System

Abstract

To provide a new method for detecting an image-based phishing site with high accuracy.SOLUTION: A system for determining whether a website is a phishing site includes means for acquiring image data, means for processing the acquired image data and converting the image data into text data using a generative model, means for extracting phishing site-specific keywords from the generated text data and determining whether the website is a phishing site based thereon, and means for outputting a determination result.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] In recent years, the number of phishing sites has rapidly increased, causing significant damage to consumers and businesses. Phishing sites consisting only of images are particularly difficult to detect using conventional string analysis-based detection systems, creating a need for methods to quickly detect and prevent these types of sites. Furthermore, existing detection systems have limited accuracy and often produce false positives. Therefore, a new method for detecting image-based phishing sites with high accuracy is needed. [Means for solving the problem]

[0005] To address this issue, we provide a system that includes a means for acquiring image data, a means for converting the image data into text data, a means for determining whether a website is a phishing site based on the text data, and a means for outputting the determination result. Specifically, the acquired image data is processed and text data is generated from the image using a generative model. Keywords specific to phishing sites are extracted from the generated text data, and based on this, a determination is made as to whether the website is a phishing site, resulting in a system that detects phishing sites with high accuracy. This system can accurately and efficiently detect phishing sites that are composed only of images.

[0006] "Means for obtaining image data" refers to the process or function for downloading image files from a website.

[0007] A "means for converting image data to text data" is a process, algorithm, or device for extracting textual information from an image and outputting it in text format.

[0008] "Means for determining whether a website is a phishing site based on text data" refers to a process or function that analyzes the generated text data and determines whether the website is a phishing site based on specific keywords or patterns.

[0009] The "means for outputting the judgment result" is a function for notifying the user of the judgment result of whether or not the site is a phishing site, and the notification method may be a screen display, an audio output, or transmission in other data formats.

[0010] "Means for extracting specific keywords and using them to identify phishing sites" refers to a process or function that selects keywords related to phishing activities from text data and uses those keywords to make a judgment.

[0011] "Means using generative models" refers to algorithms or systems that use machine learning or artificial intelligence techniques to generate text data from image data. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 11] FIG. 3 is a sequence diagram showing a processing flow of the data processing system according to the first embodiment. [Figure 12] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 1. [Figure 13] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system according to the second embodiment when an emotion engine is combined. [Figure 14]FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 2 when an emotion engine is combined. DETAILED DESCRIPTION OF THE INVENTION

[0013] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0014] First, the terms used in the following description will be explained.

[0015] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, a processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), and an APU (Accelerated Processing Unit).

[0016] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0017] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0018] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), Bluetooth (registered trademark), etc.

[0019] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0020] [First embodiment]

[0021] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0022] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0023] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0024] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0025] The reception device 38 includes a touch panel 38A, a microphone 38B, and the like, and receives user input. The touch panel 38A detects contact with an indicator (for example, a pen or a finger) to receive user input by the touch of the indicator. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0026] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form of expression that the user 20 can perceive (for example, audio and / or text). The display 40A displays visible information such as text and images in accordance with instructions from the processor 46. The speaker 40B outputs audio in accordance with instructions from the processor 46. The camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0027] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0028] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0029] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0030] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0031] In the smart device 14, the processor 46 performs the reception output process. The storage 50 stores a reception output program 60. The reception output program 60 is used in conjunction with the specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0032] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0033] The present invention relates to a system for detecting phishing sites that are composed only of images with high accuracy. Specific embodiments of the system will be described below.

[0034] Overall system configuration

[0035] This system consists of three main components: a server, a terminal, and a user. The server receives the website URL sent by the user, acquires image data, converts it to text data, and identifies phishing sites. The terminal provides an interface that receives input from the user and sends it to the server. The user checks for suspicious websites through this terminal.

[0036] Server Processing

[0037] The server performs the following process:

[0038] 1. Image Data Acquisition:

[0039] The server receives the website URL sent from the device, accesses this URL, and downloads the image on the web page. The image is retrieved using an HTTP request.

[0040] 2. Convert image data to text data:

[0041] The server converts the captured image into text data by inputting it into an image2text model (e.g., a specialized AI algorithm). This process extracts the textual information in the image and outputs it as formatted text.

[0042] 3. Phishing site identification:

[0043] The generated text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and based on these keywords, it determines whether the website is a phishing site.

[0044] 4. Output of judgment result:

[0045] The results are formatted as JSON data and sent back to the device. This includes a process to display the results in a format that is easy for the user to understand.

[0046] Terminal handling

[0047] The terminal performs the following process:

[0048] 1. URL input acceptance:

[0049] The terminal provides an interface for accepting the URL of a website entered by the user, which may be a web browser, a dedicated application, or a GUI.

[0050] 2. Send URL:

[0051] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[0052] 3. Receiving and displaying results:

[0053] The terminal receives the judgment results from the server and displays them to the user in a variety of formats, including warning messages, alerts, and detailed analysis results.

[0054] User operations

[0055] The user performs the following operations:

[0056] 1. Enter the URL:

[0057] The user enters the URL of the suspicious website using the interface provided by the terminal.

[0058] 2. Check the results:

[0059] Users can check the results displayed on their device and take appropriate action if necessary regarding suspected phishing websites, such as avoiding the site or reporting it to their security department.

[0060] Specific examples

[0061] For example, if a user wants to check the security of a bank's login page, the process would be as follows:

[0062] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[0063] 2. The terminal generates and sends a request to the server for the entered URL.

[0064] 3. The server receives the URL, visits the page and downloads the image.

[0065] 4. The server converts the downloaded image into an image2text model and generates text data (e.g., "Please log in").

[0066] 5. The server analyzes the generated text to see if it contains keywords associated with phishing sites.

[0067] 6. The server determines that the site is likely to be a phishing site and returns the result to the device.

[0068] 7. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[0069] This allows users to instantly confirm the safety of suspicious websites.Compared to conventional text-based phishing site detection methods, this invention makes it possible to detect phishing sites that consist only of images with high accuracy.

[0070] The processing flow will be explained below.

[0071] Step 1:

[0072] The user enters the URL of a suspicious website into the terminal and presses the check button.

[0073] Step 2:

[0074] The terminal generates an HTTP request to send the input URL.

[0075] Step 3:

[0076] The terminal sends the generated HTTP request to the server.

[0077] Step 4:

[0078] The server receives the URL sent from the terminal.

[0079] Step 5:

[0080] The server accesses the received URL and downloads the image data from the page, using an HTTP request.

[0081] Step 6:

[0082] The server stores the downloaded image data in its memory.

[0083] Step 7:

[0084] The server initializes the image2text model to convert image data to text data, using a generative model to extract text information from the image.

[0085] Step 8:

[0086] The server analyzes the generated text data and checks whether it contains certain keywords associated with phishing sites (e.g., "login," "password," "verification").

[0087] Step 9:

[0088] The server determines whether the site is a phishing site based on whether it contains the keywords.

[0089] Step 10:

[0090] The server formats the results into JSON format data.

[0091] Step 11:

[0092] The server returns the generated JSON formatted data to the terminal.

[0093] Step 12:

[0094] The terminal analyzes the JSON formatted judgment result received from the server.

[0095] Step 13:

[0096] Based on the analysis results, the device displays a judgment result to the user, such as "This site may be a phishing site" or "This site is safe."

[0097] This allows users to quickly verify the safety of suspicious sites.

[0098] Example 1

[0099] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0100] In recent years, fraudulent activities via phishing sites have been increasing on the Internet. In particular, phishing sites that consist only of images are difficult to detect using conventional text-based detection algorithms. Therefore, there is a need for a highly accurate method for detecting phishing sites using image data.

[0101] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0102] In this invention, the server includes means for receiving a website URL and acquiring the webpage content, means for downloading image data from the acquired webpage, means for converting the downloaded image data into text data using a generative model, means for analyzing specific keywords based on the text data and determining whether the website is a phishing site, and means for formatting and outputting the determination result in JSON format, thereby enabling rapid detection of phishing sites consisting only of images with high accuracy.

[0103] A "website URL" is a string of characters that identifies and accesses a particular web page that a user wants to access.

[0104] "Web page content" means all data, including HTML, images, style sheets, scripts, etc., of a website retrieved by a specified URL.

[0105] "Image data" refers to data files that represent visual information contained in web page content and are saved in formats such as JPEG and PNG.

[0106] A "generative model" is an artificial intelligence algorithm that generates a specific output based on input data, in this case generating text data from image data.

[0107] "Text data" is data that represents character information extracted from image data by a generative model.

[0108] "Specific keywords" are predefined significant words or phrases used to identify phishing sites.

[0109] "Analysis" is the process of examining data in detail and extracting specific information or patterns.

[0110] "Decision" is the act of determining whether a certain condition is met based on the results of data analysis.

[0111] "JSON format" stands for JavaScript Object Notation, a lightweight format for organizing data and easily exchanging it.

[0112] "Output" refers to the act of providing the results of processing by a system to a user or another system.

[0113] MODE FOR CARRYING OUT THE INVENTION

[0114] The present invention relates to a system for detecting phishing sites that are composed only of image data with high accuracy. A specific embodiment of this system will be described below.

[0115] Overall system configuration

[0116] This system consists of three main components: a server, a terminal, and a user. The server receives the website URL sent by the user, acquires image data, converts it to text data, and identifies phishing sites. The terminal provides an interface that receives input from the user and sends it to the server. The user checks for suspicious websites through this terminal.

[0117] Server Processing

[0118] The server uses the following main software and libraries: the requests library for HTTP requests, BeautifulSoup for HTML parsing, and generative models (e.g., Tesseract OCR) for processing image data.

[0119] The server receives the URL sent by the user from the device and accesses the specified web page. It downloads image data from the retrieved web page and converts the image data into text data using a generative model. It then analyzes specific keywords based on the text data to determine whether it is a phishing site. It then formats the result of this determination into JSON format and sends it to the device.

[0120] Terminal handling

[0121] The terminal provides an interface for accepting website URLs entered by the user. This interface may consist of a web browser, a dedicated application, or a GUI. When the user enters a URL and presses the send button, the terminal generates and sends an HTTP request to send the URL to the server. The terminal receives the judgment results returned from the server and displays them on the screen in a format that is easy for the user to understand.

[0122] User operations

[0123] The user enters the URL of a suspicious website using the device interface, and when the results are displayed on the device, the user can review the results and take necessary action, such as avoiding the site if it is likely a phishing site or reporting it to the security department.

[0124] Specific examples

[0125] Specific examples are shown below.

[0126] If a user wants to check the security of their bank's login page, the following steps will be taken:

[0127] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[0128] 2. The terminal generates and sends a request to the server for the entered URL.

[0129] 3. The server receives the URL, visits the page and downloads the image.

[0130] 4. The server inputs the downloaded images into a generative model to generate text data.

[0131] 5. The server analyzes the generated text data to see if it contains specific keywords associated with phishing sites.

[0132] 6. The server determines that the site is likely to be a phishing site and returns the result to the device.

[0133] 7. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[0134] Examples of prompts are:

[0135] Enter your website URL (e.g. https: / / example-bank.com / login):

[0136] Using this prompt sentence makes it easier for the user to input, and it is expected that the system will operate efficiently.

[0137] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0138] Step 1:

[0139] Receiving URLs

[0140] The server receives the HTTP request sent from the device. This request includes the URL of the website entered by the user. The server saves the received URL in a variable.

[0141] Input: The website URL entered by the user

[0142] Output: Saved URL

[0143] Specific behavior:

[0144] The server listens for HTTP requests, extracts the URL from the request body, and saves it.

[0145] Step 2:

[0146] Web page access

[0147] The server sends an HTTP GET request to the stored URL to retrieve the web page content, including the web page's HTML, images, stylesheets, scripts, etc.

[0148] Input: Saved URL

[0149] Output: Retrieved web page content (HTML, etc.)

[0150] Specific behavior:

[0151] Use the requests library to send a GET request to the specified URL.

[0152] Get the web page content from the response and save it in a variable.

[0153] Step 3:

[0154] Image data acquisition

[0155] The server analyzes the HTML of the retrieved web page and extracts the image data. Find the tag, get the image URL from its src attribute, and download the image data.

[0156] Input: HTML content of a web page

[0157] Output: Downloaded image data

[0158] Specific behavior:

[0159] Use BeautifulSoup to parse the HTML of a web page, Find the tag.

[0160] A GET request is sent to each image URL, and the image data is downloaded and saved.

[0161] Step 4:

[0162] Image data conversion

[0163] The server inputs the downloaded image data into a generative AI model (e.g., Tesseract OCR) to extract text data from the image.

[0164] Input: Downloaded image data

[0165] Output: Generated text data

[0166] Specific behavior:

[0167] Load the image data into a generative AI model (such as Tesseract OCR).

[0168] The model extracts text information from the image and saves it as text data.

[0169] Step 5:

[0170] Keyword Analysis

[0171] The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login", "password", "verification").

[0172] Input: Generated text data

[0173] Output: Keyword analysis results (phishing detection)

[0174] Specific behavior:

[0175] Based on a predefined keyword list, the frequency of keyword occurrence within text data is checked.

[0176] Calculate the keyword match rate and determine whether it exceeds a threshold.

[0177] Step 6:

[0178] Formatting and sending results

[0179] The server formats the results of the keyword analysis into JSON format and sends it to the terminal as an HTTP response.

[0180] Input: Keyword analysis results

[0181] Output: JSON format result

[0182] Specific behavior:

[0183] The result of the judgment is converted into a JSON object and sent to the terminal as an HTTP response.

[0184] Step 7:

[0185] URL input acceptance

[0186] The terminal provides an interface that accepts the URL of a website entered by the user. This interface may consist of a web browser, a dedicated application, a GUI, or the like.

[0187] Input: The URL entered by the user

[0188] Output: URL input from user

[0189] Specific behavior:

[0190] It displays an input field in an HTML form or dedicated application, allowing the user to enter a URL.

[0191] Step 8:

[0192] Send URL

[0193] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[0194] Input: The URL entered by the user

[0195] Output: HTTP request to the server

[0196] Specific behavior:

[0197] It takes data from form inputs and generates an HTTP POST request to send to the server.

[0198] Step 9:

[0199] Receive results

[0200] The terminal receives the determination result from the server.

[0201] Input: HTTP response from the server

[0202] Output: Received judgment result (JSON)

[0203] Specific behavior:

[0204] Receives an HTTP response and extracts JSON data from the response body.

[0205] Step 10:

[0206] Results display

[0207] The terminal displays the received judgment results to the user in the form of warning messages, alerts, detailed analysis results, etc.

[0208] Input: Received judgment result (JSON)

[0209] Output: Displaying the results to the user

[0210] Specific behavior:

[0211] Analyze the JSON data and display a message based on the results on the screen.

[0212] Step 11:

[0213] URL input

[0214] The user enters the URL of a suspicious website using the interface provided by the device.

[0215] Input: The URL entered by the user

[0216] Output: URL input to terminal

[0217] Specific behavior:

[0218] Enter the target URL into the URL input field on your browser or application and press the send button.

[0219] Step 12:

[0220] Check the results

[0221] The user checks the results displayed on the terminal and takes the necessary action.

[0222] Input: Judgment result displayed on the device

[0223] Output: User action (e.g. avoid site, report)

[0224] Specific behavior:

[0225] View the phishing detection results displayed on your device and take appropriate action based on the results.

[0226] (Application example 1)

[0227] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0228] Phishing sites that consist only of images are difficult to detect using conventional text-based phishing site detection methods, and users remain vulnerable to these phishing sites. Therefore, there is a need for a system that can analyze image data to detect phishing sites with high accuracy. There is also a need for a system that allows users to receive phishing site warnings in real time.

[0229] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0230] In this invention, the server includes means for acquiring image data, means for converting the image data into text data, means for determining whether a website is a phishing site based on the text data, and means for notifying the terminal of the determination result in real time, thereby enabling phishing sites consisting only of images to be detected with high accuracy and enabling users to receive warnings about phishing sites in real time.

[0231] "Image data" is data in digital format that contains visual information displayed on a web page.

[0232] "Text data" is data in a digital format that contains textual information extracted from image data.

[0233] A "phishing site" is a fake website created with the purpose of fraudulently obtaining users' personal information and authentication information.

[0234] A "terminal" is a device used by a user, such as a smartphone or computer, through which a website is accessed.

[0235] "Real-time notification" is a function that instantly reports the results of a phishing site detection to the user.

[0236] A "generative model" is a system that uses machine learning and artificial intelligence algorithms to analyze image data and generate text data.

