company and sends it to a central server using a data collection tool. The data collection tool periodically executes queries to collect the necessary logs.

[0147] 2. The server trains an anomaly detection model based on the collected data. The server uses historical data to fit the Isolation Forest model, learning the normal behavior patterns of the system and establishing criteria for detecting anomalies when they occur.

[0148] 3. The server applies an anomaly detection model to newly collected data in real time to determine whether there are any anomalies. For example, if a specific server's CPU usage rate suddenly increases, this will be detected as an anomaly.

[0149] 4. If an anomaly is detected, the server uses an emotion engine to collect user emotion data and dynamically adjust the notification method. For example, if the user is feeling stressed, it will send a notification with a detailed explanation and additional information.

[0150] 5. The server uses notification mechanisms to alert administrators, not only sending email alerts but also displaying anomalies on the web dashboard and, if necessary, running scripts to automatically fix the anomaly.

[0151] 6. The user receives a notification and accesses the dashboard to check detailed information about the anomaly. The user understands the location and details of the anomaly and can take appropriate measures promptly. The user also adjusts the necessary response according to the content of the notification provided by the emotion engine.

[0152] 7. After the user responds, the server reevaluates the system's operating status and checks whether the abnormality has been resolved. It continues to monitor the system to ensure that the abnormality does not recur.

[0153] In this way, the system of the present invention, by combining an emotion engine, enables early detection of anomalies and rapid response, significantly improving the reliability and security of the system, reducing the burden on administrators and realizing more effective operation of IT infrastructure.

[0154] The processing flow will be explained below.

[0155] Step 1:

[0156] The server collects log data from the enterprise and network devices, and periodically transmits the necessary log information from each server and network device to the central server using a data collection tool.

[0157] Step 2:

[0158] The server performs initial processing of the collected data, cleansing and standardizing the format, and shaping it into a form suitable for training an anomaly detection model.

[0159] Step 3:

[0160] The server uses the initially processed data to train an anomaly detection model (Isolation Forest algorithm), learning normal behavior patterns and setting criteria for detecting anomalies.

[0161] Step 4:

[0162] The server stores the trained anomaly detection model and begins detecting anomalies in newly collected data in real time.

[0163] Step 5:

[0164] The server inputs newly collected data into the anomaly detection model in real time to evaluate whether an anomaly exists, and if one is detected, records its index.

[0165] Step 6:

[0166] When an abnormality is detected, the server uses an emotion engine to collect the user's emotional data, thereby understanding the user's emotional state.

[0167] Step 7:

[0168] The server can then change the notification method for anomalies based on the user's emotional data. For example, if the emotion engine detects that the user is feeling stressed, it can issue a notification with a detailed explanation and additional information.

[0169] Step 8:

[0170] The server will alert the administrator using a notification mechanism, which may include sending an email alert, displaying a warning on the dashboard, or triggering an automated response system.

[0171] Step 9:

[0172] Users receive notifications and access the dashboard to check detailed information about the anomaly. Users can understand the location and details of the anomaly and take appropriate measures promptly. They can also check the content of notifications based on the emotion engine and adjust their response.

[0173] Step 10:

[0174] After the user responds, the server reevaluates the system's operating status, checks whether the abnormality has been resolved, and continues monitoring to prevent the abnormality from recurring.

[0175] In this way, early detection and countermeasures for abnormalities become possible, improving the reliability and security of the system. In addition, the introduction of an emotion engine dynamically adjusts notification methods, reducing the burden on administrators.

[0176] Example 2

[0177] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0178] While conventional system monitoring systems can detect anomalies by collecting data on system operation status and performance, they face the problem of difficulty in implementing flexible notification methods that take into account the emotional state of the user. Additionally, while using emotional data is effective in improving the accuracy of anomaly detection models, there is a lack of means to achieve this.

[0179] The specific processing by the specific processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means.

[0180] In this invention, the server includes a data collection means, a means for training an anomaly detection model, a means for detecting an anomaly, a means for notifying the user of the detected anomaly, and a means for collecting user emotion data and dynamically adjusting the notification method, thereby enabling a flexible notification method that takes the user's emotional state into consideration and improving the accuracy of the anomaly detection model.

[0181] "Data collection means" is a general term for devices and software used to collect system operating status and performance data.

[0182] "Means for training an anomaly detection model" refers to the process or equipment used to train an anomaly detection algorithm using collected data to identify normal operating patterns.

[0183] "Means for detecting anomalies" refers to devices or software that use a trained anomaly detection model to analyze newly collected data and determine whether an anomaly has occurred.

[0184] "Means for notifying detected abnormalities" is a general term for devices and software that include notification methods such as email, alerts, and dashboard displays to convey information about abnormalities to administrators when they occur.

[0185] "Means for collecting user emotional data and dynamically adjusting notification methods" refers to devices or algorithms that analyze the user's emotional state and change the content and method of notifications based on the results.

[0186] The "Isolation Forest algorithm" is a machine learning algorithm for anomaly detection, and refers to a technology that learns normal patterns from large amounts of data and identifies anomalous data points.

[0187] "Means for collecting real-time data and inputting it into the anomaly detection model" refers to devices and software that collect data from the system in real time and immediately supply that data to the anomaly detection model for analysis.

[0188] This invention combines an AI-based system monitoring system with an emotion engine that recognizes user emotions. The system mainly consists of the following components, and we will explain in detail how each component works.

[0189] Data collection methods:

[0190] Servers use various sensors and log file analysis tools to collect system status and performance data. Specific hardware includes sensors for acquiring system logs and monitoring agents for collecting performance metrics. The collected data is sent to a central server for analysis.

[0191] To train an anomaly detection model:

[0192] The server uses the collected data to train an anomaly detection model. This process uses the Isolation Forest algorithm to learn normal behavior patterns. By training the anomaly detection model using past data, the normal behavior patterns of the system are established.

[0193] Means of detecting anomalies:

[0194] The server analyzes newly collected data in real time using the trained anomaly detection model to detect anomalies, and if an anomaly is detected, details about the anomaly are recorded and the system proceeds to the next step.

[0195] Notification of detected anomalies:

[0196] The server has the means to notify administrators of detected anomalies, including sending alert emails, displaying anomalies on a web dashboard, and running scripts to automatically fix the anomalies.

[0197] A means to collect user emotional data and dynamically adjust notification methods:

[0198] The server uses an emotion engine to collect user emotional data and dynamically adjust the notification method. It collects the user's keyboard typing speed, mouse movement speed, and vital data from the wearable device to analyze whether the user is feeling stressed or relaxed. Based on this information, the server can change the content and method of notifications to provide more appropriate notifications.

[0199] Specific examples

[0200] For example, consider a system that monitors a company's entire IT infrastructure operating as follows:

[0201] 1. A server collects log data from servers and network devices within a company and sends it to a central server. For example, it retrieves system logs and performance metrics every minute.

[0202] 2. The server trains the IsolationForest model based on past collected data to learn the normal operating patterns of the system.

[0203] 3. The server applies the trained model to newly collected data and detects anomalies in real time. For example, if a particular server experiences a sudden increase in CPU usage, it will detect this as an anomaly.

[0204] 4. If an anomaly is detected, the server uses an emotion engine to collect user emotion data and dynamically adjust the notification method. For example, if the server determines that the user is in a stressful state, it will send a notification with a detailed explanation and additional information.

[0205] 5. The server alerts the administrator using notification methods, which may include sending email alerts, displaying anomalies on a web dashboard, and, if necessary, running scripts to automatically fix the anomaly.

[0206] Prompt Sentence Examples

[0207] I would like to develop a system that monitors my company's entire IT infrastructure. I would like to know how to collect system logs and performance metrics, detect abnormalities, and notify administrators. I would also like to incorporate a mechanism that dynamically changes the notification method based on user sentiment. Please explain in detail the specific algorithms and technologies that will be used to achieve this.

[0208] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0209] Step 1: Data collection

[0210] The server collects system operation status and performance data.

[0211] Input: Data from various sensors, log files, and tools that capture performance metrics.

[0212] Every minute the server parses the system log files to check for new entries.

[0213] The server runs SQL queries against the database and periodically collects performance metrics.

[0214] Output: The collected data is sent to a central server.

[0215] Step 2: Training the anomaly detection model

[0216] The server uses the collected data to train an anomaly detection model.

[0217] Input: Previously collected data.

[0218] The server trains the IsolationForest model using CPU usage data from the past six months.

[0219] The server stores the trained models in the / models / directory.

[0220] Output: An anomaly detection model that has learned normal behavior patterns.

[0221] Step 3: Real-time anomaly detection

[0222] The server analyzes newly collected data in real time using the trained anomaly detection model to detect anomalies.

[0223] Input: Log data and performance metrics collected in real time.

[0224] The server inputs system log data collected every minute into the model to detect anomalous patterns.

[0225] For example, if the CPU usage of a particular server suddenly rises above 90%, it will be recorded as an abnormality.

[0226] Output: Detailed information about the detected anomaly.

[0227] Step 4: Adjust emotion data collection and notification methods

[0228] The server uses an emotion engine to collect user emotion data and dynamically adjust the notification method.

[0229] Input: User keyboard typing speed, mouse movement speed, and vital data from wearable devices.

[0230] The server analyzes the user's emotional state based on this data.

[0231] For example, it may be determined that a user is under stress because the user is typing quickly.

[0232] Output: Adjustment of notification method based on the user's emotional state.

[0233] Step 5: Administrator Notification

[0234] The server notifies the administrator of any detected abnormalities.

[0235] Input: Detailed information about the anomaly detected in step 3, and the notification method adjusted in step 4.

[0236] The server sends an alert email to the administrator's email address.

[0237] The server displays alerts on a web dashboard and runs scripts to automatically fix anomalies.

[0238] Output: Notify administrator and fix anomaly.

[0239] Step 6: User response and dashboard check

[0240] The user receives a notification and visits the dashboard to view detailed information about the anomaly.

[0241] Input: The notification sent by the server.

[0242] The user clicks on the link in the notification to access the web dashboard.

[0243] The user sees detailed information on the dashboard such as "CPU usage on Server X has spiked."

[0244] Output: User understands abnormal conditions and takes measures.

[0245] Step 7: Reassess your system and continue monitoring

[0246] After the user responds, the server reevaluates the system's operating status and checks whether the abnormality has been resolved.

[0247] Input: Latest system data after the user has responded to the abnormality.

[0248] The server re-enters the latest CPU usage data and other data into the model to check whether the abnormality has recurred.

[0249] The server continuously monitors performance metrics across the system and immediately notifies you of any new anomalies.

[0250] Output: Confirmation that the abnormality has been resolved and continuous system monitoring.

[0251] (Application example 2)

[0252] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0253] In autonomous vehicles, it is important to detect system anomalies early and take prompt and appropriate action. However, conventional systems only issue uniform notifications when an anomaly is detected, making it difficult to flexibly adjust response methods taking into account the emotional state of the driver or engineer. Furthermore, emotional data is not utilized to improve the accuracy of anomaly detection. This can lead to delayed or incorrect responses to anomalies.

[0254] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, an emotion engine for recognizing the user's emotions, a means for notifying the user of the detected anomaly, and a means for dynamically adjusting the content of the notification based on the emotion data. This enables early detection of system anomalies in an autonomous vehicle and flexible responses according to the emotional states of the driver and technicians. Furthermore, utilizing emotion data improves the accuracy of anomaly detection, enabling more appropriate responses.

[0255] "Data collection means" refers to devices and methods for collecting system data, sensor data, etc. of autonomous vehicles.

[0256] A "means for training an anomaly detection model" is a machine learning algorithm or method that uses collected data to learn normal and abnormal behavior.

[0257] A "means for detecting anomalies" is a method or device that uses a trained anomaly detection model to analyze new data collected in real time and determine whether or not an anomaly exists.

[0258] The "emotion engine that recognizes user emotions" is software and hardware that uses biosensors and cameras to recognize and analyze the emotional state of drivers and technicians.

[0259] "Means for notifying detected abnormalities" refers to a system or method for conveying information about an abnormality to a manager or driver when it is detected.

[0260] The "means for dynamically adjusting notification content based on emotional data" refers to a method or system for flexibly changing notification content in the event of an abnormality based on the emotional state of the user.

[0261] The "Isolation Forest algorithm" is a machine learning algorithm used for anomaly detection, and is a method for detecting anomalies by measuring the degree of isolation of data.

[0262] "Real-time data" refers to the latest data that is currently being measured and collected by autonomous vehicles.

[0263] This invention is a system for detecting system anomalies early in an autonomous vehicle and notifying drivers and engineers according to their emotional states. The system includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, an emotion engine for recognizing user emotions, a means for notifying drivers of detected anomalies, and a means for dynamically adjusting the content of the notification based on the emotion data.

[0264] The server first collects system and sensor data from the autonomous vehicle. The collected data is stored in a database and used to train an anomaly detection model. The Isolation Forest algorithm is applied as this anomaly detection model. This algorithm is used to learn normal operating patterns and identify anomalous data points.

[0265] The server then uses the trained anomaly detection model to analyze newly collected data in real time and determine whether anomalies exist. If an anomaly is detected, the server uses an emotion engine to collect and analyze the user's emotional state in real time. This emotion engine identifies the user's emotional state based on facial recognition sensors and biometric data (heart rate, galvanic skin response, etc.).

[0266] The content of notifications in the event of an abnormality is dynamically adjusted based on the emotional data collected by the emotion engine. If the user is feeling stressed, the server will send a notification with a detailed explanation and additional information, encouraging them to stay calm. If the user's emotional state is normal, a simple notification will be sent. In this way, the server helps users take appropriate action quickly in the event of an abnormality.

[0267] Consider the following scenario: If an engine abnormality is detected while an autonomous vehicle is driving, the server analyzes engine status data in real time. At the same time, the emotion engine monitors the driver's heart rate and facial expressions to determine whether the driver is experiencing stress. If the driver is experiencing stress, a notification containing detailed information about the abnormality and how to deal with it is sent to the driver's smartphone.

[0268] Additionally, generative AI models can be used to set prompts that help obtain additional information. For example, the following prompts can be used:

[0269] Example prompt sentence:

[0270] Please generate a detailed functional description of a monitoring application for an autonomous vehicle. This app collects vehicle system data and detects anomalies. In addition, it monitors the driver's emotions in real time and dynamically adjusts notification content based on the driver's emotions when an anomaly is detected. Please provide a detailed description, including the following points:

[0271] Emotion data is collected using facial recognition sensors and biometric information

[0272] Isolation Forest is used as an anomaly detection model.

[0273] Notification method and content for abnormal events change based on emotions

[0274] This allows for refinement of detailed specifications and functional descriptions of the application.

[0275] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0276] Step 1:

[0277] Data collection:

[0278] The server collects system data (e.g., engine status, GPS data, sensor information, etc.) from the autonomous vehicle. The input is data from various sensors on the vehicle, and the output is the collected dataset. This dataset is used to train the anomaly detection model.

[0279] Step 2:

[0280] Training an anomaly detection model:

[0281] The server trains an anomaly detection model (Isolation Forest algorithm) using the dataset collected in step 1. The input is the collected system dataset, and the output is the trained anomaly detection model. The server uses this model to learn normal behavior patterns and set criteria for detecting anomalies.