[0237] "Keywords" are specific words or phrases used to identify phishing sites.

[0238] The "judgment result" is the analysis result of whether the website is a phishing site.

[0239] The present invention relates to a system for detecting phishing sites that are composed only of images with high accuracy. Specific embodiments of the system will be described below.

[0240] Overall system configuration

[0241] This system consists of three main components: a server, a terminal, and a user. The server receives the website URL sent by the user, acquires image data, converts it to text data, and identifies phishing sites. The terminal provides an interface that receives input from the user and sends it to the server. The user checks for suspicious websites through this terminal.

[0242] Server Processing

[0243] Obtaining image data: The server receives the website URL sent from the device. It accesses this URL and downloads the image on the web page. In this process, it obtains the image data using an HTTP request.

[0244] Converting image data to text data: The server inputs the acquired image data into a generative AI model (e.g., a machine learning algorithm) to convert the image into text data. This process extracts textual information from the image and outputs it as formatted text. Specifically, PIL (Python Imaging Library) and Pytesseract are used.

[0245] Phishing site identification: The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login", "password", "verification", "login"). Based on these keywords, it determines whether the website is a phishing site.

[0246] Notification of judgment results: The server formats the judgment results as JSON data and sends them to the terminal in real time. This includes a process to display the results in a format that is easy for the user to understand.

[0247] Terminal handling

[0248] URL input acceptance: The terminal provides an interface for accepting website URLs entered by the user. This interface can be a web browser, a dedicated application, or a GUI.

[0249] Sending URL: The terminal generates and sends an HTTP request to send the entered URL to the server.

[0250] Receiving and displaying results: The terminal receives the judgment results from the server and displays them to the user in real time. The display format can vary, including warning messages, alerts, and detailed analysis results.

[0251] User operations

[0252] Entering a URL: The user enters the URL of a suspicious website using the interface provided by the device.

[0253] Review the results: Users review the results displayed on their device and take appropriate action regarding suspected phishing websites, if necessary, such as avoiding the site or reporting it to their security department.

[0254] Specific examples

[0255] For example, if a user wants to check the security of a bank's login page, the process would be as follows:

[0256] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[0257] 2. The device generates and sends a request to send the URL to the server.

[0258] 3. The server receives the URL, visits the page, and downloads the image.

[0259] 4. The server inputs the downloaded image into a generative AI model (e.g., Pytesseract) to generate text data (e.g., "Please log in").

[0260] 5. The server analyzes the generated text to see if it contains keywords related to phishing sites.

[0261] 6. The server determines that the site is likely to be a phishing site and notifies the device of the result in real time.

[0262] 7. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[0263] Prompt Sentence Examples

[0264] Check out http: / / example.com / suspicious_site.

[0265] This allows users to instantly confirm the safety of suspicious websites.Compared to conventional text-based phishing site detection methods, this invention makes it possible to detect phishing sites that consist only of images with high accuracy.

[0266] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0267] Step 1:

[0268] URL input reception (terminal)

[0269] The user inputs the URL of a website into the terminal interface, which can be a web browser, a dedicated application, or a GUI. When the user inputs the URL and presses the check button, the terminal receives this information and obtains the input data (URL) to proceed to the next processing step.

[0270] Step 2:

[0271] Send URL (device)

[0272] The device receives the URL entered by the user and sends it to the server as an HTTP request. This request includes the URL to be verified and serves as input data for the server to retrieve web page information. After sending the request, the device waits for a response from the server.

[0273] Step 3:

[0274] Acquisition of image data (server)

[0275] The server accesses the web page based on the URL received from the terminal. It uses an HTTP request to download the image data of the web page and obtains the image data. The obtained image data is the input data to be converted to text data in the next step.

[0276] Step 4:

[0277] Convert image data to text data (server)

[0278] The server inputs the acquired image data into a generative AI model (e.g., Pytesseract), extracts text information from the image, and generates text data. This process formats the image data as text data, which becomes input data for phishing site detection in the next step.

[0279] Step 5:

[0280] Phishing site detection (server)

[0281] The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login," "password," "verification," "login"). Based on these keywords, it determines whether the website is a phishing site. The determination result (whether it is likely to be a phishing site or not) is output data that is notified to the terminal in the next step.

[0282] Step 6:

[0283] Notification of judgment results (server)

[0284] The server formats the phishing site detection results as JSON data and sends them to the device in real time. This notification contains information about the possibility that the website is a phishing site. The notified detection results become input data for display on the device.

[0285] Step 7:

[0286] Receiving and displaying results (terminal)

[0287] The device analyzes the phishing site detection results received from the server and displays them to the user in real time. Specifically, the results are displayed as warning messages, alerts, or detailed analysis results. This display allows the user to confirm the safety of the website and take appropriate action if necessary.

[0288] Furthermore, an emotion engine that estimates the user's emotion may be combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0289] The present invention is a system that converts image data into text data to detect phishing sites, and combines it with an emotion engine that recognizes user emotions. Specific embodiments of this system are described below.

[0290] Overall system configuration

[0291] This system consists of three main components: a server, a terminal, and a user. The server receives website URLs sent by users, acquires image data, converts it to text data, determines whether the website is a phishing site, and displays the results based on the user's sentiment. The terminal provides an interface that receives input from users and sends it to the server. Users check suspicious websites through this terminal.

[0292] Server Processing

[0293] The server performs the following process:

[0294] 1. Image Data Acquisition:

[0295] The server receives the website URL sent from the device, accesses this URL, and downloads the image data on the web page. The image is retrieved using an HTTP request.

[0296] 2. Convert image data to text data:

[0297] The server inputs the acquired image data into the image2text model to convert the image into text data. This process extracts the textual information in the image and outputs it as formatted text.

[0298] 3. Phishing site identification:

[0299] The generated text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and based on these keywords, it determines whether the website is a phishing site.

[0300] 4. Recognizing user emotions with the emotion engine:

[0301] The server uses an emotion engine that recognizes the user's emotions and collects emotional information from the user's facial expressions and voice. The server analyzes this emotional information and adjusts the display method to make the site information more easily accepted by the user.

[0302] 5. Output of judgment result:

[0303] The judgment results are formatted as JSON data and returned to the device, including warning messages and display methods adjusted based on the user's emotions.

[0304] Terminal handling

[0305] The terminal performs the following process:

[0306] 1. URL input acceptance:

[0307] The terminal provides an interface for accepting the URL of a website entered by the user, which may be a web browser, a dedicated application, or a GUI.

[0308] 2. Send URL:

[0309] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[0310] 3. Collecting Emotional Data:

[0311] The device uses the user's camera and microphone to capture the user's facial expressions and voice, and sends this data to the server.

[0312] 4. Receiving and displaying results:

[0313] The device analyzes the JSON formatted judgment result received from the server and displays the judgment result to the user based on the adjusted warning message and display method.

[0314] User operations

[0315] The user performs the following operations:

[0316] 1. Enter the URL:

[0317] The user enters the URL of the suspicious website using the interface provided by the terminal.

[0318] 2. Providing Emotion Data:

[0319] Users provide emotional data using their device's camera and microphone, and this operation is usually done automatically.

[0320] 3. Check the results:

[0321] Users can check the results and warning messages displayed on their devices and take appropriate action if necessary regarding suspected phishing websites, such as avoiding the site or reporting it to the security department.

[0322] Specific examples

[0323] For example, if a user wants to check the security of a bank's login page, the process would be as follows:

[0324] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[0325] 2. The terminal generates and sends a request to the server for the entered URL.

[0326] 3. The device uses a camera and microphone to collect the user's facial expressions and voice data and send it to the server.

[0327] 4. The server receives the URL, visits the page and downloads the image.

[0328] 5. The server converts the downloaded image into an image2text model and generates text data (e.g., "Please log in").

[0329] 6. The server analyzes the generated text to see if it contains keywords associated with phishing sites.

[0330] 7. The server uses an emotion engine to recognize the user's emotions and determines the warning message and display method according to the user's state.

[0331] 8. The server returns JSON format data containing the judgment result and the adjusted display method to the terminal.

[0332] 9. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[0333] This allows users to confirm the safety of the site and receive the results in an interface that suits their emotional state.The present invention not only improves the accuracy of phishing site detection, but also improves the user experience.

[0334] The processing flow will be explained below.

[0335] Step 1:

[0336] The user enters the URL of a suspicious website into the terminal and presses the check button.

[0337] Step 2:

[0338] The terminal generates an HTTP request to send the input URL.

[0339] Step 3:

[0340] The terminal sends the generated HTTP request to the server.

[0341] Step 4:

[0342] The device uses the user's camera and microphone to collect facial and voice data.

[0343] Step 5:

[0344] The device sends the collected facial expression and voice data to a server.

[0345] Step 6:

[0346] The server receives the URL sent from the terminal.

[0347] Step 7:

[0348] The server accesses the received URL and downloads the image data from the web page, for example, by using an HTTP request to retrieve the image.

[0349] Step 8:

[0350] The server stores the downloaded image data in its memory.

[0351] Step 9:

[0352] The server initializes the image2text model and converts the image data into text data. In this process, it uses a machine learning model to extract text information from the image and output it as text data.

[0353] Step 10:

[0354] The server analyzes the generated text data and checks whether it contains certain keywords associated with phishing sites (e.g., "login," "password," "verification").

[0355] Step 11:

[0356] The server determines whether the website is a phishing site based on whether the keyword is included.

[0357] Step 12:

[0358] The server uses an emotion engine to analyze the facial expression and voice data sent to it in order to analyze the user's emotions.

[0359] Step 13:

[0360] The server identifies the user's emotional state based on the analysis results of the emotion engine, such as impatience, anxiety, or relief.

[0361] Step 14:

[0362] The server adjusts the way the phishing site detection results are displayed and the content of the warning message according to the user's emotional state recognized by the emotion engine.

[0363] Step 15:

[0364] The server returns JSON format data containing the adjusted judgment results to the terminal.

[0365] Step 16:

[0366] The terminal analyzes the JSON formatted judgment result received from the server.

[0367] Step 17:

[0368] Based on the analysis results, the device displays the phishing site determination results to the user with a warning message and display method that is tailored to the user. For example, it may display a message saying "This site may be a phishing site" and change the color and font depending on the user's feelings.

[0369] In this way, users can quickly check the safety of suspicious sites and receive the results in an interface that suits their emotional state.

[0370] Example 2

[0371] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0372] In modern society, the proliferation of phishing sites has increased the risk of users accessing malicious websites and losing personal information and assets. Conventional phishing site detection systems have limitations in the accuracy of converting image data into text and identifying phishing sites. Furthermore, they are unable to provide appropriate warnings that take into account the user's emotional state. This can impair the user experience, creating a need for improved safety. Furthermore, there is a need to minimize the impact on users by generating warning messages that reflect the user's emotional state, in addition to identifying phishing sites.

[0373] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for acquiring image data, means for converting the image data into text data, means for determining whether a website is a phishing site based on the text data, means for analyzing the user's emotional data and generating a warning message based on the emotional state, and means for outputting the determination result and the warning message. This makes it possible to detect phishing sites with high accuracy and provide an appropriate warning message according to the user's emotional state.

[0374] "Image data" refers to visual information obtained from a web page, including photographs, diagrams, graphs, and other image information stored in digital format.

[0375] "Text data" is image data converted into character information, and is data that includes readable characters and text information.

[0376] A "phishing site" is a fake web page created by a malicious third party to look like a legitimate site in order to fraudulently obtain users' personal information and authentication information.

[0377] "Emotion data" is information that represents the user's emotional state, and is data collected from the user's facial expressions, voice, actions, and the like.

[0378] "Emotion engine" refers to software or hardware technology for analyzing emotion data and recognizing a user's emotional state.

[0379] A "warning message" is a message that warns users about the risks of phishing sites, and is a statement intended to inform users of the dangers.

[0380] The "determination result" is a result indicating whether or not a website is a phishing site based on an analysis of image data and text data.

[0381] A "generative model" refers to an algorithm or machine learning model that uses AI technology to generate text data from image data.

[0382] The present invention is a system that combines a system that converts image data into text data to detect phishing sites with an emotion engine that recognizes user emotions. Specific embodiments of this system are described below.

[0383] Overall system configuration

[0384] This system consists of three main components: a server, a terminal, and a user. The server receives website URLs, acquires image data, converts it to text data, determines whether the website is a phishing site, and displays the results based on the user's sentiment. The terminal provides an interface that receives input from the user and sends it to the server. The user checks suspicious websites through this terminal.

[0385] Hardware and Software Configuration

[0386] The server uses the following hardware and software:

[0387] A network interface for sending and receiving HTTP requests

[0388] Analyzing web pages with an HTML parser (e.g. BeautifulSoup)

[0389] HTTP client for downloading image data

[0390] Image2Text model for extracting text from images (OCR technology)

[0391] Keyword search and machine learning models to analyze text data and identify phishing sites

[0392] An emotion engine (e.g., OpenCV, Google Speech-to-Text API) that analyzes user emotions

[0393] A software stack for sending and receiving data in JSON format

[0394] The hardware and software used by the device:

[0395] An interface (web browser, dedicated application, or GUI) that allows users to enter URLs

[0396] A device that uses a camera and microphone to capture a user's facial expressions and voice

[0397] A network interface for generating and sending HTTP requests to a server

[0398] a display and display software for displaying the judgment results received from the server;

[0399] User Action:

[0400] Enter the URL of the suspicious website

[0401] Use your device's camera and microphone to provide emotional data

[0402] Check the judgment results and warning messages displayed on the device and take necessary action.

[0403] What the program does

[0404] The server receives the website URL sent from the device and accesses this URL to retrieve the image data on the webpage. The image data is downloaded using an HTTP request and then analyzed for image tags in the webpage using an HTML parser. The image data is then input into the image2text model, which converts the image into text data. This text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and a machine learning model is used to identify phishing sites.

[0405] Furthermore, the server receives the user's emotional data sent from the device and inputs it into the emotion engine. The emotion engine analyzes the user's facial expressions and voice to detect their emotional state. Based on the detected emotion, the server generates a warning message in a format that is easy for the user to accept, in conjunction with the phishing site judgment result. The generated warning message and judgment result are sent to the device in JSON format.

[0406] The device analyzes the received JSON format data and displays it appropriately to the user. Specifically, it organizes warning messages and judgment results so that the user can understand them immediately, and displays them on the screen.

[0407] Users should check the results displayed and take appropriate action if they suspect phishing, such as avoiding the site or reporting it to the security department.

[0408] Specific examples

[0409] For example, if a user wants to check the security of their bank's login page, they might do the following:

[0410] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[0411] 2. The device generates and sends a request to the server for the entered URL, and simultaneously collects the user's facial expression and voice data using the camera and microphone and sends them to the server.

[0412] 3. The server receives the URL, visits the page, and downloads the image.

[0413] 4. The server converts the downloaded image into an image2text model and generates text data (e.g., "Please log in").

[0414] 5. The server analyzes the generated text data, checks whether it contains specific keywords, and uses a machine learning model to identify phishing sites.

[0415] 6. The server uses an emotion engine to analyze the user's facial expressions and voice data and recognize the user's emotional state.

[0416] 7. The server generates an appropriate warning message based on the emotion data and the phishing judgment result. This message and the judgment result are sent to the device in JSON format.

[0417] 8. The device analyzes the received data and displays a warning message to the user saying, "This site may be a phishing site."

[0418] Examples of prompt statements

[0419] Below are some example prompts to input to a generative AI model:

[0420] "Enter the bank login page URL 'https: / / example-bank.com / login' into your phishing detection system to verify its safety. Also, generate a warning message that reflects the user's emotional state."

[0421] In this way, the phishing site detection system according to the present invention provides appropriate warnings according to the user's emotional state, and achieves highly accurate detection of phishing sites.

[0422] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0423] Step 1:

[0424] The server receives the URL from the terminal. The server receives the HTTP request and obtains the website URL in the request body. Input: Website URL from the terminal. Output: Obtained website URL in the server.

[0425] Step 2:

[0426] The server retrieves the image data of a web page. The server makes an HTTP request to the retrieved URL and downloads the HTML of the web page. Next, it uses an HTML parser (e.g. BeautifulSoup) to analyze the image tags in the web page and create a list of image URLs. It then sends an HTTP request to each image URL in the list to retrieve the image data. Input: Website URL. Output: Web page image data.

[0427] Step 3:

[0428] The server converts image data into text data. The server inputs the acquired image data into the image2text model to extract the text information in the image. In this process, OCR technology is used to convert the image data into text format. Input: Image data. Output: Text data.