[0282] Step 3:

[0283] Real-time data analysis:

[0284] The server applies an anomaly detection model to newly collected data in real time. The input is the system data collected in real time, and the output is the presence or absence of detected anomalies. Based on this analysis, the server determines whether an anomaly has occurred.

[0285] Step 4:

[0286] Emotion data collection:

[0287] The server collects the emotional state of the user (driver or technician) in real time. The input is data from a facial recognition sensor and biometric data (heart rate, skin galvanic response, etc.), and the output is the emotional state analysis result by the emotion engine. The server then determines whether the user is feeling stressed.

[0288] Step 5:

[0289] Notification in case of an abnormality:

[0290] The server adjusts the notification content based on the emotional data from step 4 and sends the anomaly detected in step 3. The input is the anomaly detection result and the analysis result of the emotional state, and the output is the adjusted notification content. Based on the emotional state, the server sends a notification including a detailed explanation or additional information to a smartphone or other device as needed.

[0291] Step 6:

[0292] Receiving and Responding to Notifications:

[0293] The user receives the notification sent from the server and checks the content. The input is the notification from the server, and the output is the user's response action. Based on this notification, the user can quickly take appropriate measures to deal with the system abnormality.

[0294] Step 7:

[0295] Reassess your system health:

[0296] The server reevaluates the system's operating status after the user responds. The input is the re-collected system data, and the output is the result of determining whether the abnormality has been resolved. The server checks whether the abnormality has been resolved and performs continuous monitoring.

[0297] Step 8:

[0298] Leveraging generative AI models:

[0299] The server uses a generative AI model to perform further analysis and improve the notification content. The input is the anomaly detection result and emotion data, and the output is optimized notification content and additional countermeasure suggestions. The following prompt sentence is used to instruct the AI ​​model to generate a detailed explanation.

[0300] Please generate a detailed functional description of a monitoring application for an autonomous vehicle. This app collects vehicle system data and detects anomalies. In addition, it monitors the driver's emotions in real time and dynamically adjusts notification content based on the driver's emotions when an anomaly is detected. Please provide a detailed description, including the following points:

[0301] Emotion data is collected using facial recognition sensors and biometric information

[0302] Isolation Forest is used as an anomaly detection model.

[0303] Notification method and content for abnormal events change based on emotions

[0304] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0305] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0306] In the above embodiment, an example in which the specific process is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific process may be performed by the smart device 14.

[0307] [Second embodiment]

[0308] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0309] 3, the data processing system 210 includes the data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0310] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0311] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0312] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0313] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0314] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0315] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0316] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0317] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0318] In the smart glasses 214, the reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0319] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal."

[0320] The present invention relates to a system monitoring system using AI, and includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, and a means for notifying detected anomalies. Below, specific embodiments of the present invention will be described.

[0321] Overview of program processing

[0322] Servers use data collection tools to collect system status and performance data, such as sensors and log file analysis tools that record system logs and performance metrics.

[0323] The collected data is input into a means for training an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model. The server uses this data to train the anomaly detection model and learn normal behavior patterns.

[0324] The server then uses the trained model to analyze newly collected data in real time to detect anomalies, and if an anomaly is detected, the server alerts administrators through notification mechanisms, which may include sending email alerts, displaying warnings on a dashboard, or triggering automated response systems.

[0325] Specific examples

[0326] For example, consider a system that monitors a company's entire IT infrastructure. Here's a specific scenario:

[0327] 1. The server collects log data from various servers and network devices within the company and sends it to a central server using a data collection tool. The data collection tool periodically executes queries to collect the necessary logs.

[0328] 2. The server trains an anomaly detection model based on the collected data. The server uses historical data to fit the Isolation Forest model, learning the normal behavior patterns of the system and establishing criteria for detecting anomalies when they occur.

[0329] 3. The server applies an anomaly detection model to newly collected data in real time to determine whether there are any anomalies. For example, if a specific server's CPU usage rate suddenly increases, this will be detected as an anomaly.

[0330] 4. If an anomaly is detected, the server will use its notification methods to alert the administrator, not only sending an alert email but also displaying the anomaly on the web dashboard and, if necessary, running scripts to automatically fix the anomaly.

[0331] 5. Users receive notifications and access the dashboard to view details of the anomaly, identify the cause of the anomaly, and take the necessary measures promptly.

[0332] In this way, the system of the present invention enables early detection of abnormalities and rapid response, significantly improving the reliability and security of the system, reducing the burden on administrators and improving the operational efficiency of the entire IT infrastructure.

[0333] The processing flow will be explained below.

[0334] Step 1:

[0335] The server collects system performance data and log data. The data collection means periodically acquires necessary log information from each server and network device and stores it in the central server.

[0336] Step 2:

[0337] The server performs initial processing of the collected data, cleansing and standardizing the format, and shaping it into a form suitable for training an anomaly detection model.

[0338] Step 3:

[0339] The server uses the initially processed data to train an anomaly detection model (Isolation Forest algorithm), which learns normal behavior patterns based on past data.

[0340] Step 4:

[0341] The server stores the trained anomaly detection model and begins anomaly detection on newly collected data in real time.

[0342] Step 5:

[0343] The server inputs newly collected data into the anomaly detection model in real time to evaluate whether anomalies exist, and if any are detected, records their index.

[0344] Step 6:

[0345] The server will alert administrators to detected anomalies using notification methods, which may include sending email alerts, displaying warnings on the dashboard, or triggering automated response systems.

[0346] Step 7:

[0347] Users receive a notification and access the dashboard to check detailed information about the anomaly, understand where the anomaly occurred, its details, and take appropriate measures.

[0348] Step 8:

[0349] After the user responds, the server reevaluates the system's operating status and checks whether the abnormality has been resolved. It also performs continuous monitoring to prevent the abnormality from recurring.

[0350] In this way, early detection of abnormalities and countermeasures can be implemented, improving the reliability and security of the system.

[0351] Example 1

[0352] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0353] Conventional system monitoring relies on periodic checks and manual analysis, which makes it difficult to detect abnormalities early and to respond quickly, which not only reduces system reliability but also increases the burden on administrators.

[0354] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0355] In this invention, the server includes means for collecting data using a log collection device, means for training an anomaly detection model using the collected data, means for detecting anomalies in real time using the trained anomaly detection model, and means for notifying an administrator of detected anomalies, thereby enabling early detection of anomalies and rapid response.

[0356] A "log collection device" is a device that collects various system logs and performance metrics and sends them to a central repository.

[0357] "Means for collecting data" refers to the means for aggregating system logs and performance data and transmitting the necessary information to a central server.

[0358] An "anomaly detection model" is a model equipped with an algorithm for detecting anomalies based on collected data.

[0359] "Isolation Forest" is an algorithm that detects anomalies by randomly subsampling data and measuring how isolated that data is from other data points.

[0360] A "training means" is a means for training an anomaly detection model using past data.

[0361] "Means for detecting anomalies in real time" refers to means for detecting anomalies by using a trained anomaly detection model to instantly analyze collected data.

[0362] "Means of notification" refers to the means by which a warning is sent to an administrator about a detected anomaly, including sending an alert email, displaying a warning on a dashboard, or triggering an automated response system.

[0363] The present invention relates to a system monitoring system using AI, which collects data using a log collection device, trains an anomaly detection model, detects anomalies in real time, and notifies an administrator of the anomalies. Hereinafter, specific embodiments of the present invention will be described.

[0364] Servers use log collection devices to collect system status and performance data. Specifically, log collection tools (e.g., Fluentd or Logstash) are used to collect various system logs and performance metrics and send them to a central repository. This aggregates the necessary log data, preparing to visualize the current status of the system.

[0365] Next, the server uses the collected data to train an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model in this process. The server uses the Python scikit-learn library to input past log data and fit the Isolation Forest model to learn normal behavior patterns. The trained model is saved to disk as a file (e.g., trained_model.pkl).

[0366] The server uses the trained anomaly detection model to analyze newly collected data in real time. As data is collected, it runs the data through the anomaly detection model and calculates an anomaly score. Specifically, by using a real-time processing platform (e.g., Kafka), analysis begins as soon as the data arrives.

[0367] If an anomaly is detected, the server will notify the administrator. This notification method can include sending an alert email, displaying a warning on the dashboard, or triggering an automated response system. For example, if the anomaly score exceeds a certain threshold, an alert email will be sent using the SMTP protocol, and JSON-formatted data containing the details of the anomaly will be sent as a POST request to the Webhook URL.

[0368] Finally, users receive a notification and can access the system dashboard to view details of the anomaly. Users can then identify the cause of the anomaly and quickly take necessary measures. This enables early detection of anomalies and rapid response, significantly improving system reliability and security. It also reduces the burden on administrators and improves the operational efficiency of the entire IT infrastructure.

[0369] Prompt Sentence Examples

[0370] "Analyze the server's anomaly detection log and determine whether an anomaly has occurred. If an anomaly has occurred, explain the details."

[0371] "Describe the process of training an anomaly detection model based on collected system log data."

[0372] "Please explain in detail how this anomaly detection system works when a server's CPU usage is abnormally high."

[0373] In this way, the system of the present invention incorporates an anomaly detection and notification process using a generative AI model, enabling monitoring of the system's operating status and rapid response when problems occur.

[0374] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0375] Step 1:

[0376] Servers use log collectors to collect system logs and performance metrics. Specifically, log collectors such as Fluentd and Logstash pull data from various systems and send it to a central repository. The input to this process is log data and metrics data, and the output is aggregated data stored in the central repository. The server configures the type and frequency of data to collect and runs queries to keep the data up to date.

[0377] Step 2:

[0378] The server trains an anomaly detection model based on the data stored in the central repository. In this process, the Isolation Forest algorithm is used to build the anomaly detection model. The input is historical system log data, and the output is the trained anomaly detection model. Specifically, the Python scikit-learn library is used to fit the model and learn normal behavior patterns. The training results are saved in a file format (e.g., trained_model.pkl).

[0379] Step 3:

[0380] The server uses the trained anomaly detection model to analyze newly collected data in real time. This process is performed automatically using a real-time processing platform (e.g., Kafka) whenever new log data arrives. The input is the newly collected log data, and the output is an anomaly score. The server applies the model to the collected data to determine whether it is an anomaly.

[0381] Step 4:

[0382] If an anomaly is detected, the server will notify the administrator by sending an alert email, displaying a warning on the dashboard, triggering an automatic response system, etc. The input to this process is the anomaly score generated in step 3, and the output is a notification to the administrator. For example, if the anomaly score exceeds a set threshold, the server will send an alert email to the administrator using the SMTP protocol and send data containing the anomaly details to the Webhook URL as a POST request.

[0383] Step 5:

[0384] The user receives a notification from the server and accesses the system dashboard to check the details of the abnormality. The input is the notification data from the server, and the output is detailed information about the abnormality. The user refers to the dashboard, identifies the cause of the abnormality, and takes necessary measures. The user can click on the abnormality entry to check detailed information and take prompt action.

[0385] This process flow enables the system to detect abnormalities early and respond quickly and appropriately.

[0386] (Application example 1)

[0387] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0388] In today's corporate environment, there is a need to quickly detect system anomalies and security threats and respond immediately. However, conventional monitoring systems have issues with delays in training models to detect anomalies and in notifications, making it difficult to respond in real time. In addition, there are insufficient means to promptly notify administrators of the results of anomaly detection, making it difficult to maintain system reliability and operational efficiency.

[0389] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0390] In this invention, the server includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, a means for notifying detected anomalies, a means for sending a push notification to an administrator using a smartphone, and a means for analyzing data in real time and displaying the data on a dashboard. This enables rapid detection and response to anomalies, enables an administrator to check the details of anomalies in real time, and significantly improves the system security of a company.

[0391] "Data collection means" refers to devices and software for collecting system operation status and performance data on a central server.

[0392] "Means for training an anomaly detection model" refers to the process of using collected data to train an anomaly detection algorithm and define normal operating patterns.

[0393] "Means for detecting anomalies" refers to the process of analyzing newly collected data in real time using a trained anomaly detection model to identify anomalies.

[0394] "Means for notifying detected abnormalities" refers to devices or software that send an alert to an administrator when an abnormality is detected.

[0395] "Means of sending push notifications to administrators using smartphones" refers to a function that immediately notifies administrators via a smartphone application when an abnormality is detected.

[0396] "Means for analyzing data in real time and displaying it on a dashboard" refers to a function for analyzing data collected in real time and displaying the results on a dashboard so that the user can visually confirm them.

[0397] The present invention relates to a system monitoring system using AI, and includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, a means for notifying an administrator of detected anomalies, a means for sending a push notification to an administrator using a smartphone, and a means for analyzing data in real time and displaying it on a dashboard. A specific embodiment of the present invention will be described below.

[0398] Program processing overview

[0399] The server uses data collection means to collect system operation status and performance data. This includes sensors that record system logs and performance metrics, and log file analysis tools. The collected data is input into means for training an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model. The server uses this data to train the anomaly detection model and learns normal operating patterns. The server then uses the trained model to analyze newly collected data in real time and detect anomalies. If an anomaly is detected, the server will alert the administrator through notification means. This can include sending an alert email, displaying a warning on the dashboard, and also sending push notifications via smartphones.

[0400] Hardware and software used

[0401] Hardware: Servers, smartphones, sensors

[0402] Software: Python, Flask, scikit-learn, smartphone application

[0403] Data processing and calculation

[0404] The server collects log data from network devices and systems, preprocesses it, and inputs it into an anomaly detection model. The main algorithm used is Isolation Forest, which uses past log data to train the anomaly detection model. The resulting model analyzes real-time data and detects anomalies. Detected anomalies are immediately sent to the administrator's smartphone as a push notification. The analysis results are then visually displayed on a dashboard, allowing the administrator to check the details.

[0405] Specific examples

[0406] For example, consider a system that monitors a company's entire IT infrastructure. The server collects log data from various servers and network devices within the company and sends it to a central server using a data collection method. An anomaly detection model is trained based on the collected data. The server uses past data to fit an Isolation Forest model and learns the normal operating patterns of the system. This model is applied to newly collected data in real time to determine whether an anomaly exists. For example, a sudden increase in CPU usage on a specific server is detected as an anomaly. If an anomaly is detected, the server sends a warning to the administrator using a notification method. In addition to sending an alert email, a push notification is sent to the administrator's smartphone and the anomaly is displayed on a web dashboard. The administrator receives the notification and accesses the dashboard to check the details of the anomaly. This allows the cause of the anomaly to be identified and necessary measures to be taken promptly.

[0407] Prompt Sentence Examples

[0408] "Analyze new data using an anomaly detection model and notify me if there are any anomalies:

[0409] CPU usage, memory usage, network traffic"

[0410] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0411] Step 1: Data collection

[0412] The server collects system operation status and performance data. Specifically, it periodically collects log data from network devices and servers and sends it to a central server. The input data is the log files and sensor data of each device, and the output is data stored on the central server.

[0413] Step 2: Data Preprocessing

[0414] The server preprocesses the collected raw data, specifically filtering the raw data, imputing missing values, removing noise, etc. The input is the raw data collected in step 1, and the output is the preprocessed, clean data.