[0429] Step 4:

[0430] The server identifies phishing sites. The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login," "password," "verification"). It also uses a machine learning model to score the likelihood of a phishing site from the text features and determines whether it exceeds a certain threshold. Input: Text data. Output: Phishing site identification result.

[0431] Step 5:

[0432] The server analyzes the emotion data using an emotion engine. The server receives the user's facial expression and voice data sent from the device and inputs it into the emotion engine. The emotion engine analyzes this data and detects the user's emotional state. For example, facial expressions are analyzed using facial recognition technology (e.g., OpenCV) and emotions are inferred using voice recognition (e.g., Google Speech-to-Text API). Input: User's facial expression data, voice data. Output: User's emotional state.

[0433] Step 6:

[0434] The server generates a result based on the judgment result and emotional data. The server creates an appropriate warning message based on the phishing site judgment result and the user's emotional data. For example, if the user is surprised, it generates a warning message such as "Caution! This site may be phishing." Input: phishing site judgment result, user's emotional state. Output: Result including the adjusted warning message.

[0435] Step 7:

[0436] The server sends the results to the terminal. The server formats the generated warning message and phishing site judgment results in JSON format and sends them to the terminal as an HTTP response. Input: Warning message, phishing site judgment results. Output: JSON format response to the terminal.

[0437] Step 8:

[0438] The terminal displays the results. The terminal analyzes the received JSON format data and displays it appropriately to the user. Specifically, it displays warning messages and judgment results appropriately on a GUI (graphical user interface) and organizes the information so that the user can understand it immediately. Input: JSON format response from the server. Output: Content displayed to the user.

[0439] Step 9:

[0440] The user checks the results and takes the necessary action. The user checks the displayed results and takes appropriate action, such as not using the site or reporting it to the security department, if they suspect phishing. They also take action based on the response message that is based on emotional data. Input: Displayed results on the device. Output: User's response action.

[0441] (Application example 2)

[0442] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0443] Conventional phishing site detection systems only display warnings for significant risks, and often issue warnings without considering the user's emotional state. This reduces the effectiveness of the warning and poses the risk of users taking the wrong action. Another issue is that it is difficult to accurately identify phishing sites using simple keyword extraction alone.

[0444] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for acquiring image data, means for converting the image data into text data, means for determining whether a website is a phishing site based on the text data, means for recognizing the user's emotions, and means for adjusting and outputting the determination result based on the emotions. This makes it possible to provide an appropriate warning according to the user's emotional state, significantly improving the accuracy of phishing site detection and the user experience.

[0445] The "means for acquiring image data" is a function for collecting image data from web pages on the Internet or screenshots provided by users.

[0446] "Means for converting image data into text data" refers to a function for converting character information in an image into text data using optical character recognition technology or a generative AI model.

[0447] The "means for determining whether a website is a phishing site based on text data" is a function for determining whether a website is a phishing site by analyzing the generated text data and detecting specific keywords or patterns.

[0448] The "means for recognizing the user's emotions" is a function for collecting the user's facial expressions and voice through a camera or microphone, and analyzing this to determine the user's emotional state.

[0449] The "means for adjusting and outputting the judgment result based on emotion" is a function for adjusting the judgment result of a phishing site according to the user's emotional state and conveying it to the user in the most appropriate format.

[0450] A system for implementing the present invention has the following configuration: The system receives a website URL or screenshot entered by a user, and provides a function for determining its safety. The system also has a function for adjusting the display method of the results depending on the user's emotional state.

[0451] Overall system configuration

[0452] It consists of three main elements: the server, the terminal, and the user.

[0453] The server receives the website URL sent from the terminal, acquires the image data, converts it into text data, determines whether the site is a phishing site, and displays the results based on the user's sentiment.

[0454] The terminal provides an interface that receives input from the user and transmits it to the server.

[0455] The user checks suspicious websites through this terminal.

[0456] Server Processing

[0457] The server performs the following process:

[0458] 1. Image Data Acquisition:

[0459] The server receives the website URL sent from the device, accesses this URL, and downloads the image data on the web page. The image is retrieved using an HTTP request.

[0460] 2. Convert image data to text data:

[0461] The server inputs the acquired image data into a generative AI model to convert the image into text data, a process that extracts textual information from the image and outputs it as formatted text.

[0462] 3. Phishing site identification:

[0463] The generated text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and based on these keywords, it determines whether the website is a phishing site.

[0464] 4. Recognizing user emotions with the emotion engine:

[0465] The server uses an emotion engine that recognizes the user's emotions and collects emotional information from the user's facial expressions and voice. The server analyzes this emotional information and adjusts the display method to make the site information more easily accepted by the user.

[0466] 5. Output of judgment result:

[0467] The judgment results are formatted as JSON data and returned to the device, including warning messages and display methods adjusted based on the user's emotions.

[0468] Terminal handling

[0469] The terminal performs the following process:

[0470] 1. URL input acceptance:

[0471] The terminal provides an interface for accepting the URL of a website entered by the user, which may be a web browser, a dedicated application, or a GUI.

[0472] 2. Send URL:

[0473] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[0474] 3. Collecting Emotional Data:

[0475] The device uses the user's camera and microphone to capture the user's facial expressions and voice, and sends this data to the server.

[0476] 4. Receiving and displaying results:

[0477] The device analyzes the JSON formatted judgment result received from the server and displays the judgment result to the user based on the adjusted warning message and display method.

[0478] User operations

[0479] The user performs the following operations:

[0480] 1. Enter the URL:

[0481] The user enters the URL of the suspicious website using the interface provided by the terminal.

[0482] 2. Providing Emotion Data:

[0483] Users provide emotional data using their device's camera and microphone, and this operation is usually done automatically.

[0484] 3. Check the results:

[0485] Users can check the results and warning messages displayed on their devices and take appropriate action if necessary regarding websites suspected of phishing.

[0486] Specific examples

[0487] When a user wants to check the safety of a payment page on an online shopping site, they enter the URL into the app, which determines whether the site is phishing and, if the user is nervous, displays a high-urgency warning message.

[0488] Prompt Sentence Examples

[0489] "Please analyze the following URL to determine if it is a phishing site: 'https: / / example-phishing-site.com'"

[0490] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0491] Step 1:

[0492] The user enters the URL or screenshot of a suspicious website into the device. The device takes the URL or image file path entered by the user and prepares it to send to the server. The input data includes the URL in string format and the image file path. An HTTP request is generated as output.

[0493] Step 2:

[0494] The terminal sends the URL or image data obtained from the user to the server. Specifically, it creates and sends an HTTP request. The input data includes the URL string or image file. The output data is the result of sending the request to the server.

[0495] Step 3:

[0496] The server accesses the received URL and retrieves the image data on the web page. It uses an HTTP request to download the image from the web page. The input data includes the URL string. The output data is the downloaded image data.

[0497] Step 4:

[0498] The server converts the acquired image data into text data using a generative AI model. Specifically, it extracts character information from the image using optical character recognition (OCR) technology and generates it as formatted text data. The input data is image data, and the output data is the generated text data.

[0499] Step 5:

[0500] The server analyzes the generated text data and checks for specific keywords to determine whether it is a phishing site. For example, it checks whether the text data contains keywords such as "login" or "password." The input data is the text data, and the output data is the phishing site determination result (true / false).

[0501] Step 6:

[0502] The server uses an emotion engine to recognize the user's emotional state and analyzes the user's facial expressions and voice. This analysis uses data collected from the user's camera and microphone. The input data is the user's facial expressions and voice data, and the output data is emotional information (e.g., surprise, fear, relief, etc.).

[0503] Step 7:

[0504] The server adjusts the warning message based on the phishing site detection result and the user's emotional information, and sends it to the terminal in the optimal format. Specifically, it adjusts the urgency and expression method according to the emotional information. The input data are the phishing site detection result and the user's emotional information, and the output data is the adjusted warning message.

[0505] Step 8:

[0506] The terminal analyzes the tailored warning message received from the server and displays it to the user in an appropriate format, such as a pop-up message or a sound notification. The input data is the warning message from the server, and the output data is the displayed warning message.

[0507] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0508] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0509] In the above embodiment, an example in which the specific process is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific process may be performed by the smart device 14.

[0510] [Second embodiment]

[0511] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0512] 3, the data processing system 210 includes the data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0513] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0514] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0515] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0516] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0517] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0518] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0519] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0520] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0521] In the smart glasses 214, the reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0522] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal."

[0523] The present invention relates to a system for detecting phishing sites that are composed only of images with high accuracy. Specific embodiments of the system will be described below.

[0524] Overall system configuration

[0525] This system consists of three main components: a server, a terminal, and a user. The server receives the website URL sent by the user, acquires image data, converts it to text data, and identifies phishing sites. The terminal provides an interface that receives input from the user and sends it to the server. The user checks for suspicious websites through this terminal.

[0526] Server Processing

[0527] The server performs the following process:

[0528] 1. Image Data Acquisition:

[0529] The server receives the website URL sent from the device, accesses this URL, and downloads the image on the web page. The image is retrieved using an HTTP request.

[0530] 2. Convert image data to text data:

[0531] The server converts the captured image into text data by inputting it into an image2text model (e.g., a specialized AI algorithm). This process extracts the textual information in the image and outputs it as formatted text.

[0532] 3. Phishing site identification:

[0533] The generated text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and based on these keywords, it determines whether the website is a phishing site.

[0534] 4. Output of judgment result:

[0535] The results are formatted as JSON data and sent back to the device. This includes a process to display the results in a format that is easy for the user to understand.

[0536] Terminal handling

[0537] The terminal performs the following process:

[0538] 1. URL input acceptance:

[0539] The terminal provides an interface for accepting the URL of a website entered by the user, which may be a web browser, a dedicated application, or a GUI.

[0540] 2. Send URL:

[0541] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[0542] 3. Receiving and displaying results:

[0543] The terminal receives the judgment results from the server and displays them to the user in a variety of formats, including warning messages, alerts, and detailed analysis results.

[0544] User operations

[0545] The user performs the following operations:

[0546] 1. Enter the URL:

[0547] The user enters the URL of the suspicious website using the interface provided by the terminal.

[0548] 2. Check the results:

[0549] Users can check the results displayed on their device and take appropriate action if necessary regarding suspected phishing websites, such as avoiding the site or reporting it to their security department.

[0550] Specific examples

[0551] For example, if a user wants to check the security of a bank's login page, the process would be as follows:

[0552] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[0553] 2. The terminal generates and sends a request to the server for the entered URL.

[0554] 3. The server receives the URL, visits the page and downloads the image.

[0555] 4. The server converts the downloaded image into an image2text model and generates text data (e.g., "Please log in").

[0556] 5. The server analyzes the generated text to see if it contains keywords associated with phishing sites.

[0557] 6. The server determines that the site is likely to be a phishing site and returns the result to the device.

[0558] 7. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[0559] This allows users to instantly confirm the safety of suspicious websites.Compared to conventional text-based phishing site detection methods, this invention makes it possible to detect phishing sites that consist only of images with high accuracy.

[0560] The processing flow will be explained below.

[0561] Step 1:

[0562] The user enters the URL of a suspicious website into the terminal and presses the check button.

[0563] Step 2:

[0564] The terminal generates an HTTP request to send the input URL.

[0565] Step 3:

[0566] The terminal sends the generated HTTP request to the server.

[0567] Step 4:

[0568] The server receives the URL sent from the terminal.

[0569] Step 5:

[0570] The server accesses the received URL and downloads the image data from the page, using an HTTP request.

[0571] Step 6:

[0572] The server stores the downloaded image data in its memory.

[0573] Step 7:

[0574] The server initializes the image2text model to convert image data to text data, using a generative model to extract text information from the image.

[0575] Step 8:

[0576] The server analyzes the generated text data and checks whether it contains certain keywords associated with phishing sites (e.g., "login," "password," "verification").

[0577] Step 9:

[0578] The server determines whether the site is a phishing site based on whether it contains the keywords.

[0579] Step 10:

[0580] The server formats the results into JSON format data.

[0581] Step 11:

[0582] The server returns the generated JSON formatted data to the terminal.

[0583] Step 12:

[0584] The terminal analyzes the JSON formatted judgment result received from the server.

[0585] Step 13:

[0586] Based on the analysis results, the device displays a judgment result to the user, such as "This site may be a phishing site" or "This site is safe."

[0587] This allows users to quickly verify the safety of suspicious sites.

[0588] Example 1

[0589] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0590] In recent years, fraudulent activities via phishing sites have been increasing on the Internet. In particular, phishing sites that consist only of images are difficult to detect using conventional text-based detection algorithms. Therefore, there is a need for a highly accurate method for detecting phishing sites using image data.

[0591] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0592] In this invention, the server includes means for receiving a website URL and acquiring the webpage content, means for downloading image data from the acquired webpage, means for converting the downloaded image data into text data using a generative model, means for analyzing specific keywords based on the text data and determining whether the website is a phishing site, and means for formatting and outputting the determination result in JSON format, thereby enabling rapid detection of phishing sites consisting only of images with high accuracy.

[0593] A "website URL" is a string of characters that identifies and accesses a particular web page that a user wants to access.

[0594] "Web page content" means all data, including HTML, images, style sheets, scripts, etc., of a website retrieved by a specified URL.

[0595] "Image data" refers to data files that represent visual information contained in web page content and are saved in formats such as JPEG and PNG.

[0596] A "generative model" is an artificial intelligence algorithm that generates a specific output based on input data, in this case generating text data from image data.

[0597] "Text data" is data that represents character information extracted from image data by a generative model.

[0598] "Specific keywords" are predefined significant words or phrases used to identify phishing sites.

[0599] "Analysis" is the process of examining data in detail and extracting specific information or patterns.

[0600] "Decision" is the act of determining whether a certain condition is met based on the results of data analysis.

[0601] "JSON format" stands for JavaScript Object Notation, a lightweight format for organizing data and easily exchanging it.

[0602] "Output" refers to the act of providing the results of processing by a system to a user or another system.

[0603] MODE FOR CARRYING OUT THE INVENTION

[0604] The present invention relates to a system for detecting phishing sites that are composed only of image data with high accuracy. A specific embodiment of this system will be described below.

[0605] Overall system configuration

[0606] This system consists of three main components: a server, a terminal, and a user. The server receives the website URL sent by the user, acquires image data, converts it to text data, and identifies phishing sites. The terminal provides an interface that receives input from the user and sends it to the server. The user checks for suspicious websites through this terminal.

[0607] Server Processing

[0608] The server uses the following main software and libraries: the requests library for HTTP requests, BeautifulSoup for HTML parsing, and generative models (e.g., Tesseract OCR) for processing image data.

[0609] The server receives the URL sent by the user from the device and accesses the specified web page. It downloads image data from the retrieved web page and converts the image data into text data using a generative model. It then analyzes specific keywords based on the text data to determine whether it is a phishing site. It then formats the result of this determination into JSON format and sends it to the device.

[0610] Terminal handling

[0611] The terminal provides an interface for accepting website URLs entered by the user. This interface may consist of a web browser, a dedicated application, or a GUI. When the user enters a URL and presses the send button, the terminal generates and sends an HTTP request to send the URL to the server. The terminal receives the judgment results returned from the server and displays them on the screen in a format that is easy for the user to understand.

[0612] User operations

[0613] The user enters the URL of a suspicious website using the device interface, and when the results are displayed on the device, the user can review the results and take necessary action, such as avoiding the site if it is likely a phishing site or reporting it to the security department.

[0614] Specific examples

[0615] Specific examples are shown below.

[0616] If a user wants to check the security of their bank's login page, the following steps will be taken:

[0617] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[0618] 2. The terminal generates and sends a request to the server for the entered URL.

[0619] 3. The server receives the URL, visits the page and downloads the image.

[0620] 4. The server inputs the downloaded images into a generative model to generate text data.

[0621] 5. The server analyzes the generated text data to see if it contains specific keywords associated with phishing sites.

[0622] 6. The server determines that the site is likely to be a phishing site and returns the result to the device.

[0623] 7. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[0624] Examples of prompts are:

[0625] Enter your website URL (e.g. https: / / example-bank.com / login):

[0626] Using this prompt sentence makes it easier for the user to input, and it is expected that the system will operate efficiently.

[0627] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0628] Step 1:

[0629] Receiving URLs

[0630] The server receives the HTTP request sent from the device. This request includes the URL of the website entered by the user. The server saves the received URL in a variable.

[0631] Input: The website URL entered by the user

[0632] Output: Saved URL

[0633] Specific behavior:

[0634] The server listens for HTTP requests, extracts the URL from the request body, and saves it.