[0415] Step 3: Training the anomaly detection model

[0416] The server uses the preprocessed data to train an anomaly detection model. Specifically, it uses the Isolation Forest algorithm to learn normal behavior patterns. The input is the preprocessed data from step 2, and the output is the trained anomaly detection model.

[0417] Step 4: Analyzing real-time data

[0418] The server applies the anomaly detection model to newly collected data in real time. Specifically, the collected data is input into the model to determine whether there are any anomalies. The input is the raw data collected in real time, and the output is the anomaly detection result.

[0419] Step 5: Notification of abnormalities

[0420] If an abnormality is detected, the server will issue a warning to the administrator using a notification method. Specifically, in addition to sending an email or displaying a warning on the dashboard, it will also send a push notification to the smartphone. The input is the abnormality detection result in step 4, and the output is a notification to the administrator.

[0421] Step 6: Display the data in a dashboard

[0422] The server displays the analysis results on a dashboard. Specifically, it visually displays the anomaly detection results so that administrators can check them in real time. The input is the data obtained in steps 4 and 5, and the output is the analysis results displayed on the dashboard.

[0423] Step 7: Administrator Action

[0424] The user (administrator) receives the notification and accesses the dashboard to check the details of the anomaly. Specifically, based on the anomaly data on the dashboard, the user identifies the cause of the anomaly and takes necessary measures. The input is the notification and data display in Step 5 and Step 6, and the output is the measures to be taken against the anomaly.

[0425] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[0426] The present invention combines an AI-based system monitoring system with an emotion engine that recognizes user emotions, and describes a system that includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, a means for notifying detected anomalies, and an emotion engine.

[0427] Overview of program processing

[0428] The server uses data collection methods to collect system status and performance data, including sensors and log file analysis tools that capture system logs and performance metrics.

[0429] The collected data is input into a means for training an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model. The server uses this data to train the anomaly detection model and learn normal behavior patterns.

[0430] The server then uses the trained model to analyze newly collected data in real time to detect anomalies, and if any are detected, the server alerts administrators through notification mechanisms, which may include sending email alerts, displaying warnings on a dashboard, or triggering automated response systems.

[0431] The emotion engine collects user emotional data and dynamically changes the notification method for anomalies based on that information. For example, if a user is feeling stressed, the notification content can be made more detailed or the notification method can be flexibly changed. Emotion data is also used to train anomaly detection models, enabling more accurate anomaly detection.

[0432] Specific examples

[0433] For example, consider a system that monitors a company's entire IT infrastructure. Here's a specific scenario:

[0434] 1. The server collects log data from various servers and network devices within the company and sends it to a central server using a data collection tool. The data collection tool periodically executes queries to collect the necessary logs.

[0435] 2. The server trains an anomaly detection model based on the collected data. The server uses historical data to fit the Isolation Forest model, learning the normal behavior patterns of the system and establishing criteria for detecting anomalies when they occur.

[0436] 3. The server applies an anomaly detection model to newly collected data in real time to determine whether there are any anomalies. For example, if a specific server's CPU usage rate suddenly increases, this will be detected as an anomaly.

[0437] 4. If an anomaly is detected, the server uses an emotion engine to collect user emotion data and dynamically adjust the notification method. For example, if the user is feeling stressed, it will send a notification with a detailed explanation and additional information.

[0438] 5. The server uses notification mechanisms to alert administrators, not only sending email alerts but also displaying anomalies on the web dashboard and, if necessary, running scripts to automatically fix the anomaly.

[0439] 6. The user receives a notification and accesses the dashboard to check detailed information about the anomaly. The user understands the location and details of the anomaly and can take appropriate measures promptly. The user also adjusts the necessary response according to the content of the notification provided by the emotion engine.

[0440] 7. After the user responds, the server reevaluates the system's operating status and checks whether the abnormality has been resolved. It continues to monitor the system to ensure that the abnormality does not recur.

[0441] In this way, the system of the present invention, by combining an emotion engine, enables early detection of anomalies and rapid response, significantly improving the reliability and security of the system, reducing the burden on administrators and realizing more effective operation of IT infrastructure.

[0442] The processing flow will be explained below.

[0443] Step 1:

[0444] The server collects log data from the enterprise and network devices, and periodically transmits the necessary log information from each server and network device to the central server using a data collection tool.

[0445] Step 2:

[0446] The server performs initial processing of the collected data, cleansing and standardizing the format, and shaping it into a form suitable for training an anomaly detection model.

[0447] Step 3:

[0448] The server uses the initially processed data to train an anomaly detection model (Isolation Forest algorithm), learning normal behavior patterns and setting criteria for detecting anomalies.

[0449] Step 4:

[0450] The server stores the trained anomaly detection model and begins detecting anomalies in newly collected data in real time.

[0451] Step 5:

[0452] The server inputs newly collected data into the anomaly detection model in real time to evaluate whether an anomaly exists, and if one is detected, records its index.

[0453] Step 6:

[0454] When an abnormality is detected, the server uses an emotion engine to collect the user's emotional data, thereby understanding the user's emotional state.

[0455] Step 7:

[0456] The server can then change the notification method for anomalies based on the user's emotional data. For example, if the emotion engine detects that the user is feeling stressed, it can issue a notification with a detailed explanation and additional information.

[0457] Step 8:

[0458] The server will alert the administrator using a notification mechanism, which may include sending an email alert, displaying a warning on the dashboard, or triggering an automated response system.

[0459] Step 9:

[0460] Users receive notifications and access the dashboard to check detailed information about the anomaly. Users can understand the location and details of the anomaly and take appropriate measures promptly. They can also check the content of notifications based on the emotion engine and adjust their response.

[0461] Step 10:

[0462] After the user responds, the server reevaluates the system's operating status, checks whether the abnormality has been resolved, and continues monitoring to prevent the abnormality from recurring.

[0463] In this way, early detection and countermeasures for abnormalities become possible, improving the reliability and security of the system. In addition, the introduction of an emotion engine dynamically adjusts notification methods, reducing the burden on administrators.

[0464] Example 2

[0465] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0466] While conventional system monitoring systems can detect anomalies by collecting data on system operation status and performance, they face the problem of difficulty in implementing flexible notification methods that take into account the emotional state of the user. Additionally, while using emotional data is effective in improving the accuracy of anomaly detection models, there is a lack of means to achieve this.

[0467] The specific processing by the specific processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means.

[0468] In this invention, the server includes a data collection means, a means for training an anomaly detection model, a means for detecting an anomaly, a means for notifying the user of the detected anomaly, and a means for collecting user emotion data and dynamically adjusting the notification method, thereby enabling a flexible notification method that takes the user's emotional state into consideration and improving the accuracy of the anomaly detection model.

[0469] "Data collection means" is a general term for devices and software used to collect system operating status and performance data.

[0470] "Means for training an anomaly detection model" refers to the process or equipment used to train an anomaly detection algorithm using collected data to identify normal operating patterns.

[0471] "Means for detecting anomalies" refers to devices or software that use a trained anomaly detection model to analyze newly collected data and determine whether an anomaly has occurred.

[0472] "Means for notifying detected abnormalities" is a general term for devices and software that include notification methods such as email, alerts, and dashboard displays to convey information about abnormalities to administrators when they occur.

[0473] "Means for collecting user emotional data and dynamically adjusting notification methods" refers to devices or algorithms that analyze the user's emotional state and change the content and method of notifications based on the results.

[0474] The "Isolation Forest algorithm" is a machine learning algorithm for anomaly detection, and refers to a technology that learns normal patterns from large amounts of data and identifies anomalous data points.

[0475] "Means for collecting real-time data and inputting it into the anomaly detection model" refers to devices and software that collect data from the system in real time and immediately supply that data to the anomaly detection model for analysis.

[0476] This invention combines an AI-based system monitoring system with an emotion engine that recognizes user emotions. The system mainly consists of the following components, and we will explain in detail how each component works.

[0477] Data collection methods:

[0478] Servers use various sensors and log file analysis tools to collect system status and performance data. Specific hardware includes sensors for acquiring system logs and monitoring agents for collecting performance metrics. The collected data is sent to a central server for analysis.

[0479] To train an anomaly detection model:

[0480] The server uses the collected data to train an anomaly detection model. This process uses the Isolation Forest algorithm to learn normal behavior patterns. By training the anomaly detection model using past data, the normal behavior patterns of the system are established.

[0481] Means of detecting anomalies:

[0482] The server analyzes newly collected data in real time using the trained anomaly detection model to detect anomalies, and if an anomaly is detected, details about the anomaly are recorded and the system proceeds to the next step.

[0483] Notification of detected anomalies:

[0484] The server has the means to notify administrators of detected anomalies, including sending alert emails, displaying anomalies on a web dashboard, and running scripts to automatically fix the anomalies.

[0485] A means to collect user emotional data and dynamically adjust notification methods:

[0486] The server uses an emotion engine to collect user emotional data and dynamically adjust the notification method. It collects the user's keyboard typing speed, mouse movement speed, and vital data from the wearable device to analyze whether the user is feeling stressed or relaxed. Based on this information, the server can change the content and method of notifications to provide more appropriate notifications.

[0487] Specific examples

[0488] For example, consider a system that monitors a company's entire IT infrastructure operating as follows:

[0489] 1. A server collects log data from servers and network devices within a company and sends it to a central server. For example, it retrieves system logs and performance metrics every minute.

[0490] 2. The server trains the IsolationForest model based on past collected data to learn the normal operating patterns of the system.

[0491] 3. The server applies the trained model to newly collected data and detects anomalies in real time. For example, if a particular server experiences a sudden increase in CPU usage, it will detect this as an anomaly.

[0492] 4. If an anomaly is detected, the server uses an emotion engine to collect user emotion data and dynamically adjust the notification method. For example, if the server determines that the user is in a stressful state, it will send a notification with a detailed explanation and additional information.

[0493] 5. The server alerts the administrator using notification methods, which may include sending email alerts, displaying anomalies on a web dashboard, and, if necessary, running scripts to automatically fix the anomaly.

[0494] Prompt Sentence Examples

[0495] I would like to develop a system that monitors my company's entire IT infrastructure. I would like to know how to collect system logs and performance metrics, detect abnormalities, and notify administrators. I would also like to incorporate a mechanism that dynamically changes the notification method based on user sentiment. Please explain in detail the specific algorithms and technologies that will be used to achieve this.

[0496] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0497] Step 1: Data collection

[0498] The server collects system operation status and performance data.

[0499] Input: Data from various sensors, log files, and tools that capture performance metrics.

[0500] Every minute the server parses the system log files to check for new entries.

[0501] The server runs SQL queries against the database and periodically collects performance metrics.

[0502] Output: The collected data is sent to a central server.

[0503] Step 2: Training the anomaly detection model

[0504] The server uses the collected data to train an anomaly detection model.

[0505] Input: Previously collected data.

[0506] The server trains the IsolationForest model using CPU usage data from the past six months.

[0507] The server stores the trained models in the / models / directory.

[0508] Output: An anomaly detection model that has learned normal behavior patterns.

[0509] Step 3: Real-time anomaly detection

[0510] The server analyzes newly collected data in real time using the trained anomaly detection model to detect anomalies.

[0511] Input: Log data and performance metrics collected in real time.

[0512] The server inputs system log data collected every minute into the model to detect anomalous patterns.

[0513] For example, if the CPU usage of a particular server suddenly rises above 90%, it will be recorded as an abnormality.

[0514] Output: Detailed information about the detected anomaly.

[0515] Step 4: Adjust emotion data collection and notification methods

[0516] The server uses an emotion engine to collect user emotion data and dynamically adjust the notification method.

[0517] Input: User keyboard typing speed, mouse movement speed, and vital data from wearable devices.

[0518] The server analyzes the user's emotional state based on this data.

[0519] For example, it may be determined that a user is under stress because the user is typing quickly.

[0520] Output: Adjustment of notification method based on the user's emotional state.

[0521] Step 5: Administrator Notification

[0522] The server notifies the administrator of any detected abnormalities.

[0523] Input: Detailed information about the anomaly detected in step 3, and the notification method adjusted in step 4.

[0524] The server sends an alert email to the administrator's email address.

[0525] The server displays alerts on a web dashboard and runs scripts to automatically fix anomalies.

[0526] Output: Notify administrator and fix anomaly.

[0527] Step 6: User response and dashboard check

[0528] The user receives a notification and visits the dashboard to view detailed information about the anomaly.

[0529] Input: The notification sent by the server.

[0530] The user clicks on the link in the notification to access the web dashboard.

[0531] The user sees detailed information on the dashboard such as "CPU usage on Server X has spiked."

[0532] Output: User understands abnormal conditions and takes measures.

[0533] Step 7: Reassess your system and continue monitoring

[0534] After the user responds, the server reevaluates the system's operating status and checks whether the abnormality has been resolved.

[0535] Input: Latest system data after the user has responded to the abnormality.

[0536] The server re-enters the latest CPU usage data and other data into the model to check whether the abnormality has recurred.

[0537] The server continuously monitors performance metrics across the system and immediately notifies you of any new anomalies.

[0538] Output: Confirmation that the abnormality has been resolved and continuous system monitoring.

[0539] (Application example 2)

[0540] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0541] In autonomous vehicles, it is important to detect system anomalies early and take prompt and appropriate action. However, conventional systems only issue uniform notifications when an anomaly is detected, making it difficult to flexibly adjust response methods taking into account the emotional state of the driver or engineer. Furthermore, emotional data is not utilized to improve the accuracy of anomaly detection. This can lead to delayed or incorrect responses to anomalies.

[0542] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, an emotion engine for recognizing the user's emotions, a means for notifying the user of the detected anomaly, and a means for dynamically adjusting the content of the notification based on the emotion data. This enables early detection of system anomalies in an autonomous vehicle and flexible responses according to the emotional states of the driver and technicians. Furthermore, utilizing emotion data improves the accuracy of anomaly detection, enabling more appropriate responses.

[0543] "Data collection means" refers to devices and methods for collecting system data, sensor data, etc. of autonomous vehicles.

[0544] A "means for training an anomaly detection model" is a machine learning algorithm or method that uses collected data to learn normal and abnormal behavior.

[0545] A "means for detecting anomalies" is a method or device that uses a trained anomaly detection model to analyze new data collected in real time and determine whether or not an anomaly exists.

[0546] The "emotion engine that recognizes user emotions" is software and hardware that uses biosensors and cameras to recognize and analyze the emotional state of drivers and technicians.

[0547] "Means for notifying detected abnormalities" refers to a system or method for conveying information about an abnormality to a manager or driver when it is detected.

[0548] The "means for dynamically adjusting notification content based on emotional data" refers to a method or system for flexibly changing notification content in the event of an abnormality based on the emotional state of the user.

[0549] The "Isolation Forest algorithm" is a machine learning algorithm used for anomaly detection, and is a method for detecting anomalies by measuring the degree of isolation of data.

[0550] "Real-time data" refers to the latest data that is currently being measured and collected by autonomous vehicles.

[0551] This invention is a system for detecting system anomalies early in an autonomous vehicle and notifying drivers and engineers according to their emotional states. The system includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, an emotion engine for recognizing user emotions, a means for notifying drivers of detected anomalies, and a means for dynamically adjusting the content of the notification based on the emotion data.