[0635] Step 2:

[0636] Web page access

[0637] The server sends an HTTP GET request to the stored URL to retrieve the web page content, including the web page's HTML, images, stylesheets, scripts, etc.

[0638] Input: Saved URL

[0639] Output: Retrieved web page content (HTML, etc.)

[0640] Specific behavior:

[0641] Use the requests library to send a GET request to the specified URL.

[0642] Get the web page content from the response and save it in a variable.

[0643] Step 3:

[0644] Image data acquisition

[0645] The server analyzes the HTML of the retrieved web page and extracts the image data. Find the tag, get the image URL from its src attribute, and download the image data.

[0646] Input: HTML content of a web page

[0647] Output: Downloaded image data

[0648] Specific behavior:

[0649] Use BeautifulSoup to parse the HTML of a web page, Find the tag.

[0650] A GET request is sent to each image URL, and the image data is downloaded and saved.

[0651] Step 4:

[0652] Image data conversion

[0653] The server inputs the downloaded image data into a generative AI model (e.g., Tesseract OCR) to extract text data from the image.

[0654] Input: Downloaded image data

[0655] Output: Generated text data

[0656] Specific behavior:

[0657] Load the image data into a generative AI model (such as Tesseract OCR).

[0658] The model extracts text information from the image and saves it as text data.

[0659] Step 5:

[0660] Keyword Analysis

[0661] The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login", "password", "verification").

[0662] Input: Generated text data

[0663] Output: Keyword analysis results (phishing detection)

[0664] Specific behavior:

[0665] Based on a predefined keyword list, the frequency of keyword occurrence within text data is checked.

[0666] Calculate the keyword match rate and determine whether it exceeds a threshold.

[0667] Step 6:

[0668] Formatting and sending results

[0669] The server formats the results of the keyword analysis into JSON format and sends it to the terminal as an HTTP response.

[0670] Input: Keyword analysis results

[0671] Output: JSON format result

[0672] Specific behavior:

[0673] The result of the judgment is converted into a JSON object and sent to the terminal as an HTTP response.

[0674] Step 7:

[0675] URL input acceptance

[0676] The terminal provides an interface that accepts the URL of a website entered by the user. This interface may consist of a web browser, a dedicated application, a GUI, or the like.

[0677] Input: The URL entered by the user

[0678] Output: URL input from user

[0679] Specific behavior:

[0680] It displays an input field in an HTML form or dedicated application, allowing the user to enter a URL.

[0681] Step 8:

[0682] Send URL

[0683] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[0684] Input: The URL entered by the user

[0685] Output: HTTP request to the server

[0686] Specific behavior:

[0687] It takes data from form inputs and generates an HTTP POST request to send to the server.

[0688] Step 9:

[0689] Receive results

[0690] The terminal receives the determination result from the server.

[0691] Input: HTTP response from the server

[0692] Output: Received judgment result (JSON)

[0693] Specific behavior:

[0694] Receives an HTTP response and extracts JSON data from the response body.

[0695] Step 10:

[0696] Results display

[0697] The terminal displays the received judgment results to the user in the form of warning messages, alerts, detailed analysis results, etc.

[0698] Input: Received judgment result (JSON)

[0699] Output: Displaying the results to the user

[0700] Specific behavior:

[0701] Analyze the JSON data and display a message based on the results on the screen.

[0702] Step 11:

[0703] URL input

[0704] The user enters the URL of a suspicious website using the interface provided by the device.

[0705] Input: The URL entered by the user

[0706] Output: URL input to terminal

[0707] Specific behavior:

[0708] Enter the target URL into the URL input field on your browser or application and press the send button.

[0709] Step 12:

[0710] Check the results

[0711] The user checks the results displayed on the terminal and takes the necessary action.

[0712] Input: Judgment result displayed on the device

[0713] Output: User action (e.g. avoid site, report)

[0714] Specific behavior:

[0715] View the phishing detection results displayed on your device and take appropriate action based on the results.

[0716] (Application example 1)

[0717] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0718] Phishing sites that consist only of images are difficult to detect using conventional text-based phishing site detection methods, and users remain vulnerable to these phishing sites. Therefore, there is a need for a system that can analyze image data to detect phishing sites with high accuracy. There is also a need for a system that allows users to receive phishing site warnings in real time.

[0719] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0720] In this invention, the server includes means for acquiring image data, means for converting the image data into text data, means for determining whether a website is a phishing site based on the text data, and means for notifying the terminal of the determination result in real time, thereby enabling phishing sites consisting only of images to be detected with high accuracy and enabling users to receive warnings about phishing sites in real time.

[0721] "Image data" is data in digital format that contains visual information displayed on a web page.

[0722] "Text data" is data in a digital format that contains textual information extracted from image data.

[0723] A "phishing site" is a fake website created with the purpose of fraudulently obtaining users' personal information and authentication information.

[0724] A "terminal" is a device used by a user, such as a smartphone or computer, through which a website is accessed.

[0725] "Real-time notification" is a function that instantly reports the results of a phishing site detection to the user.

[0726] A "generative model" is a system that uses machine learning and artificial intelligence algorithms to analyze image data and generate text data.

[0727] "Keywords" are specific words or phrases used to identify phishing sites.

[0728] The "judgment result" is the analysis result of whether the website is a phishing site.

[0729] The present invention relates to a system for detecting phishing sites that are composed only of images with high accuracy. Specific embodiments of the system will be described below.

[0730] Overall system configuration

[0731] This system consists of three main components: a server, a terminal, and a user. The server receives the website URL sent by the user, acquires image data, converts it to text data, and identifies phishing sites. The terminal provides an interface that receives input from the user and sends it to the server. The user checks for suspicious websites through this terminal.

[0732] Server Processing

[0733] Obtaining image data: The server receives the website URL sent from the device. It accesses this URL and downloads the image on the web page. In this process, it obtains the image data using an HTTP request.

[0734] Converting image data to text data: The server inputs the acquired image data into a generative AI model (e.g., a machine learning algorithm) to convert the image into text data. This process extracts textual information from the image and outputs it as formatted text. Specifically, PIL (Python Imaging Library) and Pytesseract are used.

[0735] Phishing site identification: The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login", "password", "verification", "login"). Based on these keywords, it determines whether the website is a phishing site.

[0736] Notification of judgment results: The server formats the judgment results as JSON data and sends them to the terminal in real time. This includes a process to display the results in a format that is easy for the user to understand.

[0737] Terminal handling

[0738] URL input acceptance: The terminal provides an interface for accepting website URLs entered by the user. This interface can be a web browser, a dedicated application, or a GUI.

[0739] Sending URL: The terminal generates and sends an HTTP request to send the entered URL to the server.

[0740] Receiving and displaying results: The terminal receives the judgment results from the server and displays them to the user in real time. The display format can vary, including warning messages, alerts, and detailed analysis results.

[0741] User operations

[0742] Entering a URL: The user enters the URL of a suspicious website using the interface provided by the device.

[0743] Review the results: Users review the results displayed on their device and take appropriate action regarding suspected phishing websites, if necessary, such as avoiding the site or reporting it to their security department.

[0744] Specific examples

[0745] For example, if a user wants to check the security of a bank's login page, the process would be as follows:

[0746] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[0747] 2. The device generates and sends a request to send the URL to the server.

[0748] 3. The server receives the URL, visits the page, and downloads the image.

[0749] 4. The server inputs the downloaded image into a generative AI model (e.g., Pytesseract) to generate text data (e.g., "Please log in").

[0750] 5. The server analyzes the generated text to see if it contains keywords related to phishing sites.

[0751] 6. The server determines that the site is likely to be a phishing site and notifies the device of the result in real time.

[0752] 7. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[0753] Prompt Sentence Examples

[0754] Check out http: / / example.com / suspicious_site.

[0755] This allows users to instantly confirm the safety of suspicious websites.Compared to conventional text-based phishing site detection methods, this invention makes it possible to detect phishing sites that consist only of images with high accuracy.

[0756] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0757] Step 1:

[0758] URL input reception (terminal)

[0759] The user inputs the URL of a website into the terminal interface, which can be a web browser, a dedicated application, or a GUI. When the user inputs the URL and presses the check button, the terminal receives this information and obtains the input data (URL) to proceed to the next processing step.

[0760] Step 2:

[0761] Send URL (device)

[0762] The device receives the URL entered by the user and sends it to the server as an HTTP request. This request includes the URL to be verified and serves as input data for the server to retrieve web page information. After sending the request, the device waits for a response from the server.

[0763] Step 3:

[0764] Acquisition of image data (server)

[0765] The server accesses the web page based on the URL received from the terminal. It uses an HTTP request to download the image data of the web page and obtains the image data. The obtained image data is the input data to be converted to text data in the next step.

[0766] Step 4:

[0767] Convert image data to text data (server)

[0768] The server inputs the acquired image data into a generative AI model (e.g., Pytesseract), extracts text information from the image, and generates text data. This process formats the image data as text data, which becomes input data for phishing site detection in the next step.

[0769] Step 5:

[0770] Phishing site detection (server)

[0771] The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login," "password," "verification," "login"). Based on these keywords, it determines whether the website is a phishing site. The determination result (whether it is likely to be a phishing site or not) is output data that is notified to the terminal in the next step.

[0772] Step 6:

[0773] Notification of judgment results (server)

[0774] The server formats the phishing site detection results as JSON data and sends them to the device in real time. This notification contains information about the possibility that the website is a phishing site. The notified detection results become input data for display on the device.

[0775] Step 7:

[0776] Receiving and displaying results (terminal)

[0777] The device analyzes the phishing site detection results received from the server and displays them to the user in real time. Specifically, the results are displayed as warning messages, alerts, or detailed analysis results. This display allows the user to confirm the safety of the website and take appropriate action if necessary.

[0778] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[0779] The present invention is a system that converts image data into text data to detect phishing sites, and combines it with an emotion engine that recognizes user emotions. Specific embodiments of this system are described below.

[0780] Overall system configuration

[0781] This system consists of three main components: a server, a terminal, and a user. The server receives website URLs sent by users, acquires image data, converts it to text data, determines whether the website is a phishing site, and displays the results based on the user's sentiment. The terminal provides an interface that receives input from users and sends it to the server. Users check suspicious websites through this terminal.

[0782] Server Processing

[0783] The server performs the following process:

[0784] 1. Image Data Acquisition:

[0785] The server receives the website URL sent from the device, accesses this URL, and downloads the image data on the web page. The image is retrieved using an HTTP request.

[0786] 2. Convert image data to text data:

[0787] The server inputs the acquired image data into the image2text model to convert the image into text data. This process extracts the textual information in the image and outputs it as formatted text.

[0788] 3. Phishing site identification:

[0789] The generated text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and based on these keywords, it determines whether the website is a phishing site.

[0790] 4. Recognizing user emotions with the emotion engine:

[0791] The server uses an emotion engine that recognizes the user's emotions and collects emotional information from the user's facial expressions and voice. The server analyzes this emotional information and adjusts the display method to make the site information more easily accepted by the user.

[0792] 5. Output of judgment result:

[0793] The judgment results are formatted as JSON data and returned to the device, including warning messages and display methods adjusted based on the user's emotions.

[0794] Terminal handling

[0795] The terminal performs the following process:

[0796] 1. URL input acceptance:

[0797] The terminal provides an interface for accepting the URL of a website entered by the user, which may be a web browser, a dedicated application, or a GUI.

[0798] 2. Send URL:

[0799] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[0800] 3. Collecting Emotional Data:

[0801] The device uses the user's camera and microphone to capture the user's facial expressions and voice, and sends this data to the server.

[0802] 4. Receiving and displaying results:

[0803] The device analyzes the JSON formatted judgment result received from the server and displays the judgment result to the user based on the adjusted warning message and display method.

[0804] User operations

[0805] The user performs the following operations:

[0806] 1. Enter the URL:

[0807] The user enters the URL of the suspicious website using the interface provided by the terminal.

[0808] 2. Providing Emotion Data:

[0809] Users provide emotional data using their device's camera and microphone, and this operation is usually done automatically.

[0810] 3. Check the results:

[0811] Users can check the results and warning messages displayed on their devices and take appropriate action if necessary regarding suspected phishing websites, such as avoiding the site or reporting it to the security department.

[0812] Specific examples

[0813] For example, if a user wants to check the security of a bank's login page, the process would be as follows:

[0814] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[0815] 2. The terminal generates and sends a request to the server for the entered URL.

[0816] 3. The device uses a camera and microphone to collect the user's facial expressions and voice data and send it to the server.

[0817] 4. The server receives the URL, visits the page and downloads the image.

[0818] 5. The server converts the downloaded image into an image2text model and generates text data (e.g., "Please log in").

[0819] 6. The server analyzes the generated text to see if it contains keywords associated with phishing sites.

[0820] 7. The server uses an emotion engine to recognize the user's emotions and determines the warning message and display method according to the user's state.

[0821] 8. The server returns JSON format data containing the judgment result and the adjusted display method to the terminal.

[0822] 9. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[0823] This allows users to confirm the safety of the site and receive the results in an interface that suits their emotional state.The present invention not only improves the accuracy of phishing site detection, but also improves the user experience.

[0824] The processing flow will be explained below.

[0825] Step 1:

[0826] The user enters the URL of a suspicious website into the terminal and presses the check button.

[0827] Step 2:

[0828] The terminal generates an HTTP request to send the input URL.

[0829] Step 3:

[0830] The terminal sends the generated HTTP request to the server.

[0831] Step 4:

[0832] The device uses the user's camera and microphone to collect facial and voice data.

[0833] Step 5:

[0834] The device sends the collected facial expression and voice data to a server.

[0835] Step 6:

[0836] The server receives the URL sent from the terminal.

[0837] Step 7:

[0838] The server accesses the received URL and downloads the image data from the web page, for example, by using an HTTP request to retrieve the image.

[0839] Step 8:

[0840] The server stores the downloaded image data in its memory.

[0841] Step 9:

[0842] The server initializes the image2text model and converts the image data into text data. In this process, it uses a machine learning model to extract text information from the image and output it as text data.

[0843] Step 10:

[0844] The server analyzes the generated text data and checks whether it contains certain keywords associated with phishing sites (e.g., "login," "password," "verification").

[0845] Step 11:

[0846] The server determines whether the website is a phishing site based on whether the keyword is included.

[0847] Step 12:

[0848] The server uses an emotion engine to analyze the facial expression and voice data sent to it in order to analyze the user's emotions.

[0849] Step 13:

[0850] The server identifies the user's emotional state based on the analysis results of the emotion engine, such as impatience, anxiety, or relief.

[0851] Step 14:

[0852] The server adjusts the way the phishing site detection results are displayed and the content of the warning message according to the user's emotional state recognized by the emotion engine.

[0853] Step 15:

[0854] The server returns JSON format data containing the adjusted judgment results to the terminal.

[0855] Step 16:

[0856] The terminal analyzes the JSON formatted judgment result received from the server.

[0857] Step 17:

[0858] Based on the analysis results, the device displays the phishing site determination results to the user with a warning message and display method that is tailored to the user. For example, it may display a message saying "This site may be a phishing site" and change the color and font depending on the user's feelings.

[0859] In this way, users can quickly check the safety of suspicious sites and receive the results in an interface that suits their emotional state.

[0860] Example 2

[0861] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0862] In modern society, the proliferation of phishing sites has increased the risk of users accessing malicious websites and losing personal information and assets. Conventional phishing site detection systems have limitations in the accuracy of converting image data into text and identifying phishing sites. Furthermore, they are unable to provide appropriate warnings that take into account the user's emotional state. This can impair the user experience, creating a need for improved safety. Furthermore, there is a need to minimize the impact on users by generating warning messages that reflect the user's emotional state, in addition to identifying phishing sites.

[0863] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for acquiring image data, means for converting the image data into text data, means for determining whether a website is a phishing site based on the text data, means for analyzing the user's emotional data and generating a warning message based on the emotional state, and means for outputting the determination result and the warning message. This makes it possible to detect phishing sites with high accuracy and provide an appropriate warning message according to the user's emotional state.

[0864] "Image data" refers to visual information obtained from a web page, including photographs, diagrams, graphs, and other image information stored in digital format.

[0865] "Text data" is image data converted into character information, and is data that includes readable characters and text information.

[0866] A "phishing site" is a fake web page created by a malicious third party to look like a legitimate site in order to fraudulently obtain users' personal information and authentication information.

[0867] "Emotion data" is information that represents the user's emotional state, and is data collected from the user's facial expressions, voice, actions, and the like.