[0552] The server first collects system and sensor data from the autonomous vehicle. The collected data is stored in a database and used to train an anomaly detection model. The Isolation Forest algorithm is applied as this anomaly detection model. This algorithm is used to learn normal operating patterns and identify anomalous data points.

[0553] The server then uses the trained anomaly detection model to analyze newly collected data in real time and determine whether anomalies exist. If an anomaly is detected, the server uses an emotion engine to collect and analyze the user's emotional state in real time. This emotion engine identifies the user's emotional state based on facial recognition sensors and biometric data (heart rate, galvanic skin response, etc.).

[0554] The content of notifications in the event of an abnormality is dynamically adjusted based on the emotional data collected by the emotion engine. If the user is feeling stressed, the server will send a notification with a detailed explanation and additional information, encouraging them to stay calm. If the user's emotional state is normal, a simple notification will be sent. In this way, the server helps users take appropriate action quickly in the event of an abnormality.

[0555] Consider the following scenario: If an engine abnormality is detected while an autonomous vehicle is driving, the server analyzes engine status data in real time. At the same time, the emotion engine monitors the driver's heart rate and facial expressions to determine whether the driver is experiencing stress. If the driver is experiencing stress, a notification containing detailed information about the abnormality and how to deal with it is sent to the driver's smartphone.

[0556] Additionally, generative AI models can be used to set prompts that help obtain additional information. For example, the following prompts can be used:

[0557] Example prompt sentence:

[0558] Please generate a detailed functional description of a monitoring application for an autonomous vehicle. This app collects vehicle system data and detects anomalies. In addition, it monitors the driver's emotions in real time and dynamically adjusts notification content based on the driver's emotions when an anomaly is detected. Please provide a detailed description, including the following points:

[0559] Emotion data is collected using facial recognition sensors and biometric information

[0560] Isolation Forest is used as an anomaly detection model.

[0561] Notification method and content for abnormal events change based on emotions

[0562] This allows for refinement of detailed specifications and functional descriptions of the application.

[0563] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0564] Step 1:

[0565] Data collection:

[0566] The server collects system data (e.g., engine status, GPS data, sensor information, etc.) from the autonomous vehicle. The input is data from various sensors on the vehicle, and the output is the collected dataset. This dataset is used to train the anomaly detection model.

[0567] Step 2:

[0568] Training an anomaly detection model:

[0569] The server trains an anomaly detection model (Isolation Forest algorithm) using the dataset collected in step 1. The input is the collected system dataset, and the output is the trained anomaly detection model. The server uses this model to learn normal behavior patterns and set criteria for detecting anomalies.

[0570] Step 3:

[0571] Real-time data analysis:

[0572] The server applies an anomaly detection model to newly collected data in real time. The input is the system data collected in real time, and the output is the presence or absence of detected anomalies. Based on this analysis, the server determines whether an anomaly has occurred.

[0573] Step 4:

[0574] Emotion data collection:

[0575] The server collects the emotional state of the user (driver or technician) in real time. The input is data from a facial recognition sensor and biometric data (heart rate, skin galvanic response, etc.), and the output is the emotional state analysis result by the emotion engine. The server then determines whether the user is feeling stressed.

[0576] Step 5:

[0577] Notification in case of an abnormality:

[0578] The server adjusts the notification content based on the emotional data from step 4 and sends the anomaly detected in step 3. The input is the anomaly detection result and the analysis result of the emotional state, and the output is the adjusted notification content. Based on the emotional state, the server sends a notification including a detailed explanation or additional information to a smartphone or other device as needed.

[0579] Step 6:

[0580] Receiving and Responding to Notifications:

[0581] The user receives the notification sent from the server and checks the content. The input is the notification from the server, and the output is the user's response action. Based on this notification, the user can quickly take appropriate measures to deal with the system abnormality.

[0582] Step 7:

[0583] Reassess your system health:

[0584] The server reevaluates the system's operating status after the user responds. The input is the re-collected system data, and the output is the result of determining whether the abnormality has been resolved. The server checks whether the abnormality has been resolved and performs continuous monitoring.

[0585] Step 8:

[0586] Leveraging generative AI models:

[0587] The server uses a generative AI model to perform further analysis and improve the notification content. The input is the anomaly detection result and emotion data, and the output is optimized notification content and additional countermeasure suggestions. The following prompt sentence is used to instruct the AI ​​model to generate a detailed explanation.

[0588] Please generate a detailed functional description of a monitoring application for an autonomous vehicle. This app collects vehicle system data and detects anomalies. In addition, it monitors the driver's emotions in real time and dynamically adjusts notification content based on the driver's emotions when an anomaly is detected. Please provide a detailed description, including the following points:

[0589] Emotion data is collected using facial recognition sensors and biometric information

[0590] Isolation Forest is used as an anomaly detection model.

[0591] Notification method and content for abnormal events change based on emotions

[0592] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0593] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0594] In the above embodiment, an example in which the specific processing is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the smart glasses 214.

[0595] [Third embodiment]

[0596] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[0597] 5, the data processing system 310 includes the data processing device 12 and a headset type terminal 314. An example of the data processing device 12 is a server.

[0598] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0599] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[0600] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0601] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0602] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0603] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0604] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0605] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0606] In the headset type terminal 314, a reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0607] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the headset type terminal 314 will be referred to as the "terminal."

[0608] The present invention relates to a system monitoring system using AI, and includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, and a means for notifying detected anomalies. Below, specific embodiments of the present invention will be described.

[0609] Overview of program processing

[0610] Servers use data collection tools to collect system status and performance data, such as sensors and log file analysis tools that record system logs and performance metrics.

[0611] The collected data is input into a means for training an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model. The server uses this data to train the anomaly detection model and learn normal behavior patterns.

[0612] The server then uses the trained model to analyze newly collected data in real time to detect anomalies, and if an anomaly is detected, the server alerts administrators through notification mechanisms, which may include sending email alerts, displaying warnings on a dashboard, or triggering automated response systems.

[0613] Specific examples

[0614] For example, consider a system that monitors a company's entire IT infrastructure. Here's a specific scenario:

[0615] 1. The server collects log data from various servers and network devices within the company and sends it to a central server using a data collection tool. The data collection tool periodically executes queries to collect the necessary logs.

[0616] 2. The server trains an anomaly detection model based on the collected data. The server uses historical data to fit the Isolation Forest model, learning the normal behavior patterns of the system and establishing criteria for detecting anomalies when they occur.

[0617] 3. The server applies an anomaly detection model to newly collected data in real time to determine whether there are any anomalies. For example, if a specific server's CPU usage rate suddenly increases, this will be detected as an anomaly.

[0618] 4. If an anomaly is detected, the server will use its notification methods to alert the administrator, not only sending an alert email but also displaying the anomaly on the web dashboard and, if necessary, running scripts to automatically fix the anomaly.

[0619] 5. Users receive notifications and access the dashboard to view details of the anomaly, identify the cause of the anomaly, and take the necessary measures promptly.

[0620] In this way, the system of the present invention enables early detection of abnormalities and rapid response, significantly improving the reliability and security of the system, reducing the burden on administrators and improving the operational efficiency of the entire IT infrastructure.

[0621] The processing flow will be explained below.

[0622] Step 1:

[0623] The server collects system performance data and log data. The data collection means periodically acquires necessary log information from each server and network device and stores it in the central server.

[0624] Step 2:

[0625] The server performs initial processing of the collected data, cleansing and standardizing the format, and shaping it into a form suitable for training an anomaly detection model.

[0626] Step 3:

[0627] The server uses the initially processed data to train an anomaly detection model (Isolation Forest algorithm), which learns normal behavior patterns based on past data.

[0628] Step 4:

[0629] The server stores the trained anomaly detection model and begins anomaly detection on newly collected data in real time.

[0630] Step 5:

[0631] The server inputs newly collected data into the anomaly detection model in real time to evaluate whether anomalies exist, and if any are detected, records their index.

[0632] Step 6:

[0633] The server will alert administrators to detected anomalies using notification methods, which may include sending email alerts, displaying warnings on the dashboard, or triggering automated response systems.

[0634] Step 7:

[0635] Users receive a notification and access the dashboard to check detailed information about the anomaly, understand where the anomaly occurred, its details, and take appropriate measures.

[0636] Step 8:

[0637] After the user responds, the server reevaluates the system's operating status and checks whether the abnormality has been resolved. It also performs continuous monitoring to prevent the abnormality from recurring.

[0638] In this way, early detection of abnormalities and countermeasures can be implemented, improving the reliability and security of the system.

[0639] Example 1

[0640] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0641] Conventional system monitoring relies on periodic checks and manual analysis, which makes it difficult to detect abnormalities early and to respond quickly, which not only reduces system reliability but also increases the burden on administrators.

[0642] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0643] In this invention, the server includes means for collecting data using a log collection device, means for training an anomaly detection model using the collected data, means for detecting anomalies in real time using the trained anomaly detection model, and means for notifying an administrator of detected anomalies, thereby enabling early detection of anomalies and rapid response.

[0644] A "log collection device" is a device that collects various system logs and performance metrics and sends them to a central repository.

[0645] "Means for collecting data" refers to the means for aggregating system logs and performance data and transmitting the necessary information to a central server.

[0646] An "anomaly detection model" is a model equipped with an algorithm for detecting anomalies based on collected data.

[0647] "Isolation Forest" is an algorithm that detects anomalies by randomly subsampling data and measuring how isolated that data is from other data points.

[0648] A "training means" is a means for training an anomaly detection model using past data.

[0649] "Means for detecting anomalies in real time" refers to means for detecting anomalies by using a trained anomaly detection model to instantly analyze collected data.

[0650] "Means of notification" refers to the means by which a warning is sent to an administrator about a detected anomaly, including sending an alert email, displaying a warning on a dashboard, or triggering an automated response system.

[0651] The present invention relates to a system monitoring system using AI, which collects data using a log collection device, trains an anomaly detection model, detects anomalies in real time, and notifies an administrator of the anomalies. Hereinafter, specific embodiments of the present invention will be described.

[0652] Servers use log collection devices to collect system status and performance data. Specifically, log collection tools (e.g., Fluentd or Logstash) are used to collect various system logs and performance metrics and send them to a central repository. This aggregates the necessary log data, preparing to visualize the current status of the system.

[0653] Next, the server uses the collected data to train an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model in this process. The server uses the Python scikit-learn library to input past log data and fit the Isolation Forest model to learn normal behavior patterns. The trained model is saved to disk as a file (e.g., trained_model.pkl).

[0654] The server uses the trained anomaly detection model to analyze newly collected data in real time. As data is collected, it runs the data through the anomaly detection model and calculates an anomaly score. Specifically, by using a real-time processing platform (e.g., Kafka), analysis begins as soon as the data arrives.

[0655] If an anomaly is detected, the server will notify the administrator. This notification method can include sending an alert email, displaying a warning on the dashboard, or triggering an automated response system. For example, if the anomaly score exceeds a certain threshold, an alert email will be sent using the SMTP protocol, and JSON-formatted data containing the details of the anomaly will be sent as a POST request to the Webhook URL.

[0656] Finally, users receive a notification and can access the system dashboard to view details of the anomaly. Users can then identify the cause of the anomaly and quickly take necessary measures. This enables early detection of anomalies and rapid response, significantly improving system reliability and security. It also reduces the burden on administrators and improves the operational efficiency of the entire IT infrastructure.

[0657] Prompt Sentence Examples

[0658] "Analyze the server's anomaly detection log and determine whether an anomaly has occurred. If an anomaly has occurred, explain the details."

[0659] "Describe the process of training an anomaly detection model based on collected system log data."

[0660] "Please explain in detail how this anomaly detection system works when a server's CPU usage is abnormally high."

[0661] In this way, the system of the present invention incorporates an anomaly detection and notification process using a generative AI model, enabling monitoring of the system's operating status and rapid response when problems occur.

[0662] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0663] Step 1:

[0664] Servers use log collectors to collect system logs and performance metrics. Specifically, log collectors such as Fluentd and Logstash pull data from various systems and send it to a central repository. The input to this process is log data and metrics data, and the output is aggregated data stored in the central repository. The server configures the type and frequency of data to collect and runs queries to keep the data up to date.

[0665] Step 2:

[0666] The server trains an anomaly detection model based on the data stored in the central repository. In this process, the Isolation Forest algorithm is used to build the anomaly detection model. The input is historical system log data, and the output is the trained anomaly detection model. Specifically, the Python scikit-learn library is used to fit the model and learn normal behavior patterns. The training results are saved in a file format (e.g., trained_model.pkl).

[0667] Step 3:

[0668] The server uses the trained anomaly detection model to analyze newly collected data in real time. This process is performed automatically using a real-time processing platform (e.g., Kafka) whenever new log data arrives. The input is the newly collected log data, and the output is an anomaly score. The server applies the model to the collected data to determine whether it is an anomaly.

[0669] Step 4:

[0670] If an anomaly is detected, the server will notify the administrator by sending an alert email, displaying a warning on the dashboard, triggering an automatic response system, etc. The input to this process is the anomaly score generated in step 3, and the output is a notification to the administrator. For example, if the anomaly score exceeds a set threshold, the server will send an alert email to the administrator using the SMTP protocol and send data containing the anomaly details to the Webhook URL as a POST request.

[0671] Step 5:

[0672] The user receives a notification from the server and accesses the system dashboard to check the details of the abnormality. The input is the notification data from the server, and the output is detailed information about the abnormality. The user refers to the dashboard, identifies the cause of the abnormality, and takes necessary measures. The user can click on the abnormality entry to check detailed information and take prompt action.

[0673] This process flow enables the system to detect abnormalities early and respond quickly and appropriately.

[0674] (Application example 1)

[0675] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0676] In today's corporate environment, there is a need to quickly detect system anomalies and security threats and respond immediately. However, conventional monitoring systems have issues with delays in training models to detect anomalies and in notifications, making it difficult to respond in real time. In addition, there are insufficient means to promptly notify administrators of the results of anomaly detection, making it difficult to maintain system reliability and operational efficiency.

[0677] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0678] In this invention, the server includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, a means for notifying detected anomalies, a means for sending a push notification to an administrator using a smartphone, and a means for analyzing data in real time and displaying the data on a dashboard. This enables rapid detection and response to anomalies, enables an administrator to check the details of anomalies in real time, and significantly improves the system security of a company.

[0679] "Data collection means" refers to devices and software for collecting system operation status and performance data on a central server.

[0680] "Means for training an anomaly detection model" refers to the process of using collected data to train an anomaly detection algorithm and define normal operating patterns.

[0681] "Means for detecting anomalies" refers to the process of analyzing newly collected data in real time using a trained anomaly detection model to identify anomalies.

[0682] "Means for notifying detected abnormalities" refers to devices or software that send an alert to an administrator when an abnormality is detected.

[0683] "Means of sending push notifications to administrators using smartphones" refers to a function that immediately notifies administrators via a smartphone application when an abnormality is detected.

[0684] "Means for analyzing data in real time and displaying it on a dashboard" refers to a function for analyzing data collected in real time and displaying the results on a dashboard so that the user can visually confirm them.