[0868] "Emotion engine" refers to software or hardware technology for analyzing emotion data and recognizing a user's emotional state.

[0869] A "warning message" is a message that warns users about the risks of phishing sites, and is a statement intended to inform users of the dangers.

[0870] The "determination result" is a result indicating whether or not a website is a phishing site based on an analysis of image data and text data.

[0871] A "generative model" refers to an algorithm or machine learning model that uses AI technology to generate text data from image data.

[0872] The present invention is a system that combines a system that converts image data into text data to detect phishing sites with an emotion engine that recognizes user emotions. Specific embodiments of this system are described below.

[0873] Overall system configuration

[0874] This system consists of three main components: a server, a terminal, and a user. The server receives website URLs, acquires image data, converts it to text data, determines whether the website is a phishing site, and displays the results based on the user's sentiment. The terminal provides an interface that receives input from the user and sends it to the server. The user checks suspicious websites through this terminal.

[0875] Hardware and Software Configuration

[0876] The server uses the following hardware and software:

[0877] A network interface for sending and receiving HTTP requests

[0878] Analyzing web pages with an HTML parser (e.g. BeautifulSoup)

[0879] HTTP client for downloading image data

[0880] Image2Text model for extracting text from images (OCR technology)

[0881] Keyword search and machine learning models to analyze text data and identify phishing sites

[0882] An emotion engine (e.g., OpenCV, Google Speech-to-Text API) that analyzes user emotions

[0883] A software stack for sending and receiving data in JSON format

[0884] The hardware and software used by the device:

[0885] An interface (web browser, dedicated application, or GUI) that allows users to enter URLs

[0886] A device that uses a camera and microphone to capture a user's facial expressions and voice

[0887] A network interface for generating and sending HTTP requests to a server

[0888] a display and display software for displaying the judgment results received from the server;

[0889] User Action:

[0890] Enter the URL of the suspicious website

[0891] Use your device's camera and microphone to provide emotional data

[0892] Check the judgment results and warning messages displayed on the device and take necessary action.

[0893] What the program does

[0894] The server receives the website URL sent from the device and accesses this URL to retrieve the image data on the webpage. The image data is downloaded using an HTTP request and then analyzed for image tags in the webpage using an HTML parser. The image data is then input into the image2text model, which converts the image into text data. This text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and a machine learning model is used to identify phishing sites.

[0895] Furthermore, the server receives the user's emotional data sent from the device and inputs it into the emotion engine. The emotion engine analyzes the user's facial expressions and voice to detect their emotional state. Based on the detected emotion, the server generates a warning message in a format that is easy for the user to accept, in conjunction with the phishing site judgment result. The generated warning message and judgment result are sent to the device in JSON format.

[0896] The device analyzes the received JSON format data and displays it appropriately to the user. Specifically, it organizes warning messages and judgment results so that the user can understand them immediately, and displays them on the screen.

[0897] Users should check the results displayed and take appropriate action if they suspect phishing, such as avoiding the site or reporting it to the security department.

[0898] Specific examples

[0899] For example, if a user wants to check the security of their bank's login page, they might do the following:

[0900] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[0901] 2. The device generates and sends a request to the server for the entered URL, and simultaneously collects the user's facial expression and voice data using the camera and microphone and sends them to the server.

[0902] 3. The server receives the URL, visits the page, and downloads the image.

[0903] 4. The server converts the downloaded image into an image2text model and generates text data (e.g., "Please log in").

[0904] 5. The server analyzes the generated text data, checks whether it contains specific keywords, and uses a machine learning model to identify phishing sites.

[0905] 6. The server uses an emotion engine to analyze the user's facial expressions and voice data and recognize the user's emotional state.

[0906] 7. The server generates an appropriate warning message based on the emotion data and the phishing judgment result. This message and the judgment result are sent to the device in JSON format.

[0907] 8. The device analyzes the received data and displays a warning message to the user saying, "This site may be a phishing site."

[0908] Examples of prompt statements

[0909] Below are some example prompts to input to a generative AI model:

[0910] "Enter the bank login page URL 'https: / / example-bank.com / login' into your phishing detection system to verify its safety. Also, generate a warning message that reflects the user's emotional state."

[0911] In this way, the phishing site detection system according to the present invention provides appropriate warnings according to the user's emotional state, and achieves highly accurate detection of phishing sites.

[0912] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0913] Step 1:

[0914] The server receives the URL from the terminal. The server receives the HTTP request and obtains the website URL in the request body. Input: Website URL from the terminal. Output: Obtained website URL in the server.

[0915] Step 2:

[0916] The server retrieves the image data of a web page. The server makes an HTTP request to the retrieved URL and downloads the HTML of the web page. Next, it uses an HTML parser (e.g. BeautifulSoup) to analyze the image tags in the web page and create a list of image URLs. It then sends an HTTP request to each image URL in the list to retrieve the image data. Input: Website URL. Output: Web page image data.

[0917] Step 3:

[0918] The server converts image data into text data. The server inputs the acquired image data into the image2text model to extract the text information in the image. In this process, OCR technology is used to convert the image data into text format. Input: Image data. Output: Text data.

[0919] Step 4:

[0920] The server identifies phishing sites. The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login," "password," "verification"). It also uses a machine learning model to score the likelihood of a phishing site from the text features and determines whether it exceeds a certain threshold. Input: Text data. Output: Phishing site identification result.

[0921] Step 5:

[0922] The server analyzes the emotion data using an emotion engine. The server receives the user's facial expression and voice data sent from the device and inputs it into the emotion engine. The emotion engine analyzes this data and detects the user's emotional state. For example, facial expressions are analyzed using facial recognition technology (e.g., OpenCV) and emotions are inferred using voice recognition (e.g., Google Speech-to-Text API). Input: User's facial expression data, voice data. Output: User's emotional state.

[0923] Step 6:

[0924] The server generates a result based on the judgment result and emotional data. The server creates an appropriate warning message based on the phishing site judgment result and the user's emotional data. For example, if the user is surprised, it generates a warning message such as "Caution! This site may be phishing." Input: phishing site judgment result, user's emotional state. Output: Result including the adjusted warning message.

[0925] Step 7:

[0926] The server sends the results to the terminal. The server formats the generated warning message and phishing site judgment results in JSON format and sends them to the terminal as an HTTP response. Input: Warning message, phishing site judgment results. Output: JSON format response to the terminal.

[0927] Step 8:

[0928] The terminal displays the results. The terminal analyzes the received JSON format data and displays it appropriately to the user. Specifically, it displays warning messages and judgment results appropriately on a GUI (graphical user interface) and organizes the information so that the user can understand it immediately. Input: JSON format response from the server. Output: Content displayed to the user.

[0929] Step 9:

[0930] The user checks the results and takes the necessary action. The user checks the displayed results and takes appropriate action, such as not using the site or reporting it to the security department, if they suspect phishing. They also take action based on the response message that is based on emotional data. Input: Displayed results on the device. Output: User's response action.

[0931] (Application example 2)

[0932] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0933] Conventional phishing site detection systems only display warnings for significant risks, and often issue warnings without considering the user's emotional state. This reduces the effectiveness of the warning and poses the risk of users taking the wrong action. Another issue is that it is difficult to accurately identify phishing sites using simple keyword extraction alone.

[0934] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for acquiring image data, means for converting the image data into text data, means for determining whether a website is a phishing site based on the text data, means for recognizing the user's emotions, and means for adjusting and outputting the determination result based on the emotions. This makes it possible to provide an appropriate warning according to the user's emotional state, significantly improving the accuracy of phishing site detection and the user experience.

[0935] The "means for acquiring image data" is a function for collecting image data from web pages on the Internet or screenshots provided by users.

[0936] "Means for converting image data into text data" refers to a function for converting character information in an image into text data using optical character recognition technology or a generative AI model.

[0937] The "means for determining whether a website is a phishing site based on text data" is a function for determining whether a website is a phishing site by analyzing the generated text data and detecting specific keywords or patterns.

[0938] The "means for recognizing the user's emotions" is a function for collecting the user's facial expressions and voice through a camera or microphone, and analyzing this to determine the user's emotional state.

[0939] The "means for adjusting and outputting the judgment result based on emotion" is a function for adjusting the judgment result of a phishing site according to the user's emotional state and conveying it to the user in the most appropriate format.

[0940] A system for implementing the present invention has the following configuration: The system receives a website URL or screenshot entered by a user, and provides a function for determining its safety. The system also has a function for adjusting the display method of the results depending on the user's emotional state.

[0941] Overall system configuration

[0942] It consists of three main elements: the server, the terminal, and the user.

[0943] The server receives the website URL sent from the terminal, acquires the image data, converts it into text data, determines whether the site is a phishing site, and displays the results based on the user's sentiment.

[0944] The terminal provides an interface that receives input from the user and transmits it to the server.

[0945] The user checks suspicious websites through this terminal.

[0946] Server Processing

[0947] The server performs the following process:

[0948] 1. Image Data Acquisition:

[0949] The server receives the website URL sent from the device, accesses this URL, and downloads the image data on the web page. The image is retrieved using an HTTP request.

[0950] 2. Convert image data to text data:

[0951] The server inputs the acquired image data into a generative AI model to convert the image into text data, a process that extracts textual information from the image and outputs it as formatted text.

[0952] 3. Phishing site identification:

[0953] The generated text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and based on these keywords, it determines whether the website is a phishing site.

[0954] 4. Recognizing user emotions with the emotion engine:

[0955] The server uses an emotion engine that recognizes the user's emotions and collects emotional information from the user's facial expressions and voice. The server analyzes this emotional information and adjusts the display method to make the site information more easily accepted by the user.

[0956] 5. Output of judgment result:

[0957] The judgment results are formatted as JSON data and returned to the device, including warning messages and display methods adjusted based on the user's emotions.

[0958] Terminal handling

[0959] The terminal performs the following process:

[0960] 1. URL input acceptance:

[0961] The terminal provides an interface for accepting the URL of a website entered by the user, which may be a web browser, a dedicated application, or a GUI.

[0962] 2. Send URL:

[0963] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[0964] 3. Collecting Emotional Data:

[0965] The device uses the user's camera and microphone to capture the user's facial expressions and voice, and sends this data to the server.

[0966] 4. Receiving and displaying results:

[0967] The device analyzes the JSON formatted judgment result received from the server and displays the judgment result to the user based on the adjusted warning message and display method.

[0968] User operations

[0969] The user performs the following operations:

[0970] 1. Enter the URL:

[0971] The user enters the URL of the suspicious website using the interface provided by the terminal.

[0972] 2. Providing Emotion Data:

[0973] Users provide emotional data using their device's camera and microphone, and this operation is usually done automatically.

[0974] 3. Check the results:

[0975] Users can check the results and warning messages displayed on their devices and take appropriate action if necessary regarding websites suspected of phishing.

[0976] Specific examples

[0977] When a user wants to check the safety of a payment page on an online shopping site, they enter the URL into the app, which determines whether the site is phishing and, if the user is nervous, displays a high-urgency warning message.

[0978] Prompt Sentence Examples

[0979] "Please analyze the following URL to determine if it is a phishing site: 'https: / / example-phishing-site.com'"

[0980] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0981] Step 1:

[0982] The user enters the URL or screenshot of a suspicious website into the device. The device takes the URL or image file path entered by the user and prepares it to send to the server. The input data includes the URL in string format and the image file path. An HTTP request is generated as output.

[0983] Step 2:

[0984] The terminal sends the URL or image data obtained from the user to the server. Specifically, it creates and sends an HTTP request. The input data includes the URL string or image file. The output data is the result of sending the request to the server.

[0985] Step 3:

[0986] The server accesses the received URL and retrieves the image data on the web page. It uses an HTTP request to download the image from the web page. The input data includes the URL string. The output data is the downloaded image data.

[0987] Step 4:

[0988] The server converts the acquired image data into text data using a generative AI model. Specifically, it extracts character information from the image using optical character recognition (OCR) technology and generates it as formatted text data. The input data is image data, and the output data is the generated text data.

[0989] Step 5:

[0990] The server analyzes the generated text data and checks for specific keywords to determine whether it is a phishing site. For example, it checks whether the text data contains keywords such as "login" or "password." The input data is the text data, and the output data is the phishing site determination result (true / false).

[0991] Step 6:

[0992] The server uses an emotion engine to recognize the user's emotional state and analyzes the user's facial expressions and voice. This analysis uses data collected from the user's camera and microphone. The input data is the user's facial expressions and voice data, and the output data is emotional information (e.g., surprise, fear, relief, etc.).

[0993] Step 7:

[0994] The server adjusts the warning message based on the phishing site detection result and the user's emotional information, and sends it to the terminal in the optimal format. Specifically, it adjusts the urgency and expression method according to the emotional information. The input data are the phishing site detection result and the user's emotional information, and the output data is the adjusted warning message.

[0995] Step 8:

[0996] The terminal analyzes the tailored warning message received from the server and displays it to the user in an appropriate format, such as a pop-up message or a sound notification. The input data is the warning message from the server, and the output data is the displayed warning message.

[0997] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0998] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0999] In the above embodiment, an example in which the specific processing is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the smart glasses 214.

[1000] [Third embodiment]

[1001] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[1002] 5, the data processing system 310 includes the data processing device 12 and a headset type terminal 314. An example of the data processing device 12 is a server.

[1003] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[1004] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[1005] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[1006] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[1007] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[1008] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[1009] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[1010] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[1011] In the headset type terminal 314, a reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[1012] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the headset type terminal 314 will be referred to as the "terminal."

[1013] The present invention relates to a system for detecting phishing sites that are composed only of images with high accuracy. Specific embodiments of the system will be described below.

[1014] Overall system configuration

[1015] This system consists of three main components: a server, a terminal, and a user. The server receives the website URL sent by the user, acquires image data, converts it to text data, and identifies phishing sites. The terminal provides an interface that receives input from the user and sends it to the server. The user checks for suspicious websites through this terminal.

[1016] Server Processing

[1017] The server performs the following process:

[1018] 1. Image Data Acquisition:

[1019] The server receives the website URL sent from the device, accesses this URL, and downloads the image on the web page. The image is retrieved using an HTTP request.

[1020] 2. Convert image data to text data:

[1021] The server converts the captured image into text data by inputting it into an image2text model (e.g., a specialized AI algorithm). This process extracts the textual information in the image and outputs it as formatted text.

[1022] 3. Phishing site identification:

[1023] The generated text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and based on these keywords, it determines whether the website is a phishing site.

[1024] 4. Output of judgment result:

[1025] The results are formatted as JSON data and sent back to the device. This includes a process to display the results in a format that is easy for the user to understand.

[1026] Terminal handling

[1027] The terminal performs the following process:

[1028] 1. URL input acceptance:

[1029] The terminal provides an interface for accepting the URL of a website entered by the user, which may be a web browser, a dedicated application, or a GUI.

[1030] 2. Send URL:

[1031] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[1032] 3. Receiving and displaying results:

[1033] The terminal receives the judgment results from the server and displays them to the user in a variety of formats, including warning messages, alerts, and detailed analysis results.

[1034] User operations

[1035] The user performs the following operations:

[1036] 1. Enter the URL:

[1037] The user enters the URL of the suspicious website using the interface provided by the terminal.

[1038] 2. Check the results:

[1039] Users can check the results displayed on their device and take appropriate action if necessary regarding suspected phishing websites, such as avoiding the site or reporting it to their security department.

[1040] Specific examples

[1041] For example, if a user wants to check the security of a bank's login page, the process would be as follows:

[1042] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[1043] 2. The terminal generates and sends a request to the server for the entered URL.

[1044] 3. The server receives the URL, visits the page and downloads the image.

[1045] 4. The server converts the downloaded image into an image2text model and generates text data (e.g., "Please log in").

[1046] 5. The server analyzes the generated text to see if it contains keywords associated with phishing sites.

[1047] 6. The server determines that the site is likely to be a phishing site and returns the result to the device.

[1048] 7. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[1049] This allows users to instantly confirm the safety of suspicious websites.Compared to conventional text-based phishing site detection methods, this invention makes it possible to detect phishing sites that consist only of images with high accuracy.

[1050] The processing flow will be explained below.

[1051] Step 1:

[1052] The user enters the URL of a suspicious website into the terminal and presses the check button.

[1053] Step 2:

[1054] The terminal generates an HTTP request to send the input URL.

[1055] Step 3:

[1056] The terminal sends the generated HTTP request to the server.

[1057] Step 4:

[1058] The server receives the URL sent from the terminal.

[1059] Step 5:

[1060] The server accesses the received URL and downloads the image data from the page, using an HTTP request.

[1061] Step 6:

[1062] The server stores the downloaded image data in its memory.

[1063] Step 7:

[1064] The server initializes the image2text model to convert image data to text data, using a generative model to extract text information from the image.

[1065] Step 8:

[1066] The server analyzes the generated text data and checks whether it contains certain keywords associated with phishing sites (e.g., "login," "password," "verification").

[1067] Step 9:

[1068] The server determines whether the site is a phishing site based on whether it contains the keywords.

[1069] Step 10:

[1070] The server formats the results into JSON format data.

[1071] Step 11:

[1072] The server returns the generated JSON formatted data to the terminal.

[1073] Step 12:

[1074] The terminal analyzes the JSON formatted judgment result received from the server.

[1075] Step 13:

[1076] Based on the analysis results, the device displays a judgment result to the user, such as "This site may be a phishing site" or "This site is safe."

[1077] This allows users to quickly verify the safety of suspicious sites.

[1078] Example 1

[1079] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1080] In recent years, fraudulent activities via phishing sites have been increasing on the Internet. In particular, phishing sites that consist only of images are difficult to detect using conventional text-based detection algorithms. Therefore, there is a need for a highly accurate method for detecting phishing sites using image data.

[1081] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[1082] In this invention, the server includes means for receiving a website URL and acquiring the webpage content, means for downloading image data from the acquired webpage, means for converting the downloaded image data into text data using a generative model, means for analyzing specific keywords based on the text data and determining whether the website is a phishing site, and means for formatting and outputting the determination result in JSON format, thereby enabling rapid detection of phishing sites consisting only of images with high accuracy.

[1083] A "website URL" is a string of characters that identifies and accesses a particular web page that a user wants to access.

[1084] "Web page content" means all data, including HTML, images, style sheets, scripts, etc., of a website retrieved by a specified URL.

[1085] "Image data" refers to data files that represent visual information contained in web page content and are saved in formats such as JPEG and PNG.

[1086] A "generative model" is an artificial intelligence algorithm that generates a specific output based on input data, in this case generating text data from image data.

[1087] "Text data" is data that represents character information extracted from image data by a generative model.

[1088] "Specific keywords" are predefined significant words or phrases used to identify phishing sites.

[1089] "Analysis" is the process of examining data in detail and extracting specific information or patterns.

[1090] "Decision" is the act of determining whether a certain condition is met based on the results of data analysis.

[1091] "JSON format" stands for JavaScript Object Notation, a lightweight format for organizing data and easily exchanging it.

[1092] "Output" refers to the act of providing the results of processing by a system to a user or another system.

[1093] MODE FOR CARRYING OUT THE INVENTION

[1094] The present invention relates to a system for detecting phishing sites that are composed only of image data with high accuracy. A specific embodiment of this system will be described below.

[1095] Overall system configuration

[1096] This system consists of three main components: a server, a terminal, and a user. The server receives the website URL sent by the user, acquires image data, converts it to text data, and identifies phishing sites. The terminal provides an interface that receives input from the user and sends it to the server. The user checks for suspicious websites through this terminal.

[1097] Server Processing

[1098] The server uses the following main software and libraries: the requests library for HTTP requests, BeautifulSoup for HTML parsing, and generative models (e.g., Tesseract OCR) for processing image data.

[1099] The server receives the URL sent by the user from the device and accesses the specified web page. It downloads image data from the retrieved web page and converts the image data into text data using a generative model. It then analyzes specific keywords based on the text data to determine whether it is a phishing site. It then formats the result of this determination into JSON format and sends it to the device.

[1100] Terminal handling

[1101] The terminal provides an interface for accepting website URLs entered by the user. This interface may consist of a web browser, a dedicated application, or a GUI. When the user enters a URL and presses the send button, the terminal generates and sends an HTTP request to send the URL to the server. The terminal receives the judgment results returned from the server and displays them on the screen in a format that is easy for the user to understand.

[1102] User operations

[1103] The user enters the URL of a suspicious website using the device interface, and when the results are displayed on the device, the user can review the results and take necessary action, such as avoiding the site if it is likely a phishing site or reporting it to the security department.

[1104] Specific examples

[1105] Specific examples are shown below.

[1106] If a user wants to check the security of their bank's login page, the following steps will be taken:

[1107] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[1108] 2. The terminal generates and sends a request to the server for the entered URL.

[1109] 3. The server receives the URL, visits the page and downloads the image.

[1110] 4. The server inputs the downloaded images into a generative model to generate text data.

[1111] 5. The server analyzes the generated text data to see if it contains specific keywords associated with phishing sites.

[1112] 6. The server determines that the site is likely to be a phishing site and returns the result to the device.

[1113] 7. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[1114] Examples of prompts are:

[1115] Enter your website URL (e.g. https: / / example-bank.com / login):

[1116] Using this prompt sentence makes it easier for the user to input, and it is expected that the system will operate efficiently.

[1117] The flow of the identification process in the first embodiment will be described with reference to FIG.

[1118] Step 1:

[1119] Receiving URLs

[1120] The server receives the HTTP request sent from the device. This request includes the URL of the website entered by the user. The server saves the received URL in a variable.

[1121] Input: The website URL entered by the user

[1122] Output: Saved URL

[1123] Specific behavior:

[1124] The server listens for HTTP requests, extracts the URL from the request body, and saves it.

[1125] Step 2:

[1126] Web page access

[1127] The server sends an HTTP GET request to the stored URL to retrieve the web page content, including the web page's HTML, images, stylesheets, scripts, etc.

[1128] Input: Saved URL

[1129] Output: Retrieved web page content (HTML, etc.)

[1130] Specific behavior:

[1131] Use the requests library to send a GET request to the specified URL.

[1132] Get the web page content from the response and save it in a variable.

[1133] Step 3:

[1134] Image data acquisition

[1135] The server analyzes the HTML of the retrieved web page and extracts the image data. Find the tag, get the image URL from its src attribute, and download the image data.

[1136] Input: HTML content of a web page

[1137] Output: Downloaded image data

[1138] Specific behavior:

[1139] Use BeautifulSoup to parse the HTML of a web page, Find the tag.

[1140] A GET request is sent to each image URL, and the image data is downloaded and saved.

[1141] Step 4:

[1142] Image data conversion

[1143] The server inputs the downloaded image data into a generative AI model (e.g., Tesseract OCR) to extract text data from the image.

[1144] Input: Downloaded image data

[1145] Output: Generated text data

[1146] Specific behavior:

[1147] Load the image data into a generative AI model (such as Tesseract OCR).

[1148] The model extracts text information from the image and saves it as text data.

[1149] Step 5:

[1150] Keyword Analysis

[1151] The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login", "password", "verification").

[1152] Input: Generated text data

[1153] Output: Keyword analysis results (phishing detection)

[1154] Specific behavior:

[1155] Based on a predefined keyword list, the frequency of keyword occurrence within text data is checked.

[1156] Calculate the keyword match rate and determine whether it exceeds a threshold.

[1157] Step 6:

[1158] Formatting and sending results

[1159] The server formats the results of the keyword analysis into JSON format and sends it to the terminal as an HTTP response.

[1160] Input: Keyword analysis results

[1161] Output: JSON format result

[1162] Specific behavior:

[1163] The result of the judgment is converted into a JSON object and sent to the terminal as an HTTP response.

[1164] Step 7:

[1165] URL input acceptance

[1166] The terminal provides an interface that accepts the URL of a website entered by the user. This interface may consist of a web browser, a dedicated application, a GUI, or the like.

[1167] Input: The URL entered by the user

[1168] Output: URL input from user

[1169] Specific behavior:

[1170] It displays an input field in an HTML form or dedicated application, allowing the user to enter a URL.

[1171] Step 8:

[1172] Send URL

[1173] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[1174] Input: The URL entered by the user

[1175] Output: HTTP request to the server

[1176] Specific behavior:

[1177] It takes data from form inputs and generates an HTTP POST request to send to the server.

[1178] Step 9:

[1179] Receive results

[1180] The terminal receives the determination result from the server.

[1181] Input: HTTP response from the server

[1182] Output: Received judgment result (JSON)

[1183] Specific behavior:

[1184] Receives an HTTP response and extracts JSON data from the response body.

[1185] Step 10:

[1186] Results display

[1187] The terminal displays the received judgment results to the user in the form of warning messages, alerts, detailed analysis results, etc.

[1188] Input: Received judgment result (JSON)

[1189] Output: Displaying the results to the user

[1190] Specific behavior:

[1191] Analyze the JSON data and display a message based on the results on the screen.

[1192] Step 11:

[1193] URL input

[1194] The user enters the URL of a suspicious website using the interface provided by the device.

[1195] Input: The URL entered by the user

[1196] Output: URL input to terminal

[1197] Specific behavior:

[1198] Enter the target URL into the URL input field on your browser or application and press the send button.

[1199] Step 12:

[1200] Check the results

[1201] The user checks the results displayed on the terminal and takes the necessary action.

[1202] Input: Judgment result displayed on the device

[1203] Output: User action (e.g. avoid site, report)

[1204] Specific behavior:

[1205] View the phishing detection results displayed on your device and take appropriate action based on the results.

[1206] (Application example 1)

[1207] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1208] Phishing sites that consist only of images are difficult to detect using conventional text-based phishing site detection methods, and users remain vulnerable to these phishing sites. Therefore, there is a need for a system that can analyze image data to detect phishing sites with high accuracy. There is also a need for a system that allows users to receive phishing site warnings in real time.

[1209] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[1210] In this invention, the server includes means for acquiring image data, means for converting the image data into text data, means for determining whether a website is a phishing site based on the text data, and means for notifying the terminal of the determination result in real time, thereby enabling phishing sites consisting only of images to be detected with high accuracy and enabling users to receive warnings about phishing sites in real time.

[1211] "Image data" is data in digital format that contains visual information displayed on a web page.

[1212] "Text data" is data in a digital format that contains textual information extracted from image data.

[1213] A "phishing site" is a fake website created with the purpose of fraudulently obtaining users' personal information and authentication information.

[1214] A "terminal" is a device used by a user, such as a smartphone or computer, through which a website is accessed.

[1215] "Real-time notification" is a function that instantly reports the results of a phishing site detection to the user.

[1216] A "generative model" is a system that uses machine learning and artificial intelligence algorithms to analyze image data and generate text data.

[1217] "Keywords" are specific words or phrases used to identify phishing sites.

[1218] The "judgment result" is the analysis result of whether the website is a phishing site.

[1219] The present invention relates to a system for detecting phishing sites that are composed only of images with high accuracy. Specific embodiments of the system will be described below.

[1220] Overall system configuration

[1221] This system consists of three main components: a server, a terminal, and a user. The server receives the website URL sent by the user, acquires image data, converts it to text data, and identifies phishing sites. The terminal provides an interface that receives input from the user and sends it to the server. The user checks for suspicious websites through this terminal.

[1222] Server Processing

[1223] Obtaining image data: The server receives the website URL sent from the device. It accesses this URL and downloads the image on the web page. In this process, it obtains the image data using an HTTP request.

[1224] Converting image data to text data: The server inputs the acquired image data into a generative AI model (e.g., a machine learning algorithm) to convert the image into text data. This process extracts textual information from the image and outputs it as formatted text. Specifically, PIL (Python Imaging Library) and Pytesseract are used.

[1225] Phishing site identification: The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login", "password", "verification", "login"). Based on these keywords, it determines whether the website is a phishing site.

[1226] Notification of judgment results: The server formats the judgment results as JSON data and sends them to the terminal in real time. This includes a process to display the results in a format that is easy for the user to understand.

[1227] Terminal handling

[1228] URL input acceptance: The terminal provides an interface for accepting website URLs entered by the user. This interface can be a web browser, a dedicated application, or a GUI.

[1229] Sending URL: The terminal generates and sends an HTTP request to send the entered URL to the server.

[1230] Receiving and displaying results: The terminal receives the judgment results from the server and displays them to the user in real time. The display format can vary, including warning messages, alerts, and detailed analysis results.

[1231] User operations

[1232] Entering a URL: The user enters the URL of a suspicious website using the interface provided by the device.

[1233] Review the results: Users review the results displayed on their device and take appropriate action regarding suspected phishing websites, if necessary, such as avoiding the site or reporting it to their security department.

[1234] Specific examples

[1235] For example, if a user wants to check the security of a bank's login page, the process would be as follows:

[1236] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[1237] 2. The device generates and sends a request to send the URL to the server.

[1238] 3. The server receives the URL, visits the page, and downloads the image.

[1239] 4. The server inputs the downloaded image into a generative AI model (e.g., Pytesseract) to generate text data (e.g., "Please log in").

[1240] 5. The server analyzes the generated text to see if it contains keywords related to phishing sites.

[1241] 6. The server determines that the site is likely to be a phishing site and notifies the device of the result in real time.

[1242] 7. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[1243] Prompt Sentence Examples

[1244] Check out http: / / example.com / suspicious_site.

[1245] This allows users to instantly confirm the safety of suspicious websites.Compared to conventional text-based phishing site detection methods, this invention makes it possible to detect phishing sites that consist only of images with high accuracy.

[1246] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[1247] Step 1:

[1248] URL input reception (terminal)

[1249] The user inputs the URL of a website into the terminal interface, which can be a web browser, a dedicated application, or a GUI. When the user inputs the URL and presses the check button, the terminal receives this information and obtains the input data (URL) to proceed to the next processing step.

[1250] Step 2:

[1251] Send URL (device)

[1252] The device receives the URL entered by the user and sends it to the server as an HTTP request. This request includes the URL to be verified and serves as input data for the server to retrieve web page information. After sending the request, the device waits for a response from the server.

[1253] Step 3:

[1254] Acquisition of image data (server)

[1255] The server accesses the web page based on the URL received from the terminal. It uses an HTTP request to download the image data of the web page and obtains the image data. The obtained image data is the input data to be converted to text data in the next step.

[1256] Step 4:

[1257] Convert image data to text data (server)

[1258] The server inputs the acquired image data into a generative AI model (e.g., Pytesseract), extracts text information from the image, and generates text data. This process formats the image data as text data, which becomes input data for phishing site detection in the next step.

[1259] Step 5:

[1260] Phishing site detection (server)

[1261] The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login," "password," "verification," "login"). Based on these keywords, it determines whether the website is a phishing site. The determination result (whether it is likely to be a phishing site or not) is output data that is notified to the terminal in the next step.

[1262] Step 6:

[1263] Notification of judgment results (server)

[1264] The server formats the phishing site detection results as JSON data and sends them to the device in real time. This notification contains information about the possibility that the website is a phishing site. The notified detection results become input data for display on the device.

[1265] Step 7:

[1266] Receiving and displaying results (terminal)

[1267] The device analyzes the phishing site detection results received from the server and displays them to the user in real time. Specifically, the results are displayed as warning messages, alerts, or detailed analysis results. This display allows the user to confirm the safety of the website and take appropriate action if necessary.

[1268] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[1269] The present invention is a system that converts image data into text data to detect phishing sites, and combines it with an emotion engine that recognizes user emotions. Specific embodiments of this system are described below.

[1270] Overall system configuration

[1271] This system consists of three main components: a server, a terminal, and a user. The server receives website URLs sent by users, acquires image data, converts it to text data, determines whether the website is a phishing site, and displays the results based on the user's sentiment. The terminal provides an interface that receives input from users and sends it to the server. Users check suspicious websites through this terminal.

[1272] Server Processing

[1273] The server performs the following process:

[1274] 1. Image Data Acquisition:

[1275] The server receives the website URL sent from the device, accesses this URL, and downloads the image data on the web page. The image is retrieved using an HTTP request.

[1276] 2. Convert image data to text data:

[1277] The server inputs the acquired image data into the image2text model to convert the image into text data. This process extracts the textual information in the image and outputs it as formatted text.

[1278] 3. Phishing site identification:

[1279] The generated text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and based on these keywords, it determines whether the website is a phishing site.

[1280] 4. Recognizing user emotions with the emotion engine:

[1281] The server uses an emotion engine that recognizes the user's emotions and collects emotional information from the user's facial expressions and voice. The server analyzes this emotional information and adjusts the display method to make the site information more easily accepted by the user.

[1282] 5. Output of judgment result:

[1283] The judgment results are formatted as JSON data and returned to the device, including warning messages and display methods adjusted based on the user's emotions.

[1284] Terminal handling

[1285] The terminal performs the following process:

[1286] 1. URL input acceptance:

[1287] The terminal provides an interface for accepting the URL of a website entered by the user, which may be a web browser, a dedicated application, or a GUI.