[0685] The present invention relates to a system monitoring system using AI, and includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, a means for notifying an administrator of detected anomalies, a means for sending a push notification to an administrator using a smartphone, and a means for analyzing data in real time and displaying it on a dashboard. A specific embodiment of the present invention will be described below.

[0686] Program processing overview

[0687] The server uses data collection means to collect system operation status and performance data. This includes sensors that record system logs and performance metrics, and log file analysis tools. The collected data is input into means for training an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model. The server uses this data to train the anomaly detection model and learns normal operating patterns. The server then uses the trained model to analyze newly collected data in real time and detect anomalies. If an anomaly is detected, the server will alert the administrator through notification means. This can include sending an alert email, displaying a warning on the dashboard, and also sending push notifications via smartphones.

[0688] Hardware and software used

[0689] Hardware: Servers, smartphones, sensors

[0690] Software: Python, Flask, scikit-learn, smartphone application

[0691] Data processing and calculation

[0692] The server collects log data from network devices and systems, preprocesses it, and inputs it into an anomaly detection model. The main algorithm used is Isolation Forest, which uses past log data to train the anomaly detection model. The resulting model analyzes real-time data and detects anomalies. Detected anomalies are immediately sent to the administrator's smartphone as a push notification. The analysis results are then visually displayed on a dashboard, allowing the administrator to check the details.

[0693] Specific examples

[0694] For example, consider a system that monitors a company's entire IT infrastructure. The server collects log data from various servers and network devices within the company and sends it to a central server using a data collection method. An anomaly detection model is trained based on the collected data. The server uses past data to fit an Isolation Forest model and learns the normal operating patterns of the system. This model is applied to newly collected data in real time to determine whether an anomaly exists. For example, a sudden increase in CPU usage on a specific server is detected as an anomaly. If an anomaly is detected, the server sends a warning to the administrator using a notification method. In addition to sending an alert email, a push notification is sent to the administrator's smartphone and the anomaly is displayed on a web dashboard. The administrator receives the notification and accesses the dashboard to check the details of the anomaly. This allows the cause of the anomaly to be identified and necessary measures to be taken promptly.

[0695] Prompt Sentence Examples

[0696] "Analyze new data using an anomaly detection model and notify me if there are any anomalies:

[0697] CPU usage, memory usage, network traffic"

[0698] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0699] Step 1: Data collection

[0700] The server collects system operation status and performance data. Specifically, it periodically collects log data from network devices and servers and sends it to a central server. The input data is the log files and sensor data of each device, and the output is data stored on the central server.

[0701] Step 2: Data Preprocessing

[0702] The server preprocesses the collected raw data, specifically filtering the raw data, imputing missing values, removing noise, etc. The input is the raw data collected in step 1, and the output is the preprocessed, clean data.

[0703] Step 3: Training the anomaly detection model

[0704] The server uses the preprocessed data to train an anomaly detection model. Specifically, it uses the Isolation Forest algorithm to learn normal behavior patterns. The input is the preprocessed data from step 2, and the output is the trained anomaly detection model.

[0705] Step 4: Analyzing real-time data

[0706] The server applies the anomaly detection model to newly collected data in real time. Specifically, the collected data is input into the model to determine whether there are any anomalies. The input is the raw data collected in real time, and the output is the anomaly detection result.

[0707] Step 5: Notification of abnormalities

[0708] If an abnormality is detected, the server will issue a warning to the administrator using a notification method. Specifically, in addition to sending an email or displaying a warning on the dashboard, it will also send a push notification to the smartphone. The input is the abnormality detection result in step 4, and the output is a notification to the administrator.

[0709] Step 6: Display the data in a dashboard

[0710] The server displays the analysis results on a dashboard. Specifically, it visually displays the anomaly detection results so that administrators can check them in real time. The input is the data obtained in steps 4 and 5, and the output is the analysis results displayed on the dashboard.

[0711] Step 7: Administrator Action

[0712] The user (administrator) receives the notification and accesses the dashboard to check the details of the anomaly. Specifically, based on the anomaly data on the dashboard, the user identifies the cause of the anomaly and takes necessary measures. The input is the notification and data display in Step 5 and Step 6, and the output is the measures to be taken against the anomaly.

[0713] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[0714] The present invention combines an AI-based system monitoring system with an emotion engine that recognizes user emotions, and describes a system that includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, a means for notifying detected anomalies, and an emotion engine.

[0715] Overview of program processing

[0716] The server uses data collection methods to collect system status and performance data, including sensors and log file analysis tools that capture system logs and performance metrics.

[0717] The collected data is input into a means for training an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model. The server uses this data to train the anomaly detection model and learn normal behavior patterns.

[0718] The server then uses the trained model to analyze newly collected data in real time to detect anomalies, and if any are detected, the server alerts administrators through notification mechanisms, which may include sending email alerts, displaying warnings on a dashboard, or triggering automated response systems.

[0719] The emotion engine collects user emotional data and dynamically changes the notification method for anomalies based on that information. For example, if a user is feeling stressed, the notification content can be made more detailed or the notification method can be flexibly changed. Emotion data is also used to train anomaly detection models, enabling more accurate anomaly detection.

[0720] Specific examples

[0721] For example, consider a system that monitors a company's entire IT infrastructure. Here's a specific scenario:

[0722] 1. The server collects log data from various servers and network devices within the company and sends it to a central server using a data collection tool. The data collection tool periodically executes queries to collect the necessary logs.

[0723] 2. The server trains an anomaly detection model based on the collected data. The server uses historical data to fit the Isolation Forest model, learning the normal behavior patterns of the system and establishing criteria for detecting anomalies when they occur.

[0724] 3. The server applies an anomaly detection model to newly collected data in real time to determine whether there are any anomalies. For example, if a specific server's CPU usage rate suddenly increases, this will be detected as an anomaly.

[0725] 4. If an anomaly is detected, the server uses an emotion engine to collect user emotion data and dynamically adjust the notification method. For example, if the user is feeling stressed, it will send a notification with a detailed explanation and additional information.

[0726] 5. The server uses notification mechanisms to alert administrators, not only sending email alerts but also displaying anomalies on the web dashboard and, if necessary, running scripts to automatically fix the anomaly.

[0727] 6. The user receives a notification and accesses the dashboard to check detailed information about the anomaly. The user understands the location and details of the anomaly and can take appropriate measures promptly. The user also adjusts the necessary response according to the content of the notification provided by the emotion engine.

[0728] 7. After the user responds, the server reevaluates the system's operating status and checks whether the abnormality has been resolved. It continues to monitor the system to ensure that the abnormality does not recur.

[0729] In this way, the system of the present invention, by combining an emotion engine, enables early detection of anomalies and rapid response, significantly improving the reliability and security of the system, reducing the burden on administrators and realizing more effective operation of IT infrastructure.

[0730] The processing flow will be explained below.

[0731] Step 1:

[0732] The server collects log data from the enterprise and network devices, and periodically transmits the necessary log information from each server and network device to the central server using a data collection tool.

[0733] Step 2:

[0734] The server performs initial processing of the collected data, cleansing and standardizing the format, and shaping it into a form suitable for training an anomaly detection model.

[0735] Step 3:

[0736] The server uses the initially processed data to train an anomaly detection model (Isolation Forest algorithm), learning normal behavior patterns and setting criteria for detecting anomalies.

[0737] Step 4:

[0738] The server stores the trained anomaly detection model and begins detecting anomalies in newly collected data in real time.

[0739] Step 5:

[0740] The server inputs newly collected data into the anomaly detection model in real time to evaluate whether an anomaly exists, and if one is detected, records its index.

[0741] Step 6:

[0742] When an abnormality is detected, the server uses an emotion engine to collect the user's emotional data, thereby understanding the user's emotional state.

[0743] Step 7:

[0744] The server can then change the notification method for anomalies based on the user's emotional data. For example, if the emotion engine detects that the user is feeling stressed, it can issue a notification with a detailed explanation and additional information.

[0745] Step 8:

[0746] The server will alert the administrator using a notification mechanism, which may include sending an email alert, displaying a warning on the dashboard, or triggering an automated response system.

[0747] Step 9:

[0748] Users receive notifications and access the dashboard to check detailed information about the anomaly. Users can understand the location and details of the anomaly and take appropriate measures promptly. They can also check the content of notifications based on the emotion engine and adjust their response.

[0749] Step 10:

[0750] After the user responds, the server reevaluates the system's operating status, checks whether the abnormality has been resolved, and continues monitoring to prevent the abnormality from recurring.

[0751] In this way, early detection and countermeasures for abnormalities become possible, improving the reliability and security of the system. In addition, the introduction of an emotion engine dynamically adjusts notification methods, reducing the burden on administrators.

[0752] Example 2

[0753] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0754] While conventional system monitoring systems can detect anomalies by collecting data on system operation status and performance, they face the problem of difficulty in implementing flexible notification methods that take into account the emotional state of the user. Additionally, while using emotional data is effective in improving the accuracy of anomaly detection models, there is a lack of means to achieve this.

[0755] The specific processing by the specific processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means.

[0756] In this invention, the server includes a data collection means, a means for training an anomaly detection model, a means for detecting an anomaly, a means for notifying the user of the detected anomaly, and a means for collecting user emotion data and dynamically adjusting the notification method, thereby enabling a flexible notification method that takes the user's emotional state into consideration and improving the accuracy of the anomaly detection model.

[0757] "Data collection means" is a general term for devices and software used to collect system operating status and performance data.

[0758] "Means for training an anomaly detection model" refers to the process or equipment used to train an anomaly detection algorithm using collected data to identify normal operating patterns.

[0759] "Means for detecting anomalies" refers to devices or software that use a trained anomaly detection model to analyze newly collected data and determine whether an anomaly has occurred.

[0760] "Means for notifying detected abnormalities" is a general term for devices and software that include notification methods such as email, alerts, and dashboard displays to convey information about abnormalities to administrators when they occur.

[0761] "Means for collecting user emotional data and dynamically adjusting notification methods" refers to devices or algorithms that analyze the user's emotional state and change the content and method of notifications based on the results.

[0762] The "Isolation Forest algorithm" is a machine learning algorithm for anomaly detection, and refers to a technology that learns normal patterns from large amounts of data and identifies anomalous data points.

[0763] "Means for collecting real-time data and inputting it into the anomaly detection model" refers to devices and software that collect data from the system in real time and immediately supply that data to the anomaly detection model for analysis.

[0764] This invention combines an AI-based system monitoring system with an emotion engine that recognizes user emotions. The system mainly consists of the following components, and we will explain in detail how each component works.

[0765] Data collection methods:

[0766] Servers use various sensors and log file analysis tools to collect system status and performance data. Specific hardware includes sensors for acquiring system logs and monitoring agents for collecting performance metrics. The collected data is sent to a central server for analysis.

[0767] To train an anomaly detection model:

[0768] The server uses the collected data to train an anomaly detection model. This process uses the Isolation Forest algorithm to learn normal behavior patterns. By training the anomaly detection model using past data, the normal behavior patterns of the system are established.

[0769] Means of detecting anomalies:

[0770] The server analyzes newly collected data in real time using the trained anomaly detection model to detect anomalies, and if an anomaly is detected, details about the anomaly are recorded and the system proceeds to the next step.

[0771] Notification of detected anomalies:

[0772] The server has the means to notify administrators of detected anomalies, including sending alert emails, displaying anomalies on a web dashboard, and running scripts to automatically fix the anomalies.

[0773] A means to collect user emotional data and dynamically adjust notification methods:

[0774] The server uses an emotion engine to collect user emotional data and dynamically adjust the notification method. It collects the user's keyboard typing speed, mouse movement speed, and vital data from the wearable device to analyze whether the user is feeling stressed or relaxed. Based on this information, the server can change the content and method of notifications to provide more appropriate notifications.

[0775] Specific examples

[0776] For example, consider a system that monitors a company's entire IT infrastructure operating as follows:

[0777] 1. A server collects log data from servers and network devices within a company and sends it to a central server. For example, it retrieves system logs and performance metrics every minute.

[0778] 2. The server trains the IsolationForest model based on past collected data to learn the normal operating patterns of the system.

[0779] 3. The server applies the trained model to newly collected data and detects anomalies in real time. For example, if a particular server experiences a sudden increase in CPU usage, it will detect this as an anomaly.

[0780] 4. If an anomaly is detected, the server uses an emotion engine to collect user emotion data and dynamically adjust the notification method. For example, if the server determines that the user is in a stressful state, it will send a notification with a detailed explanation and additional information.

[0781] 5. The server alerts the administrator using notification methods, which may include sending email alerts, displaying anomalies on a web dashboard, and, if necessary, running scripts to automatically fix the anomaly.

[0782] Prompt Sentence Examples

[0783] I would like to develop a system that monitors my company's entire IT infrastructure. I would like to know how to collect system logs and performance metrics, detect abnormalities, and notify administrators. I would also like to incorporate a mechanism that dynamically changes the notification method based on user sentiment. Please explain in detail the specific algorithms and technologies that will be used to achieve this.

[0784] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0785] Step 1: Data collection

[0786] The server collects system operation status and performance data.

[0787] Input: Data from various sensors, log files, and tools that capture performance metrics.

[0788] Every minute the server parses the system log files to check for new entries.

[0789] The server runs SQL queries against the database and periodically collects performance metrics.

[0790] Output: The collected data is sent to a central server.

[0791] Step 2: Training the anomaly detection model

[0792] The server uses the collected data to train an anomaly detection model.

[0793] Input: Previously collected data.

[0794] The server trains the IsolationForest model using CPU usage data from the past six months.

[0795] The server stores the trained models in the / models / directory.

[0796] Output: An anomaly detection model that has learned normal behavior patterns.

[0797] Step 3: Real-time anomaly detection

[0798] The server analyzes newly collected data in real time using the trained anomaly detection model to detect anomalies.

[0799] Input: Log data and performance metrics collected in real time.

[0800] The server inputs system log data collected every minute into the model to detect anomalous patterns.

[0801] For example, if the CPU usage of a particular server suddenly rises above 90%, it will be recorded as an abnormality.

[0802] Output: Detailed information about the detected anomaly.

[0803] Step 4: Adjust emotion data collection and notification methods

[0804] The server uses an emotion engine to collect user emotion data and dynamically adjust the notification method.

[0805] Input: User keyboard typing speed, mouse movement speed, and vital data from wearable devices.

[0806] The server analyzes the user's emotional state based on this data.

[0807] For example, it may be determined that a user is under stress because the user is typing quickly.

[0808] Output: Adjustment of notification method based on the user's emotional state.

[0809] Step 5: Administrator Notification

[0810] The server notifies the administrator of any detected abnormalities.

[0811] Input: Detailed information about the anomaly detected in step 3, and the notification method adjusted in step 4.

[0812] The server sends an alert email to the administrator's email address.

[0813] The server displays alerts on a web dashboard and runs scripts to automatically fix anomalies.

[0814] Output: Notify administrator and fix anomaly.

[0815] Step 6: User response and dashboard check

[0816] The user receives a notification and visits the dashboard to view detailed information about the anomaly.

[0817] Input: The notification sent by the server.

[0818] The user clicks on the link in the notification to access the web dashboard.

[0819] The user sees detailed information on the dashboard such as "CPU usage on Server X has spiked."