[1288] 2. Send URL:

[1289] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[1290] 3. Collecting Emotional Data:

[1291] The device uses the user's camera and microphone to capture the user's facial expressions and voice, and sends this data to the server.

[1292] 4. Receiving and displaying results:

[1293] The device analyzes the JSON formatted judgment result received from the server and displays the judgment result to the user based on the adjusted warning message and display method.

[1294] User operations

[1295] The user performs the following operations:

[1296] 1. Enter the URL:

[1297] The user enters the URL of the suspicious website using the interface provided by the terminal.

[1298] 2. Providing Emotion Data:

[1299] Users provide emotional data using their device's camera and microphone, and this operation is usually done automatically.

[1300] 3. Check the results:

[1301] Users can check the results and warning messages displayed on their devices and take appropriate action if necessary regarding suspected phishing websites, such as avoiding the site or reporting it to the security department.

[1302] Specific examples

[1303] For example, if a user wants to check the security of a bank's login page, the process would be as follows:

[1304] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[1305] 2. The terminal generates and sends a request to the server for the entered URL.

[1306] 3. The device uses a camera and microphone to collect the user's facial expressions and voice data and send it to the server.

[1307] 4. The server receives the URL, visits the page and downloads the image.

[1308] 5. The server converts the downloaded image into an image2text model and generates text data (e.g., "Please log in").

[1309] 6. The server analyzes the generated text to see if it contains keywords associated with phishing sites.

[1310] 7. The server uses an emotion engine to recognize the user's emotions and determines the warning message and display method according to the user's state.

[1311] 8. The server returns JSON format data containing the judgment result and the adjusted display method to the terminal.

[1312] 9. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[1313] This allows users to confirm the safety of the site and receive the results in an interface that suits their emotional state.The present invention not only improves the accuracy of phishing site detection, but also improves the user experience.

[1314] The processing flow will be explained below.

[1315] Step 1:

[1316] The user enters the URL of a suspicious website into the terminal and presses the check button.

[1317] Step 2:

[1318] The terminal generates an HTTP request to send the input URL.

[1319] Step 3:

[1320] The terminal sends the generated HTTP request to the server.

[1321] Step 4:

[1322] The device uses the user's camera and microphone to collect facial and voice data.

[1323] Step 5:

[1324] The device sends the collected facial expression and voice data to a server.

[1325] Step 6:

[1326] The server receives the URL sent from the terminal.

[1327] Step 7:

[1328] The server accesses the received URL and downloads the image data from the web page, for example, by using an HTTP request to retrieve the image.

[1329] Step 8:

[1330] The server stores the downloaded image data in its memory.

[1331] Step 9:

[1332] The server initializes the image2text model and converts the image data into text data. In this process, it uses a machine learning model to extract text information from the image and output it as text data.

[1333] Step 10:

[1334] The server analyzes the generated text data and checks whether it contains certain keywords associated with phishing sites (e.g., "login," "password," "verification").

[1335] Step 11:

[1336] The server determines whether the website is a phishing site based on whether the keyword is included.

[1337] Step 12:

[1338] The server uses an emotion engine to analyze the facial expression and voice data sent to it in order to analyze the user's emotions.

[1339] Step 13:

[1340] The server identifies the user's emotional state based on the analysis results of the emotion engine, such as impatience, anxiety, or relief.

[1341] Step 14:

[1342] The server adjusts the way the phishing site detection results are displayed and the content of the warning message according to the user's emotional state recognized by the emotion engine.

[1343] Step 15:

[1344] The server returns JSON format data containing the adjusted judgment results to the terminal.

[1345] Step 16:

[1346] The terminal analyzes the JSON formatted judgment result received from the server.

[1347] Step 17:

[1348] Based on the analysis results, the device displays the phishing site determination results to the user with a warning message and display method that is tailored to the user. For example, it may display a message saying "This site may be a phishing site" and change the color and font depending on the user's feelings.

[1349] In this way, users can quickly check the safety of suspicious sites and receive the results in an interface that suits their emotional state.

[1350] Example 2

[1351] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1352] In modern society, the proliferation of phishing sites has increased the risk of users accessing malicious websites and losing personal information and assets. Conventional phishing site detection systems have limitations in the accuracy of converting image data into text and identifying phishing sites. Furthermore, they are unable to provide appropriate warnings that take into account the user's emotional state. This can impair the user experience, creating a need for improved safety. Furthermore, there is a need to minimize the impact on users by generating warning messages that reflect the user's emotional state, in addition to identifying phishing sites.

[1353] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for acquiring image data, means for converting the image data into text data, means for determining whether a website is a phishing site based on the text data, means for analyzing the user's emotional data and generating a warning message based on the emotional state, and means for outputting the determination result and the warning message. This makes it possible to detect phishing sites with high accuracy and provide an appropriate warning message according to the user's emotional state.

[1354] "Image data" refers to visual information obtained from a web page, including photographs, diagrams, graphs, and other image information stored in digital format.

[1355] "Text data" is image data converted into character information, and is data that includes readable characters and text information.

[1356] A "phishing site" is a fake web page created by a malicious third party to look like a legitimate site in order to fraudulently obtain users' personal information and authentication information.

[1357] "Emotion data" is information that represents the user's emotional state, and is data collected from the user's facial expressions, voice, actions, and the like.

[1358] "Emotion engine" refers to software or hardware technology for analyzing emotion data and recognizing a user's emotional state.

[1359] A "warning message" is a message that warns users about the risks of phishing sites, and is a statement intended to inform users of the dangers.

[1360] The "determination result" is a result indicating whether or not a website is a phishing site based on an analysis of image data and text data.

[1361] A "generative model" refers to an algorithm or machine learning model that uses AI technology to generate text data from image data.

[1362] The present invention is a system that combines a system that converts image data into text data to detect phishing sites with an emotion engine that recognizes user emotions. Specific embodiments of this system are described below.

[1363] Overall system configuration

[1364] This system consists of three main components: a server, a terminal, and a user. The server receives website URLs, acquires image data, converts it to text data, determines whether the website is a phishing site, and displays the results based on the user's sentiment. The terminal provides an interface that receives input from the user and sends it to the server. The user checks suspicious websites through this terminal.

[1365] Hardware and Software Configuration

[1366] The server uses the following hardware and software:

[1367] A network interface for sending and receiving HTTP requests

[1368] Analyzing web pages with an HTML parser (e.g. BeautifulSoup)

[1369] HTTP client for downloading image data

[1370] Image2Text model for extracting text from images (OCR technology)

[1371] Keyword search and machine learning models to analyze text data and identify phishing sites

[1372] An emotion engine (e.g., OpenCV, Google Speech-to-Text API) that analyzes user emotions

[1373] A software stack for sending and receiving data in JSON format

[1374] The hardware and software used by the device:

[1375] An interface (web browser, dedicated application, or GUI) that allows users to enter URLs

[1376] A device that uses a camera and microphone to capture a user's facial expressions and voice

[1377] A network interface for generating and sending HTTP requests to a server

[1378] a display and display software for displaying the judgment results received from the server;

[1379] User Action:

[1380] Enter the URL of the suspicious website

[1381] Use your device's camera and microphone to provide emotional data

[1382] Check the judgment results and warning messages displayed on the device and take necessary action.

[1383] What the program does

[1384] The server receives the website URL sent from the device and accesses this URL to retrieve the image data on the webpage. The image data is downloaded using an HTTP request and then analyzed for image tags in the webpage using an HTML parser. The image data is then input into the image2text model, which converts the image into text data. This text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and a machine learning model is used to identify phishing sites.

[1385] Furthermore, the server receives the user's emotional data sent from the device and inputs it into the emotion engine. The emotion engine analyzes the user's facial expressions and voice to detect their emotional state. Based on the detected emotion, the server generates a warning message in a format that is easy for the user to accept, in conjunction with the phishing site judgment result. The generated warning message and judgment result are sent to the device in JSON format.

[1386] The device analyzes the received JSON format data and displays it appropriately to the user. Specifically, it organizes warning messages and judgment results so that the user can understand them immediately, and displays them on the screen.

[1387] Users should check the results displayed and take appropriate action if they suspect phishing, such as avoiding the site or reporting it to the security department.

[1388] Specific examples

[1389] For example, if a user wants to check the security of their bank's login page, they might do the following:

[1390] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[1391] 2. The device generates and sends a request to the server for the entered URL, and simultaneously collects the user's facial expression and voice data using the camera and microphone and sends them to the server.

[1392] 3. The server receives the URL, visits the page, and downloads the image.

[1393] 4. The server converts the downloaded image into an image2text model and generates text data (e.g., "Please log in").

[1394] 5. The server analyzes the generated text data, checks whether it contains specific keywords, and uses a machine learning model to identify phishing sites.

[1395] 6. The server uses an emotion engine to analyze the user's facial expressions and voice data and recognize the user's emotional state.

[1396] 7. The server generates an appropriate warning message based on the emotion data and the phishing judgment result. This message and the judgment result are sent to the device in JSON format.

[1397] 8. The device analyzes the received data and displays a warning message to the user saying, "This site may be a phishing site."

[1398] Examples of prompt statements

[1399] Below are some example prompts to input to a generative AI model:

[1400] "Enter the bank login page URL 'https: / / example-bank.com / login' into your phishing detection system to verify its safety. Also, generate a warning message that reflects the user's emotional state."

[1401] In this way, the phishing site detection system according to the present invention provides appropriate warnings according to the user's emotional state, and achieves highly accurate detection of phishing sites.

[1402] The flow of the identification process in the second embodiment will be described with reference to FIG.

[1403] Step 1:

[1404] The server receives the URL from the terminal. The server receives the HTTP request and obtains the website URL in the request body. Input: Website URL from the terminal. Output: Obtained website URL in the server.

[1405] Step 2:

[1406] The server retrieves the image data of a web page. The server makes an HTTP request to the retrieved URL and downloads the HTML of the web page. Next, it uses an HTML parser (e.g. BeautifulSoup) to analyze the image tags in the web page and create a list of image URLs. It then sends an HTTP request to each image URL in the list to retrieve the image data. Input: Website URL. Output: Web page image data.

[1407] Step 3:

[1408] The server converts image data into text data. The server inputs the acquired image data into the image2text model to extract the text information in the image. In this process, OCR technology is used to convert the image data into text format. Input: Image data. Output: Text data.

[1409] Step 4:

[1410] The server identifies phishing sites. The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login," "password," "verification"). It also uses a machine learning model to score the likelihood of a phishing site from the text features and determines whether it exceeds a certain threshold. Input: Text data. Output: Phishing site identification result.

[1411] Step 5:

[1412] The server analyzes the emotion data using an emotion engine. The server receives the user's facial expression and voice data sent from the device and inputs it into the emotion engine. The emotion engine analyzes this data and detects the user's emotional state. For example, facial expressions are analyzed using facial recognition technology (e.g., OpenCV) and emotions are inferred using voice recognition (e.g., Google Speech-to-Text API). Input: User's facial expression data, voice data. Output: User's emotional state.

[1413] Step 6:

[1414] The server generates a result based on the judgment result and emotional data. The server creates an appropriate warning message based on the phishing site judgment result and the user's emotional data. For example, if the user is surprised, it generates a warning message such as "Caution! This site may be phishing." Input: phishing site judgment result, user's emotional state. Output: Result including the adjusted warning message.

[1415] Step 7:

[1416] The server sends the results to the terminal. The server formats the generated warning message and phishing site judgment results in JSON format and sends them to the terminal as an HTTP response. Input: Warning message, phishing site judgment results. Output: JSON format response to the terminal.

[1417] Step 8:

[1418] The terminal displays the results. The terminal analyzes the received JSON format data and displays it appropriately to the user. Specifically, it displays warning messages and judgment results appropriately on a GUI (graphical user interface) and organizes the information so that the user can understand it immediately. Input: JSON format response from the server. Output: Content displayed to the user.

[1419] Step 9:

[1420] The user checks the results and takes the necessary action. The user checks the displayed results and takes appropriate action, such as not using the site or reporting it to the security department, if they suspect phishing. They also take action based on the response message that is based on emotional data. Input: Displayed results on the device. Output: User's response action.

[1421] (Application example 2)

[1422] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1423] Conventional phishing site detection systems only display warnings for significant risks, and often issue warnings without considering the user's emotional state. This reduces the effectiveness of the warning and poses the risk of users taking the wrong action. Another issue is that it is difficult to accurately identify phishing sites using simple keyword extraction alone.

[1424] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for acquiring image data, means for converting the image data into text data, means for determining whether a website is a phishing site based on the text data, means for recognizing the user's emotions, and means for adjusting and outputting the determination result based on the emotions. This makes it possible to provide an appropriate warning according to the user's emotional state, significantly improving the accuracy of phishing site detection and the user experience.

[1425] The "means for acquiring image data" is a function for collecting image data from web pages on the Internet or screenshots provided by users.

[1426] "Means for converting image data into text data" refers to a function for converting character information in an image into text data using optical character recognition technology or a generative AI model.

[1427] The "means for determining whether a website is a phishing site based on text data" is a function for determining whether a website is a phishing site by analyzing the generated text data and detecting specific keywords or patterns.

[1428] The "means for recognizing the user's emotions" is a function for collecting the user's facial expressions and voice through a camera or microphone, and analyzing this to determine the user's emotional state.

[1429] The "means for adjusting and outputting the judgment result based on emotion" is a function for adjusting the judgment result of a phishing site according to the user's emotional state and conveying it to the user in the most appropriate format.

[1430] A system for implementing the present invention has the following configuration: The system receives a website URL or screenshot entered by a user, and provides a function for determining its safety. The system also has a function for adjusting the display method of the results depending on the user's emotional state.

[1431] Overall system configuration

[1432] It consists of three main elements: the server, the terminal, and the user.

[1433] The server receives the website URL sent from the terminal, acquires the image data, converts it into text data, determines whether the site is a phishing site, and displays the results based on the user's sentiment.

[1434] The terminal provides an interface that receives input from the user and transmits it to the server.

[1435] The user checks suspicious websites through this terminal.

[1436] Server Processing

[1437] The server performs the following process:

[1438] 1. Image Data Acquisition:

[1439] The server receives the website URL sent from the device, accesses this URL, and downloads the image data on the web page. The image is retrieved using an HTTP request.

[1440] 2. Convert image data to text data:

[1441] The server inputs the acquired image data into a generative AI model to convert the image into text data, a process that extracts textual information from the image and outputs it as formatted text.

[1442] 3. Phishing site identification:

[1443] The generated text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and based on these keywords, it determines whether the website is a phishing site.

[1444] 4. Recognizing user emotions with the emotion engine:

[1445] The server uses an emotion engine that recognizes the user's emotions and collects emotional information from the user's facial expressions and voice. The server analyzes this emotional information and adjusts the display method to make the site information more easily accepted by the user.

[1446] 5. Output of judgment result:

[1447] The judgment results are formatted as JSON data and returned to the device, including warning messages and display methods adjusted based on the user's emotions.

[1448] Terminal handling

[1449] The terminal performs the following process:

[1450] 1. URL input acceptance:

[1451] The terminal provides an interface for accepting the URL of a website entered by the user, which may be a web browser, a dedicated application, or a GUI.

[1452] 2. Send URL:

[1453] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[1454] 3. Collecting Emotional Data:

[1455] The device uses the user's camera and microphone to capture the user's facial expressions and voice, and sends this data to the server.

[1456] 4. Receiving and displaying results:

[1457] The device analyzes the JSON formatted judgment result received from the server and displays the judgment result to the user based on the adjusted warning message and display method.

[1458] User operations

[1459] The user performs the following operations:

[1460] 1. Enter the URL:

[1461] The user enters the URL of the suspicious website using the interface provided by the terminal.

[1462] 2. Providing Emotion Data:

[1463] Users provide emotional data using their device's camera and microphone, and this operation is usually done automatically.

[1464] 3. Check the results:

[1465] Users can check the results and warning messages displayed on their devices and take appropriate action if necessary regarding websites suspected of phishing.

[1466] Specific examples

[1467] When a user wants to check the safety of a payment page on an online shopping site, they enter the URL into the app, which determines whether the site is phishing and, if the user is nervous, displays a high-urgency warning message.

[1468] Prompt Sentence Examples

[1469] "Please analyze the following URL to determine if it is a phishing site: 'https: / / example-phishing-site.com'"

[1470] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[1471] Step 1:

[1472] The user enters the URL or screenshot of a suspicious website into the device. The device takes the URL or image file path entered by the user and prepares it to send to the server. The input data includes the URL in string format and the image file path. An HTTP request is generated as output.