[0820] Output: User understands abnormal conditions and takes measures.

[0821] Step 7: Reassess your system and continue monitoring

[0822] After the user responds, the server reevaluates the system's operating status and checks whether the abnormality has been resolved.

[0823] Input: Latest system data after the user has responded to the abnormality.

[0824] The server re-enters the latest CPU usage data and other data into the model to check whether the abnormality has recurred.

[0825] The server continuously monitors performance metrics across the system and immediately notifies you of any new anomalies.

[0826] Output: Confirmation that the abnormality has been resolved and continuous system monitoring.

[0827] (Application example 2)

[0828] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0829] In autonomous vehicles, it is important to detect system anomalies early and take prompt and appropriate action. However, conventional systems only issue uniform notifications when an anomaly is detected, making it difficult to flexibly adjust response methods taking into account the emotional state of the driver or engineer. Furthermore, emotional data is not utilized to improve the accuracy of anomaly detection. This can lead to delayed or incorrect responses to anomalies.

[0830] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, an emotion engine for recognizing the user's emotions, a means for notifying the user of the detected anomaly, and a means for dynamically adjusting the content of the notification based on the emotion data. This enables early detection of system anomalies in an autonomous vehicle and flexible responses according to the emotional states of the driver and technicians. Furthermore, utilizing emotion data improves the accuracy of anomaly detection, enabling more appropriate responses.

[0831] "Data collection means" refers to devices and methods for collecting system data, sensor data, etc. of autonomous vehicles.

[0832] A "means for training an anomaly detection model" is a machine learning algorithm or method that uses collected data to learn normal and abnormal behavior.

[0833] A "means for detecting anomalies" is a method or device that uses a trained anomaly detection model to analyze new data collected in real time and determine whether or not an anomaly exists.

[0834] The "emotion engine that recognizes user emotions" is software and hardware that uses biosensors and cameras to recognize and analyze the emotional state of drivers and technicians.

[0835] "Means for notifying detected abnormalities" refers to a system or method for conveying information about an abnormality to a manager or driver when it is detected.

[0836] The "means for dynamically adjusting notification content based on emotional data" refers to a method or system for flexibly changing notification content in the event of an abnormality based on the emotional state of the user.

[0837] The "Isolation Forest algorithm" is a machine learning algorithm used for anomaly detection, and is a method for detecting anomalies by measuring the degree of isolation of data.

[0838] "Real-time data" refers to the latest data that is currently being measured and collected by autonomous vehicles.

[0839] This invention is a system for detecting system anomalies early in an autonomous vehicle and notifying drivers and engineers according to their emotional states. The system includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, an emotion engine for recognizing user emotions, a means for notifying drivers of detected anomalies, and a means for dynamically adjusting the content of the notification based on the emotion data.

[0840] The server first collects system and sensor data from the autonomous vehicle. The collected data is stored in a database and used to train an anomaly detection model. The Isolation Forest algorithm is applied as this anomaly detection model. This algorithm is used to learn normal operating patterns and identify anomalous data points.

[0841] The server then uses the trained anomaly detection model to analyze newly collected data in real time and determine whether anomalies exist. If an anomaly is detected, the server uses an emotion engine to collect and analyze the user's emotional state in real time. This emotion engine identifies the user's emotional state based on facial recognition sensors and biometric data (heart rate, galvanic skin response, etc.).

[0842] The content of notifications in the event of an abnormality is dynamically adjusted based on the emotional data collected by the emotion engine. If the user is feeling stressed, the server will send a notification with a detailed explanation and additional information, encouraging them to stay calm. If the user's emotional state is normal, a simple notification will be sent. In this way, the server helps users take appropriate action quickly in the event of an abnormality.

[0843] Consider the following scenario: If an engine abnormality is detected while an autonomous vehicle is driving, the server analyzes engine status data in real time. At the same time, the emotion engine monitors the driver's heart rate and facial expressions to determine whether the driver is experiencing stress. If the driver is experiencing stress, a notification containing detailed information about the abnormality and how to deal with it is sent to the driver's smartphone.

[0844] Additionally, generative AI models can be used to set prompts that help obtain additional information. For example, the following prompts can be used:

[0845] Example prompt sentence:

[0846] Please generate a detailed functional description of a monitoring application for an autonomous vehicle. This app collects vehicle system data and detects anomalies. In addition, it monitors the driver's emotions in real time and dynamically adjusts notification content based on the driver's emotions when an anomaly is detected. Please provide a detailed description, including the following points:

[0847] Emotion data is collected using facial recognition sensors and biometric information

[0848] Isolation Forest is used as an anomaly detection model.

[0849] Notification method and content for abnormal events change based on emotions

[0850] This allows for refinement of detailed specifications and functional descriptions of the application.

[0851] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0852] Step 1:

[0853] Data collection:

[0854] The server collects system data (e.g., engine status, GPS data, sensor information, etc.) from the autonomous vehicle. The input is data from various sensors on the vehicle, and the output is the collected dataset. This dataset is used to train the anomaly detection model.

[0855] Step 2:

[0856] Training an anomaly detection model:

[0857] The server trains an anomaly detection model (Isolation Forest algorithm) using the dataset collected in step 1. The input is the collected system dataset, and the output is the trained anomaly detection model. The server uses this model to learn normal behavior patterns and set criteria for detecting anomalies.

[0858] Step 3:

[0859] Real-time data analysis:

[0860] The server applies an anomaly detection model to newly collected data in real time. The input is the system data collected in real time, and the output is the presence or absence of detected anomalies. Based on this analysis, the server determines whether an anomaly has occurred.

[0861] Step 4:

[0862] Emotion data collection:

[0863] The server collects the emotional state of the user (driver or technician) in real time. The input is data from a facial recognition sensor and biometric data (heart rate, skin galvanic response, etc.), and the output is the emotional state analysis result by the emotion engine. The server then determines whether the user is feeling stressed.

[0864] Step 5:

[0865] Notification in case of an abnormality:

[0866] The server adjusts the notification content based on the emotional data from step 4 and sends the anomaly detected in step 3. The input is the anomaly detection result and the analysis result of the emotional state, and the output is the adjusted notification content. Based on the emotional state, the server sends a notification including a detailed explanation or additional information to a smartphone or other device as needed.

[0867] Step 6:

[0868] Receiving and Responding to Notifications:

[0869] The user receives the notification sent from the server and checks the content. The input is the notification from the server, and the output is the user's response action. Based on this notification, the user can quickly take appropriate measures to deal with the system abnormality.

[0870] Step 7:

[0871] Reassess your system health:

[0872] The server reevaluates the system's operating status after the user responds. The input is the re-collected system data, and the output is the result of determining whether the abnormality has been resolved. The server checks whether the abnormality has been resolved and performs continuous monitoring.

[0873] Step 8:

[0874] Leveraging generative AI models:

[0875] The server uses a generative AI model to perform further analysis and improve the notification content. The input is the anomaly detection result and emotion data, and the output is optimized notification content and additional countermeasure suggestions. The following prompt sentence is used to instruct the AI ​​model to generate a detailed explanation.

[0876] Please generate a detailed functional description of a monitoring application for an autonomous vehicle. This app collects vehicle system data and detects anomalies. In addition, it monitors the driver's emotions in real time and dynamically adjusts notification content based on the driver's emotions when an anomaly is detected. Please provide a detailed description, including the following points:

[0877] Emotion data is collected using facial recognition sensors and biometric information

[0878] Isolation Forest is used as an anomaly detection model.

[0879] Notification method and content for abnormal events change based on emotions

[0880] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0881] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0882] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the headset type terminal 314.

[0883] [Fourth embodiment]

[0884] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[0885] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0886] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0887] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[0888] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0889] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0890] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0891] The control object 443 includes a display device, LEDs in the eyes, and motors for driving the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[0892] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0893] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0894] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0895] In the robot 414, the processor 46 performs the reception output process. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0896] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[0897] The present invention relates to a system monitoring system using AI, and includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, and a means for notifying detected anomalies. Below, specific embodiments of the present invention will be described.

[0898] Overview of program processing

[0899] Servers use data collection tools to collect system status and performance data, such as sensors and log file analysis tools that record system logs and performance metrics.

[0900] The collected data is input into a means for training an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model. The server uses this data to train the anomaly detection model and learn normal behavior patterns.

[0901] The server then uses the trained model to analyze newly collected data in real time to detect anomalies, and if an anomaly is detected, the server alerts administrators through notification mechanisms, which may include sending email alerts, displaying warnings on a dashboard, or triggering automated response systems.

[0902] Specific examples

[0903] For example, consider a system that monitors a company's entire IT infrastructure. Here's a specific scenario:

[0904] 1. The server collects log data from various servers and network devices within the company and sends it to a central server using a data collection tool. The data collection tool periodically executes queries to collect the necessary logs.

[0905] 2. The server trains an anomaly detection model based on the collected data. The server uses historical data to fit the Isolation Forest model, learning the normal behavior patterns of the system and establishing criteria for detecting anomalies when they occur.

[0906] 3. The server applies an anomaly detection model to newly collected data in real time to determine whether there are any anomalies. For example, if a specific server's CPU usage rate suddenly increases, this will be detected as an anomaly.

[0907] 4. If an anomaly is detected, the server will use its notification methods to alert the administrator, not only sending an alert email but also displaying the anomaly on the web dashboard and, if necessary, running scripts to automatically fix the anomaly.

[0908] 5. Users receive notifications and access the dashboard to view details of the anomaly, identify the cause of the anomaly, and take the necessary measures promptly.

[0909] In this way, the system of the present invention enables early detection of abnormalities and rapid response, significantly improving the reliability and security of the system, reducing the burden on administrators and improving the operational efficiency of the entire IT infrastructure.

[0910] The processing flow will be explained below.

[0911] Step 1:

[0912] The server collects system performance data and log data. The data collection means periodically acquires necessary log information from each server and network device and stores it in the central server.

[0913] Step 2:

[0914] The server performs initial processing of the collected data, cleansing and standardizing the format, and shaping it into a form suitable for training an anomaly detection model.

[0915] Step 3:

[0916] The server uses the initially processed data to train an anomaly detection model (Isolation Forest algorithm), which learns normal behavior patterns based on past data.

[0917] Step 4:

[0918] The server stores the trained anomaly detection model and begins anomaly detection on newly collected data in real time.

[0919] Step 5:

[0920] The server inputs newly collected data into the anomaly detection model in real time to evaluate whether anomalies exist, and if any are detected, records their index.

[0921] Step 6:

[0922] The server will alert administrators to detected anomalies using notification methods, which may include sending email alerts, displaying warnings on the dashboard, or triggering automated response systems.

[0923] Step 7:

[0924] Users receive a notification and access the dashboard to check detailed information about the anomaly, understand where the anomaly occurred, its details, and take appropriate measures.

[0925] Step 8:

[0926] After the user responds, the server reevaluates the system's operating status and checks whether the abnormality has been resolved. It also performs continuous monitoring to prevent the abnormality from recurring.

[0927] In this way, early detection of abnormalities and countermeasures can be implemented, improving the reliability and security of the system.

[0928] Example 1

[0929] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[0930] Conventional system monitoring relies on periodic checks and manual analysis, which makes it difficult to detect abnormalities early and to respond quickly, which not only reduces system reliability but also increases the burden on administrators.

[0931] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0932] In this invention, the server includes means for collecting data using a log collection device, means for training an anomaly detection model using the collected data, means for detecting anomalies in real time using the trained anomaly detection model, and means for notifying an administrator of detected anomalies, thereby enabling early detection of anomalies and rapid response.

[0933] A "log collection device" is a device that collects various system logs and performance metrics and sends them to a central repository.

[0934] "Means for collecting data" refers to the means for aggregating system logs and performance data and transmitting the necessary information to a central server.

[0935] An "anomaly detection model" is a model equipped with an algorithm for detecting anomalies based on collected data.

[0936] "Isolation Forest" is an algorithm that detects anomalies by randomly subsampling data and measuring how isolated that data is from other data points.

[0937] A "training means" is a means for training an anomaly detection model using past data.

[0938] "Means for detecting anomalies in real time" refers to means for detecting anomalies by using a trained anomaly detection model to instantly analyze collected data.

[0939] "Means of notification" refers to the means by which a warning is sent to an administrator about a detected anomaly, including sending an alert email, displaying a warning on a dashboard, or triggering an automated response system.

[0940] The present invention relates to a system monitoring system using AI, which collects data using a log collection device, trains an anomaly detection model, detects anomalies in real time, and notifies an administrator of the anomalies. Hereinafter, specific embodiments of the present invention will be described.

[0941] Servers use log collection devices to collect system status and performance data. Specifically, log collection tools (e.g., Fluentd or Logstash) are used to collect various system logs and performance metrics and send them to a central repository. This aggregates the necessary log data, preparing to visualize the current status of the system.

[0942] Next, the server uses the collected data to train an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model in this process. The server uses the Python scikit-learn library to input past log data and fit the Isolation Forest model to learn normal behavior patterns. The trained model is saved to disk as a file (e.g., trained_model.pkl).

[0943] The server uses the trained anomaly detection model to analyze newly collected data in real time. As data is collected, it runs the data through the anomaly detection model and calculates an anomaly score. Specifically, by using a real-time processing platform (e.g., Kafka), analysis begins as soon as the data arrives.

[0944] If an anomaly is detected, the server will notify the administrator. This notification method can include sending an alert email, displaying a warning on the dashboard, or triggering an automated response system. For example, if the anomaly score exceeds a certain threshold, an alert email will be sent using the SMTP protocol, and JSON-formatted data containing the details of the anomaly will be sent as a POST request to the Webhook URL.

[0945] Finally, users receive a notification and can access the system dashboard to view details of the anomaly. Users can then identify the cause of the anomaly and quickly take necessary measures. This enables early detection of anomalies and rapid response, significantly improving system reliability and security. It also reduces the burden on administrators and improves the operational efficiency of the entire IT infrastructure.

[0946] Prompt Sentence Examples

[0947] "Analyze the server's anomaly detection log and determine whether an anomaly has occurred. If an anomaly has occurred, explain the details."

[0948] "Describe the process of training an anomaly detection model based on collected system log data."

[0949] "Please explain in detail how this anomaly detection system works when a server's CPU usage is abnormally high."

[0950] In this way, the system of the present invention incorporates an anomaly detection and notification process using a generative AI model, enabling monitoring of the system's operating status and rapid response when problems occur.

[0951] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0952] Step 1:

[0953] Servers use log collectors to collect system logs and performance metrics. Specifically, log collectors such as Fluentd and Logstash pull data from various systems and send it to a central repository. The input to this process is log data and metrics data, and the output is aggregated data stored in the central repository. The server configures the type and frequency of data to collect and runs queries to keep the data up to date.

[0954] Step 2:

[0955] The server trains an anomaly detection model based on the data stored in the central repository. In this process, the Isolation Forest algorithm is used to build the anomaly detection model. The input is historical system log data, and the output is the trained anomaly detection model. Specifically, the Python scikit-learn library is used to fit the model and learn normal behavior patterns. The training results are saved in a file format (e.g., trained_model.pkl).

[0956] Step 3:

[0957] The server uses the trained anomaly detection model to analyze newly collected data in real time. This process is performed automatically using a real-time processing platform (e.g., Kafka) whenever new log data arrives. The input is the newly collected log data, and the output is an anomaly score. The server applies the model to the collected data to determine whether it is an anomaly.

[0958] Step 4:

[0959] If an anomaly is detected, the server will notify the administrator by sending an alert email, displaying a warning on the dashboard, triggering an automatic response system, etc. The input to this process is the anomaly score generated in step 3, and the output is a notification to the administrator. For example, if the anomaly score exceeds a set threshold, the server will send an alert email to the administrator using the SMTP protocol and send data containing the anomaly details to the Webhook URL as a POST request.

[0960] Step 5:

[0961] The user receives a notification from the server and accesses the system dashboard to check the details of the abnormality. The input is the notification data from the server, and the output is detailed information about the abnormality. The user refers to the dashboard, identifies the cause of the abnormality, and takes necessary measures. The user can click on the abnormality entry to check detailed information and take prompt action.

[0962] This process flow enables the system to detect abnormalities early and respond quickly and appropriately.

[0963] (Application example 1)

[0964] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[0965] In today's corporate environment, there is a need to quickly detect system anomalies and security threats and respond immediately. However, conventional monitoring systems have issues with delays in training models to detect anomalies and in notifications, making it difficult to respond in real time. In addition, there are insufficient means to promptly notify administrators of the results of anomaly detection, making it difficult to maintain system reliability and operational efficiency.

[0966] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0967] In this invention, the server includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, a means for notifying detected anomalies, a means for sending a push notification to an administrator using a smartphone, and a means for analyzing data in real time and displaying the data on a dashboard. This enables rapid detection and response to anomalies, enables an administrator to check the details of anomalies in real time, and significantly improves the system security of a company.

[0968] "Data collection means" refers to devices and software for collecting system operation status and performance data on a central server.

[0969] "Means for training an anomaly detection model" refers to the process of using collected data to train an anomaly detection algorithm and define normal operating patterns.

[0970] "Means for detecting anomalies" refers to the process of analyzing newly collected data in real time using a trained anomaly detection model to identify anomalies.

[0971] "Means for notifying detected abnormalities" refers to devices or software that send an alert to an administrator when an abnormality is detected.

[0972] "Means of sending push notifications to administrators using smartphones" refers to a function that immediately notifies administrators via a smartphone application when an abnormality is detected.

[0973] "Means for analyzing data in real time and displaying it on a dashboard" refers to a function for analyzing data collected in real time and displaying the results on a dashboard so that the user can visually confirm them.

[0974] The present invention relates to a system monitoring system using AI, and includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, a means for notifying an administrator of detected anomalies, a means for sending a push notification to an administrator using a smartphone, and a means for analyzing data in real time and displaying it on a dashboard. A specific embodiment of the present invention will be described below.

[0975] Program processing overview

[0976] The server uses data collection means to collect system operation status and performance data. This includes sensors that record system logs and performance metrics, and log file analysis tools. The collected data is input into means for training an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model. The server uses this data to train the anomaly detection model and learns normal operating patterns. The server then uses the trained model to analyze newly collected data in real time and detect anomalies. If an anomaly is detected, the server will alert the administrator through notification means. This can include sending an alert email, displaying a warning on the dashboard, and also sending push notifications via smartphones.

[0977] Hardware and software used

[0978] Hardware: Servers, smartphones, sensors

[0979] Software: Python, Flask, scikit-learn, smartphone application

[0980] Data processing and calculation

[0981] The server collects log data from network devices and systems, preprocesses it, and inputs it into an anomaly detection model. The main algorithm used is Isolation Forest, which uses past log data to train the anomaly detection model. The resulting model analyzes real-time data and detects anomalies. Detected anomalies are immediately sent to the administrator's smartphone as a push notification. The analysis results are then visually displayed on a dashboard, allowing the administrator to check the details.

[0982] Specific examples

[0983] For example, consider a system that monitors a company's entire IT infrastructure. The server collects log data from various servers and network devices within the company and sends it to a central server using a data collection method. An anomaly detection model is trained based on the collected data. The server uses past data to fit an Isolation Forest model and learns the normal operating patterns of the system. This model is applied to newly collected data in real time to determine whether an anomaly exists. For example, a sudden increase in CPU usage on a specific server is detected as an anomaly. If an anomaly is detected, the server sends a warning to the administrator using a notification method. In addition to sending an alert email, a push notification is sent to the administrator's smartphone and the anomaly is displayed on a web dashboard. The administrator receives the notification and accesses the dashboard to check the details of the anomaly. This allows the cause of the anomaly to be identified and necessary measures to be taken promptly.

[0984] Prompt Sentence Examples

[0985] "Analyze new data using an anomaly detection model and notify me if there are any anomalies:

[0986] CPU usage, memory usage, network traffic"

[0987] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0988] Step 1: Data collection

[0989] The server collects system operation status and performance data. Specifically, it periodically collects log data from network devices and servers and sends it to a central server. The input data is the log files and sensor data of each device, and the output is data stored on the central server.

[0990] Step 2: Data Preprocessing

[0991] The server preprocesses the collected raw data, specifically filtering the raw data, imputing missing values, removing noise, etc. The input is the raw data collected in step 1, and the output is the preprocessed, clean data.

[0992] Step 3: Training the anomaly detection model

[0993] The server uses the preprocessed data to train an anomaly detection model. Specifically, it uses the Isolation Forest algorithm to learn normal behavior patterns. The input is the preprocessed data from step 2, and the output is the trained anomaly detection model.

[0994] Step 4: Analyzing real-time data

[0995] The server applies the anomaly detection model to newly collected data in real time. Specifically, the collected data is input into the model to determine whether there are any anomalies. The input is the raw data collected in real time, and the output is the anomaly detection result.

[0996] Step 5: Notification of abnormalities

[0997] If an abnormality is detected, the server will issue a warning to the administrator using a notification method. Specifically, in addition to sending an email or displaying a warning on the dashboard, it will also send a push notification to the smartphone. The input is the abnormality detection result in step 4, and the output is a notification to the administrator.

[0998] Step 6: Display the data in a dashboard

[0999] The server displays the analysis results on a dashboard. Specifically, it visually displays the anomaly detection results so that administrators can check them in real time. The input is the data obtained in steps 4 and 5, and the output is the analysis results displayed on the dashboard.

[1000] Step 7: Administrator Action

[1001] The user (administrator) receives the notification and accesses the dashboard to check the details of the anomaly. Specifically, based on the anomaly data on the dashboard, the user identifies the cause of the anomaly and takes necessary measures. The input is the notification and data display in Step 5 and Step 6, and the output is the measures to be taken against the anomaly.

[1002] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[1003] The present invention combines an AI-based system monitoring system with an emotion engine that recognizes user emotions, and describes a system that includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, a means for notifying detected anomalies, and an emotion engine.

[1004] Overview of program processing

[1005] The server uses data collection methods to collect system status and performance data, including sensors and log file analysis tools that capture system logs and performance metrics.

[1006] The collected data is input into a means for training an anomaly detection model. The Isolation Forest algorithm is used as the anomaly detection model. The server uses this data to train the anomaly detection model and learn normal behavior patterns.

[1007] The server then uses the trained model to analyze newly collected data in real time to detect anomalies, and if any are detected, the server alerts administrators through notification mechanisms, which may include sending email alerts, displaying warnings on a dashboard, or triggering automated response systems.

[1008] The emotion engine collects user emotional data and dynamically changes the notification method for anomalies based on that information. For example, if a user is feeling stressed, the notification content can be made more detailed or the notification method can be flexibly changed. Emotion data is also used to train anomaly detection models, enabling more accurate anomaly detection.

[1009] Specific examples

[1010] For example, consider a system that monitors a company's entire IT infrastructure. Here's a specific scenario:

[1011] 1. The server collects log data from various servers and network devices within the company and sends it to a central server using a data collection tool. The data collection tool periodically executes queries to collect the necessary logs.

[1012] 2. The server trains an anomaly detection model based on the collected data. The server uses historical data to fit the Isolation Forest model, learning the normal behavior patterns of the system and establishing criteria for detecting anomalies when they occur.

[1013] 3. The server applies an anomaly detection model to newly collected data in real time to determine whether there are any anomalies. For example, if a specific server's CPU usage rate suddenly increases, this will be detected as an anomaly.

[1014] 4. If an anomaly is detected, the server uses an emotion engine to collect user emotion data and dynamically adjust the notification method. For example, if the user is feeling stressed, it will send a notification with a detailed explanation and additional information.

[1015] 5. The server uses notification mechanisms to alert administrators, not only sending email alerts but also displaying anomalies on the web dashboard and, if necessary, running scripts to automatically fix the anomaly.

[1016] 6. The user receives a notification and accesses the dashboard to check detailed information about the anomaly. The user understands the location and details of the anomaly and can take appropriate measures promptly. The user also adjusts the necessary response according to the content of the notification provided by the emotion engine.

[1017] 7. After the user responds, the server reevaluates the system's operating status and checks whether the abnormality has been resolved. It continues to monitor the system to ensure that the abnormality does not recur.

[1018] In this way, the system of the present invention, by combining an emotion engine, enables early detection of anomalies and rapid response, significantly improving the reliability and security of the system, reducing the burden on administrators and realizing more effective operation of IT infrastructure.

[1019] The processing flow will be explained below.

[1020] Step 1:

[1021] The server collects log data from the enterprise and network devices, and periodically transmits the necessary log information from each server and network device to the central server using a data collection tool.

[1022] Step 2:

[1023] The server performs initial processing of the collected data, cleansing and standardizing the format, and shaping it into a form suitable for training an anomaly detection model.

[1024] Step 3:

[1025] The server uses the initially processed data to train an anomaly detection model (Isolation Forest algorithm), learning normal behavior patterns and setting criteria for detecting anomalies.

[1026] Step 4:

[1027] The server stores the trained anomaly detection model and begins detecting anomalies in newly collected data in real time.

[1028] Step 5:

[1029] The server inputs newly collected data into the anomaly detection model in real time to evaluate whether an anomaly exists, and if one is detected, records its index.

[1030] Step 6:

[1031] When an abnormality is detected, the server uses an emotion engine to collect the user's emotional data, thereby understanding the user's emotional state.

[1032] Step 7:

[1033] The server can then change the notification method for anomalies based on the user's emotional data. For example, if the emotion engine detects that the user is feeling stressed, it can issue a notification with a detailed explanation and additional information.

[1034] Step 8:

[1035] The server will alert the administrator using a notification mechanism, which may include sending an email alert, displaying a warning on the dashboard, or triggering an automated response system.

[1036] Step 9:

[1037] Users receive notifications and access the dashboard to check detailed information about the anomaly. Users can understand the location and details of the anomaly and take appropriate measures promptly. They can also check the content of notifications based on the emotion engine and adjust their response.

[1038] Step 10:

[1039] After the user responds, the server reevaluates the system's operating status, checks whether the abnormality has been resolved, and continues monitoring to prevent the abnormality from recurring.

[1040] In this way, early detection and countermeasures for abnormalities become possible, improving the reliability and security of the system. In addition, the introduction of an emotion engine dynamically adjusts notification methods, reducing the burden on administrators.

[1041] Example 2

[1042] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1043] While conventional system monitoring systems can detect anomalies by collecting data on system operation status and performance, they face the problem of difficulty in implementing flexible notification methods that take into account the emotional state of the user. Additionally, while using emotional data is effective in improving the accuracy of anomaly detection models, there is a lack of means to achieve this.

[1044] The specific processing by the specific processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means.

[1045] In this invention, the server includes a data collection means, a means for training an anomaly detection model, a means for detecting an anomaly, a means for notifying the user of the detected anomaly, and a means for collecting user emotion data and dynamically adjusting the notification method, thereby enabling a flexible notification method that takes the user's emotional state into consideration and improving the accuracy of the anomaly detection model.

[1046] "Data collection means" is a general term for devices and software used to collect system operating status and performance data.

[1047] "Means for training an anomaly detection model" refers to the process or equipment used to train an anomaly detection algorithm using collected data to identify normal operating patterns.

[1048] "Means for detecting anomalies" refers to devices or software that use a trained anomaly detection model to analyze newly collected data and determine whether an anomaly has occurred.

[1049] "Means for notifying detected abnormalities" is a general term for devices and software that include notification methods such as email, alerts, and dashboard displays to convey information about abnormalities to administrators when they occur.

[1050] "Means for collecting user emotional data and dynamically adjusting notification methods" refers to devices or algorithms that analyze the user's emotional state and change the content and method of notifications based on the results.

[1051] The "Isolation Forest algorithm" is a machine learning algorithm for anomaly detection, and refers to a technology that learns normal patterns from large amounts of data and identifies anomalous data points.

[1052] "Means for collecting real-time data and inputting it into the anomaly detection model" refers to devices and software that collect data from the system in real time and immediately supply that data to the anomaly detection model for analysis.

[1053] This invention combines an AI-based system monitoring system with an emotion engine that recognizes user emotions. The system mainly consists of the following components, and we will explain in detail how each component works.

[1054] Data collection methods:

[1055] Servers use various sensors and log file analysis tools to collect system status and performance data. Specific hardware includes sensors for acquiring system logs and monitoring agents for collecting performance metrics. The collected data is sent to a central server for analysis.

[1056] To train an anomaly detection model:

[1057] The server uses the collected data to train an anomaly detection model. This process uses the Isolation Forest algorithm to learn normal behavior patterns. By training the anomaly detection model using past data, the normal behavior patterns of the system are established.

[1058] Means of detecting anomalies:

[1059] The server analyzes newly collected data in real time using the trained anomaly detection model to detect anomalies, and if an anomaly is detected, details about the anomaly are recorded and the system proceeds to the next step.

[1060] Notification of detected anomalies:

[1061] The server has the means to notify administrators of detected anomalies, including sending alert emails, displaying anomalies on a web dashboard, and running scripts to automatically fix the anomalies.

[1062] A means to collect user emotional data and dynamically adjust notification methods:

[1063] The server uses an emotion engine to collect user emotional data and dynamically adjust the notification method. It collects the user's keyboard typing speed, mouse movement speed, and vital data from the wearable device to analyze whether the user is feeling stressed or relaxed. Based on this information, the server can change the content and method of notifications to provide more appropriate notifications.

[1064] Specific examples

[1065] For example, consider a system that monitors a company's entire IT infrastructure operating as follows:

[1066] 1. A server collects log data from servers and network devices within a company and sends it to a central server. For example, it retrieves system logs and performance metrics every minute.

[1067] 2. The server trains the IsolationForest model based on past collected data to learn the normal operating patterns of the system.

[1068] 3. The server applies the trained model to newly collected data and detects anomalies in real time. For example, if a particular server experiences a sudden increase in CPU usage, it will detect this as an anomaly.

[1069] 4. If an anomaly is detected, the server uses an emotion engine to collect user emotion data and dynamically adjust the notification method. For example, if the server determines that the user is in a stressful state, it will send a notification with a detailed explanation and additional information.

[1070] 5. The server alerts the administrator using notification methods, which may include sending email alerts, displaying anomalies on a web dashboard, and, if necessary, running scripts to automatically fix the anomaly.

[1071] Prompt Sentence Examples

[1072] I would like to develop a system that monitors my company's entire IT infrastructure. I would like to know how to collect system logs and performance metrics, detect abnormalities, and notify administrators. I would also like to incorporate a mechanism that dynamically changes the notification method based on user sentiment. Please explain in detail the specific algorithms and technologies that will be used to achieve this.

[1073] The flow of the identification process in the second embodiment will be described with reference to FIG.

[1074] Step 1: Data collection

[1075] The server collects system operation status and performance data.

[1076] Input: Data from various sensors, log files, and tools that capture performance metrics.

[1077] Every minute the server parses the system log files to check for new entries.

[1078] The server runs SQL queries against the database and periodically collects performance metrics.

[1079] Output: The collected data is sent to a central server.

[1080] Step 2: Training the anomaly detection model

[1081] The server uses the collected data to train an anomaly detection model.

[1082] Input: Previously collected data.

[1083] The server trains the IsolationForest model using CPU usage data from the past six months.

[1084] The server stores the trained models in the / models / directory.

[1085] Output: An anomaly detection model that has learned normal behavior patterns.

[1086] Step 3: Real-time anomaly detection

[1087] The server analyzes newly collected data in real time using the trained anomaly detection model to detect anomalies.

[1088] Input: Log data and performance metrics collected in real time.

[1089] The server inputs system log data collected every minute into the model to detect anomalous patterns.

[1090] For example, if the CPU usage of a particular server suddenly rises above 90%, it will be recorded as an abnormality.

[1091] Output: Detailed information about the detected anomaly.

[1092] Step 4: Adjust emotion data collection and notification methods

[1093] The server uses an emotion engine to collect user emotion data and dynamically adjust the notification method.

[1094] Input: User keyboard typing speed, mouse movement speed, and vital data from wearable devices.

[1095] The server analyzes the user's emotional state based on this data.

[1096] For example, it may be determined that a user is under stress because the user is typing quickly.

[1097] Output: Adjustment of notification method based on the user's emotional state.

[1098] Step 5: Administrator Notification

[1099] The server notifies the administrator of any detected abnormalities.

[1100] Input: Detailed information about the anomaly detected in step 3, and the notification method adjusted in step 4.

[1101] The server sends an alert email to the administrator's email address.

[1102] The server displays alerts on a web dashboard and runs scripts to automatically fix anomalies.

[1103] Output: Notify administrator and fix anomaly.

[1104] Step 6: User response and dashboard check

[1105] The user receives a notification and visits the dashboard to view detailed information about the anomaly.

[1106] Input: The notification sent by the server.

[1107] The user clicks on the link in the notification to access the web dashboard.

[1108] The user sees detailed information on the dashboard such as "CPU usage on Server X has spiked."

[1109] Output: User understands abnormal conditions and takes measures.

[1110] Step 7: Reassess your system and continue monitoring

[1111] After the user responds, the server reevaluates the system's operating status and checks whether the abnormality has been resolved.

[1112] Input: Latest system data after the user has responded to the abnormality.

[1113] The server re-enters the latest CPU usage data and other data into the model to check whether the abnormality has recurred.

[1114] The server continuously monitors performance metrics across the system and immediately notifies you of any new anomalies.

[1115] Output: Confirmation that the abnormality has been resolved and continuous system monitoring.

[1116] (Application example 2)

[1117] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1118] In autonomous vehicles, it is important to detect system anomalies early and take prompt and appropriate action. However, conventional systems only issue uniform notifications when an anomaly is detected, making it difficult to flexibly adjust response methods taking into account the emotional state of the driver or engineer. Furthermore, emotional data is not utilized to improve the accuracy of anomaly detection. This can lead to delayed or incorrect responses to anomalies.

[1119] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, an emotion engine for recognizing the user's emotions, a means for notifying the user of the detected anomaly, and a means for dynamically adjusting the content of the notification based on the emotion data. This enables early detection of system anomalies in an autonomous vehicle and flexible responses according to the emotional states of the driver and technicians. Furthermore, utilizing emotion data improves the accuracy of anomaly detection, enabling more appropriate responses.

[1120] "Data collection means" refers to devices and methods for collecting system data, sensor data, etc. of autonomous vehicles.

[1121] A "means for training an anomaly detection model" is a machine learning algorithm or method that uses collected data to learn normal and abnormal behavior.

[1122] A "means for detecting anomalies" is a method or device that uses a trained anomaly detection model to analyze new data collected in real time and determine whether or not an anomaly exists.

[1123] The "emotion engine that recognizes user emotions" is software and hardware that uses biosensors and cameras to recognize and analyze the emotional state of drivers and technicians.

[1124] "Means for notifying detected abnormalities" refers to a system or method for conveying information about an abnormality to a manager or driver when it is detected.

[1125] The "means for dynamically adjusting notification content based on emotional data" refers to a method or system for flexibly changing notification content in the event of an abnormality based on the emotional state of the user.

[1126] The "Isolation Forest algorithm" is a machine learning algorithm used for anomaly detection, and is a method for detecting anomalies by measuring the degree of isolation of data.

[1127] "Real-time data" refers to the latest data that is currently being measured and collected by autonomous vehicles.

[1128] This invention is a system for detecting system anomalies early in an autonomous vehicle and notifying drivers and engineers according to their emotional states. The system includes a data collection means, a means for training an anomaly detection model, a means for detecting anomalies, an emotion engine for recognizing user emotions, a means for notifying drivers of detected anomalies, and a means for dynamically adjusting the content of the notification based on the emotion data.

[1129] The server first collects system and sensor data from the autonomous vehicle. The collected data is stored in a database and used to train an anomaly detection model. The Isolation Forest algorithm is applied as this anomaly detection model. This algorithm is used to learn normal operating patterns and identify anomalous data points.

[1130] The server then uses the trained anomaly detection model to analyze newly collected data in real time and determine whether anomalies exist. If an anomaly is detected, the server uses an emotion engine to collect and analyze the user's emotional state in real time. This emotion engine identifies the user's emotional state based on facial recognition sensors and biometric data (heart rate, galvanic skin response, etc.).

[1131] The content of notifications in the event of an abnormality is dynamically adjusted based on the emotional data collected by the emotion engine. If the user is feeling stressed, the server will send a notification with a detailed explanation and additional information, encouraging them to stay calm. If the user's emotional state is normal, a simple notification will be sent. In this way, the server helps users take appropriate action quickly in the event of an abnormality.

[1132] Consider the following scenario: If an engine abnormality is detected while an autonomous vehicle is driving, the server analyzes engine status data in real time. At the same time, the emotion engine monitors the driver's heart rate and facial expressions to determine whether the driver is experiencing stress. If the driver is experiencing stress, a notification containing detailed information about the abnormality and how to deal with it is sent to the driver's smartphone.

[1133] Additionally, generative AI models can be used to set prompts that help obtain additional information. For example, the following prompts can be used:

[1134] Example prompt sentence:

[1135] Please generate a detailed functional description of a monitoring application for an autonomous vehicle. This app collects vehicle system data and detects anomalies. In addition, it monitors the driver's emotions in real time and dynamically adjusts notification content based on the driver's emotions when an anomaly is detected. Please provide a detailed description, including the following points:

[1136] Emotion data is collected using facial recognition sensors and biometric information

[1137] Isolation Forest is used as an anomaly detection model.

[1138] Notification method and content for abnormal events change based on emotions

[1139] This allows for refinement of detailed specifications and functional descriptions of the application.

[1140] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[1141] Step 1:

[1142] Data collection:

[1143] The server collects system data (e.g., engine status, GPS data, sensor information, etc.) from the autonomous vehicle. The input is data from various sensors on the vehicle, and the output is the collected dataset. This dataset is used to train the anomaly detection model.

[1144] Step 2:

[1145] Training an anomaly detection model:

[1146] The server trains an anomaly detection model (Isolation Forest algorithm) using the dataset collected in step 1. The input is the collected system dataset, and the output is the trained anomaly detection model. The server uses this model to learn normal behavior patterns and set criteria for detecting anomalies.

[1147] Step 3:

[1148] Real-time data analysis:

[1149] The server applies an anomaly detection model to newly collected data in real time. The input is the system data collected in real time, and the output is the presence or absence of detected anomalies. Based on this analysis, the server determines whether an anomaly has occurred.

[1150] Step 4:

[1151] Emotion data collection:

[1152] The server collects the emotional state of the user (driver or technician) in real time. The input is data from a facial recognition sensor and biometric data (heart rate, skin galvanic response, etc.), and the output is the emotional state analysis result by the emotion engine. The server then determines whether the user is feeling stressed.

[1153] Step 5:

[1154] Notification in case of an abnormality:

[1155] The server adjusts the notification content based on the emotional data from step 4 and sends the anomaly detected in step 3. The input is the anomaly detection result and the analysis result of the emotional state, and the output is the adjusted notification content. Based on the emotional state, the server sends a notification including a detailed explanation or additional information to a smartphone or other device as needed.

[1156] Step 6:

[1157] Receiving and Responding to Notifications:

[1158] The user receives the notification sent from the server and checks the content. The input is the notification from the server, and the output is the user's response action. Based on this notification, the user can quickly take appropriate measures to deal with the system abnormality.

[1159] Step 7:

[1160] Reassess your system health:

[1161] The server reevaluates the system's operating status after the user responds. The input is the re-collected system data, and the output is the result of determining whether the abnormality has been resolved. The server checks whether the abnormality has been resolved and performs continuous monitoring.

[1162] Step 8:

[1163] Leveraging generative AI models:

[1164] The server uses a generative AI model to perform further analysis and improve the notification content. The input is the anomaly detection result and emotion data, and the output is optimized notification content and additional countermeasure suggestions. The following prompt sentence is used to instruct the AI ​​model to generate a detailed explanation.

[1165] Please generate a detailed functional description of a monitoring application for an autonomous vehicle. This app collects vehicle system data and detects anomalies. In addition, it monitors the driver's emotions in real time and dynamically adjusts notification content based on the driver's emotions when an anomaly is detected. Please provide a detailed description, including the following points:

[1166] Emotion data is collected using facial recognition sensors and biometric information

[1167] Isolation Forest is used as an anomaly detection model.

[1168] Notification method and content for abnormal events change based on emotions

[1169] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[1170] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1171] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the robot 414.

[1172] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[1173] FIG. 9 is a diagram illustrating an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and actions arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion includes both affect and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[1174] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[1175] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[1176] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. Emotions can also be created for robots, automobiles, and motorcycles, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on Voice Emotion Recognition and Emotional Brain Physiological Signal Analysis Systems, Tokushima University, Doctoral Dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the "reaction" domain, where sensation is dominant. The right half of the emotion map lists emotions belonging to the "situation" domain, where situational awareness is dominant.

[1177] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[1178] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[1179] The system according to the present disclosure has been described above mainly with respect to the functions of the data processing device 12, but the system according to the present disclosure is not necessarily implemented on a server. The system according to the present disclosure may be implemented as a general information processing system. The present disclosure may be implemented, for example, as a software program running on a personal computer or an application running on a smartphone, etc. The method according to the present disclosure may be provided to users in the form of SaaS (Software as a Service).

[1180] In the above embodiment, an example was given in which the specific processing is performed by one computer 22, but the technology of the present disclosure is not limited to this, and the specific processing may be distributed and performed by a plurality of computers including the computer 22. For example, the data generation model 58 may be provided in an external device of the data processing device 12, and data may be generated in the external device in accordance with input data.

[1181] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[1182] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[1183] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[1184] The hardware resource for executing a specific process can be any of the following processors: An example of a processor is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. Another example of a processor is a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[1185] The hardware resource that executes the specific processing may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific processing may be a single processor.

[1186] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[1187] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[1188] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[1189] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[1190] The following is further disclosed regarding the above embodiment.

[1191] (Claim 1)

[1192] data collection means;

[1193] a means for training an anomaly detection model;

[1194] means for detecting anomalies;

[1195] means for notifying the detected anomaly;

[1196] A system including:

[1197] (Claim 2)

[1198] 10. The system of claim 1, further comprising: means for using an Isolation Forest algorithm as the anomaly detection model.

[1199] (Claim 3)

[1200] 10. The system of claim 1, further comprising means for collecting real-time data and inputting it into the anomaly detection model.

[1201] "Example 1"

[1202] (Claim 1)

[1203] means for collecting data using a log collection device;

[1204] means for training an anomaly detection model using the collected data;

[1205] means for detecting anomalies in real time using the trained anomaly detection model;

[1206] a means for notifying an administrator of detected anomalies;

[1207] A system including:

[1208] (Claim 2)

[1209] 10. The system of claim 1, further comprising means for training the anomaly detection model using an Isolation Forest algorithm.

[1210] (Claim 3)

[1211] 10. The system of claim 1, further comprising means for inputting newly collected data into the anomaly detection model in real time.

[1212] "Application Example 1"

[1213] (Claim 1)

[1214] data collection means;

[1215] a means for training an anomaly detection model;

[1216] means for detecting anomalies;

[1217] means for notifying the detected anomaly;

[1218] A means for sending push notifications to the administrator using a smartphone;

[1219] A means to analyze data in real time and display it on a dashboard,

[1220] A system including:

[1221] (Claim 2)

[1222] 10. The system of claim 1, further comprising: means for using an Isolation Forest algorithm as the anomaly detection model.

[1223] (Claim 3)

[1224] 10. The system of claim 1, further comprising means for collecting real-time data and inputting it into the anomaly detection model.

[1225] "Example 2: Combining Emotion Engines"

[1226] (Claim 1)

[1227] data collection means;

[1228] a means for training an anomaly detection model;

[1229] means for detecting anomalies;

[1230] means for notifying the detected anomaly;

[1231] A means for collecting user emotion data and dynamically adjusting notification methods;

[1232] A system including:

[1233] (Claim 2)

[1234] 10. The system of claim 1, further comprising: means for using an Isolation Forest algorithm as the anomaly detection model.

[1235] (Claim 3)

[1236] 10. The system of claim 1, further comprising means for collecting real-time data and inputting it into the anomaly detection model.

[1237] "Application example 2 when combining emotion engines"

[1238] (Claim 1)

[1239] data collection means;

[1240] a means for training an anomaly detection model;

[1241] means for detecting anomalies;

[1242] an emotion engine that recognizes the user's emotions;

[1243] means for notifying the detected anomaly;

[1244] means for dynamically adjusting notification content based on emotion data;

[1245] A system including:

[1246] (Claim 2)

[1247] 10. The system of claim 1, further comprising: means for using an Isolation Forest algorithm as the anomaly detection model.

[1248] (Claim 3)

[1249] 10. The system of claim 1, further comprising means for collecting real-time data and inputting it into the anomaly detection model. [Explanation of symbols]

[1250] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot< / url:> < / url:> < / url:> < / url:>

Claims

1. data collection means; a means for training an anomaly detection model; means for detecting anomalies; means for notifying the detected anomaly; A system including:

2. The system of claim 1 , further comprising means for using an Isolation Forest algorithm as the anomaly detection model.

3. The system of claim 1 , further comprising means for collecting real-time data and inputting it into the anomaly detection model.

Images