[1473] Step 2:

[1474] The terminal sends the URL or image data obtained from the user to the server. Specifically, it creates and sends an HTTP request. The input data includes the URL string or image file. The output data is the result of sending the request to the server.

[1475] Step 3:

[1476] The server accesses the received URL and retrieves the image data on the web page. It uses an HTTP request to download the image from the web page. The input data includes the URL string. The output data is the downloaded image data.

[1477] Step 4:

[1478] The server converts the acquired image data into text data using a generative AI model. Specifically, it extracts character information from the image using optical character recognition (OCR) technology and generates it as formatted text data. The input data is image data, and the output data is the generated text data.

[1479] Step 5:

[1480] The server analyzes the generated text data and checks for specific keywords to determine whether it is a phishing site. For example, it checks whether the text data contains keywords such as "login" or "password." The input data is the text data, and the output data is the phishing site determination result (true / false).

[1481] Step 6:

[1482] The server uses an emotion engine to recognize the user's emotional state and analyzes the user's facial expressions and voice. This analysis uses data collected from the user's camera and microphone. The input data is the user's facial expressions and voice data, and the output data is emotional information (e.g., surprise, fear, relief, etc.).

[1483] Step 7:

[1484] The server adjusts the warning message based on the phishing site detection result and the user's emotional information, and sends it to the terminal in the optimal format. Specifically, it adjusts the urgency and expression method according to the emotional information. The input data are the phishing site detection result and the user's emotional information, and the output data is the adjusted warning message.

[1485] Step 8:

[1486] The terminal analyzes the tailored warning message received from the server and displays it to the user in an appropriate format, such as a pop-up message or a sound notification. The input data is the warning message from the server, and the output data is the displayed warning message.

[1487] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[1488] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1489] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the headset type terminal 314.

[1490] [Fourth embodiment]

[1491] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[1492] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[1493] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[1494] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[1495] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[1496] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[1497] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[1498] The control object 443 includes a display device, LEDs in the eyes, and motors for driving the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[1499] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[1500] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[1501] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[1502] In the robot 414, the processor 46 performs the reception output process. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[1503] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1504] The present invention relates to a system for detecting phishing sites that are composed only of images with high accuracy. Specific embodiments of the system will be described below.

[1505] Overall system configuration

[1506] This system consists of three main components: a server, a terminal, and a user. The server receives the website URL sent by the user, acquires image data, converts it to text data, and identifies phishing sites. The terminal provides an interface that receives input from the user and sends it to the server. The user checks for suspicious websites through this terminal.

[1507] Server Processing

[1508] The server performs the following process:

[1509] 1. Image Data Acquisition:

[1510] The server receives the website URL sent from the device, accesses this URL, and downloads the image on the web page. The image is retrieved using an HTTP request.

[1511] 2. Convert image data to text data:

[1512] The server converts the captured image into text data by inputting it into an image2text model (e.g., a specialized AI algorithm). This process extracts the textual information in the image and outputs it as formatted text.

[1513] 3. Phishing site identification:

[1514] The generated text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and based on these keywords, it determines whether the website is a phishing site.

[1515] 4. Output of judgment result:

[1516] The results are formatted as JSON data and sent back to the device. This includes a process to display the results in a format that is easy for the user to understand.

[1517] Terminal handling

[1518] The terminal performs the following process:

[1519] 1. URL input acceptance:

[1520] The terminal provides an interface for accepting the URL of a website entered by the user, which may be a web browser, a dedicated application, or a GUI.

[1521] 2. Send URL:

[1522] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[1523] 3. Receiving and displaying results:

[1524] The terminal receives the judgment results from the server and displays them to the user in a variety of formats, including warning messages, alerts, and detailed analysis results.

[1525] User operations

[1526] The user performs the following operations:

[1527] 1. Enter the URL:

[1528] The user enters the URL of the suspicious website using the interface provided by the terminal.

[1529] 2. Check the results:

[1530] Users can check the results displayed on their device and take appropriate action if necessary regarding suspected phishing websites, such as avoiding the site or reporting it to their security department.

[1531] Specific examples

[1532] For example, if a user wants to check the security of a bank's login page, the process would be as follows:

[1533] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[1534] 2. The terminal generates and sends a request to the server for the entered URL.

[1535] 3. The server receives the URL, visits the page and downloads the image.

[1536] 4. The server converts the downloaded image into an image2text model and generates text data (e.g., "Please log in").

[1537] 5. The server analyzes the generated text to see if it contains keywords associated with phishing sites.

[1538] 6. The server determines that the site is likely to be a phishing site and returns the result to the device.

[1539] 7. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[1540] This allows users to instantly confirm the safety of suspicious websites.Compared to conventional text-based phishing site detection methods, this invention makes it possible to detect phishing sites that consist only of images with high accuracy.

[1541] The processing flow will be explained below.

[1542] Step 1:

[1543] The user enters the URL of a suspicious website into the terminal and presses the check button.

[1544] Step 2:

[1545] The terminal generates an HTTP request to send the input URL.

[1546] Step 3:

[1547] The terminal sends the generated HTTP request to the server.

[1548] Step 4:

[1549] The server receives the URL sent from the terminal.

[1550] Step 5:

[1551] The server accesses the received URL and downloads the image data from the page, using an HTTP request.

[1552] Step 6:

[1553] The server stores the downloaded image data in its memory.

[1554] Step 7:

[1555] The server initializes the image2text model to convert image data to text data, using a generative model to extract text information from the image.

[1556] Step 8:

[1557] The server analyzes the generated text data and checks whether it contains certain keywords associated with phishing sites (e.g., "login," "password," "verification").

[1558] Step 9:

[1559] The server determines whether the site is a phishing site based on whether it contains the keywords.

[1560] Step 10:

[1561] The server formats the results into JSON format data.

[1562] Step 11:

[1563] The server returns the generated JSON formatted data to the terminal.

[1564] Step 12:

[1565] The terminal analyzes the JSON formatted judgment result received from the server.

[1566] Step 13:

[1567] Based on the analysis results, the device displays a judgment result to the user, such as "This site may be a phishing site" or "This site is safe."

[1568] This allows users to quickly verify the safety of suspicious sites.

[1569] Example 1

[1570] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1571] In recent years, fraudulent activities via phishing sites have been increasing on the Internet. In particular, phishing sites that consist only of images are difficult to detect using conventional text-based detection algorithms. Therefore, there is a need for a highly accurate method for detecting phishing sites using image data.

[1572] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[1573] In this invention, the server includes means for receiving a website URL and acquiring the webpage content, means for downloading image data from the acquired webpage, means for converting the downloaded image data into text data using a generative model, means for analyzing specific keywords based on the text data and determining whether the website is a phishing site, and means for formatting and outputting the determination result in JSON format, thereby enabling rapid detection of phishing sites consisting only of images with high accuracy.

[1574] A "website URL" is a string of characters that identifies and accesses a particular web page that a user wants to access.

[1575] "Web page content" means all data, including HTML, images, style sheets, scripts, etc., of a website retrieved by a specified URL.

[1576] "Image data" refers to data files that represent visual information contained in web page content and are saved in formats such as JPEG and PNG.

[1577] A "generative model" is an artificial intelligence algorithm that generates a specific output based on input data, in this case generating text data from image data.

[1578] "Text data" is data that represents character information extracted from image data by a generative model.

[1579] "Specific keywords" are predefined significant words or phrases used to identify phishing sites.

[1580] "Analysis" is the process of examining data in detail and extracting specific information or patterns.

[1581] "Decision" is the act of determining whether a certain condition is met based on the results of data analysis.

[1582] "JSON format" stands for JavaScript Object Notation, a lightweight format for organizing data and easily exchanging it.

[1583] "Output" refers to the act of providing the results of processing by a system to a user or another system.

[1584] MODE FOR CARRYING OUT THE INVENTION

[1585] The present invention relates to a system for detecting phishing sites that are composed only of image data with high accuracy. A specific embodiment of this system will be described below.

[1586] Overall system configuration

[1587] This system consists of three main components: a server, a terminal, and a user. The server receives the website URL sent by the user, acquires image data, converts it to text data, and identifies phishing sites. The terminal provides an interface that receives input from the user and sends it to the server. The user checks for suspicious websites through this terminal.

[1588] Server Processing

[1589] The server uses the following main software and libraries: the requests library for HTTP requests, BeautifulSoup for HTML parsing, and generative models (e.g., Tesseract OCR) for processing image data.

[1590] The server receives the URL sent by the user from the device and accesses the specified web page. It downloads image data from the retrieved web page and converts the image data into text data using a generative model. It then analyzes specific keywords based on the text data to determine whether it is a phishing site. It then formats the result of this determination into JSON format and sends it to the device.

[1591] Terminal handling

[1592] The terminal provides an interface for accepting website URLs entered by the user. This interface may consist of a web browser, a dedicated application, or a GUI. When the user enters a URL and presses the send button, the terminal generates and sends an HTTP request to send the URL to the server. The terminal receives the judgment results returned from the server and displays them on the screen in a format that is easy for the user to understand.

[1593] User operations

[1594] The user enters the URL of a suspicious website using the device interface, and when the results are displayed on the device, the user can review the results and take necessary action, such as avoiding the site if it is likely a phishing site or reporting it to the security department.

[1595] Specific examples

[1596] Specific examples are shown below.

[1597] If a user wants to check the security of their bank's login page, the following steps will be taken:

[1598] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[1599] 2. The terminal generates and sends a request to the server for the entered URL.

[1600] 3. The server receives the URL, visits the page and downloads the image.

[1601] 4. The server inputs the downloaded images into a generative model to generate text data.

[1602] 5. The server analyzes the generated text data to see if it contains specific keywords associated with phishing sites.

[1603] 6. The server determines that the site is likely to be a phishing site and returns the result to the device.

[1604] 7. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[1605] Examples of prompts are:

[1606] Enter your website URL (e.g. https: / / example-bank.com / login):

[1607] Using this prompt sentence makes it easier for the user to input, and it is expected that the system will operate efficiently.

[1608] The flow of the identification process in the first embodiment will be described with reference to FIG.

[1609] Step 1:

[1610] Receiving URLs

[1611] The server receives the HTTP request sent from the device. This request includes the URL of the website entered by the user. The server saves the received URL in a variable.

[1612] Input: The website URL entered by the user

[1613] Output: Saved URL

[1614] Specific behavior:

[1615] The server listens for HTTP requests, extracts the URL from the request body, and saves it.

[1616] Step 2:

[1617] Web page access

[1618] The server sends an HTTP GET request to the stored URL to retrieve the web page content, including the web page's HTML, images, stylesheets, scripts, etc.

[1619] Input: Saved URL

[1620] Output: Retrieved web page content (HTML, etc.)

[1621] Specific behavior:

[1622] Use the requests library to send a GET request to the specified URL.

[1623] Get the web page content from the response and save it in a variable.

[1624] Step 3:

[1625] Image data acquisition

[1626] The server analyzes the HTML of the retrieved web page and extracts the image data. Find the tag, get the image URL from its src attribute, and download the image data.

[1627] Input: HTML content of a web page

[1628] Output: Downloaded image data

[1629] Specific behavior:

[1630] Use BeautifulSoup to parse the HTML of a web page, Find the tag.

[1631] A GET request is sent to each image URL, and the image data is downloaded and saved.

[1632] Step 4:

[1633] Image data conversion

[1634] The server inputs the downloaded image data into a generative AI model (e.g., Tesseract OCR) to extract text data from the image.

[1635] Input: Downloaded image data

[1636] Output: Generated text data

[1637] Specific behavior:

[1638] Load the image data into a generative AI model (such as Tesseract OCR).

[1639] The model extracts text information from the image and saves it as text data.

[1640] Step 5:

[1641] Keyword Analysis

[1642] The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login", "password", "verification").

[1643] Input: Generated text data

[1644] Output: Keyword analysis results (phishing detection)

[1645] Specific behavior:

[1646] Based on a predefined keyword list, the frequency of keyword occurrence within text data is checked.

[1647] Calculate the keyword match rate and determine whether it exceeds a threshold.

[1648] Step 6:

[1649] Formatting and sending results

[1650] The server formats the results of the keyword analysis into JSON format and sends it to the terminal as an HTTP response.

[1651] Input: Keyword analysis results

[1652] Output: JSON format result

[1653] Specific behavior:

[1654] The result of the judgment is converted into a JSON object and sent to the terminal as an HTTP response.

[1655] Step 7:

[1656] URL input acceptance

[1657] The terminal provides an interface that accepts the URL of a website entered by the user. This interface may consist of a web browser, a dedicated application, a GUI, or the like.

[1658] Input: The URL entered by the user

[1659] Output: URL input from user

[1660] Specific behavior:

[1661] It displays an input field in an HTML form or dedicated application, allowing the user to enter a URL.

[1662] Step 8:

[1663] Send URL

[1664] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[1665] Input: The URL entered by the user

[1666] Output: HTTP request to the server

[1667] Specific behavior:

[1668] It takes data from form inputs and generates an HTTP POST request to send to the server.

[1669] Step 9:

[1670] Receive results

[1671] The terminal receives the determination result from the server.

[1672] Input: HTTP response from the server

[1673] Output: Received judgment result (JSON)

[1674] Specific behavior:

[1675] Receives an HTTP response and extracts JSON data from the response body.

[1676] Step 10:

[1677] Results display

[1678] The terminal displays the received judgment results to the user in the form of warning messages, alerts, detailed analysis results, etc.

[1679] Input: Received judgment result (JSON)

[1680] Output: Displaying the results to the user

[1681] Specific behavior:

[1682] Analyze the JSON data and display a message based on the results on the screen.

[1683] Step 11:

[1684] URL input

[1685] The user enters the URL of a suspicious website using the interface provided by the device.

[1686] Input: The URL entered by the user

[1687] Output: URL input to terminal

[1688] Specific behavior:

[1689] Enter the target URL into the URL input field on your browser or application and press the send button.

[1690] Step 12:

[1691] Check the results

[1692] The user checks the results displayed on the terminal and takes the necessary action.

[1693] Input: Judgment result displayed on the device

[1694] Output: User action (e.g. avoid site, report)

[1695] Specific behavior:

[1696] View the phishing detection results displayed on your device and take appropriate action based on the results.

[1697] (Application example 1)

[1698] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1699] Phishing sites that consist only of images are difficult to detect using conventional text-based phishing site detection methods, and users remain vulnerable to these phishing sites. Therefore, there is a need for a system that can analyze image data to detect phishing sites with high accuracy. There is also a need for a system that allows users to receive phishing site warnings in real time.

[1700] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[1701] In this invention, the server includes means for acquiring image data, means for converting the image data into text data, means for determining whether a website is a phishing site based on the text data, and means for notifying the terminal of the determination result in real time, thereby enabling phishing sites consisting only of images to be detected with high accuracy and enabling users to receive warnings about phishing sites in real time.

[1702] "Image data" is data in digital format that contains visual information displayed on a web page.

[1703] "Text data" is data in a digital format that contains textual information extracted from image data.

[1704] A "phishing site" is a fake website created with the purpose of fraudulently obtaining users' personal information and authentication information.

[1705] A "terminal" is a device used by a user, such as a smartphone or computer, through which a website is accessed.

[1706] "Real-time notification" is a function that instantly reports the results of a phishing site detection to the user.

[1707] A "generative model" is a system that uses machine learning and artificial intelligence algorithms to analyze image data and generate text data.

[1708] "Keywords" are specific words or phrases used to identify phishing sites.

[1709] The "judgment result" is the analysis result of whether the website is a phishing site.

[1710] The present invention relates to a system for detecting phishing sites that are composed only of images with high accuracy. Specific embodiments of the system will be described below.

[1711] Overall system configuration

[1712] This system consists of three main components: a server, a terminal, and a user. The server receives the website URL sent by the user, acquires image data, converts it to text data, and identifies phishing sites. The terminal provides an interface that receives input from the user and sends it to the server. The user checks for suspicious websites through this terminal.

[1713] Server Processing

[1714] Obtaining image data: The server receives the website URL sent from the device. It accesses this URL and downloads the image on the web page. In this process, it obtains the image data using an HTTP request.

[1715] Converting image data to text data: The server inputs the acquired image data into a generative AI model (e.g., a machine learning algorithm) to convert the image into text data. This process extracts textual information from the image and outputs it as formatted text. Specifically, PIL (Python Imaging Library) and Pytesseract are used.

[1716] Phishing site identification: The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login", "password", "verification", "login"). Based on these keywords, it determines whether the website is a phishing site.

[1717] Notification of judgment results: The server formats the judgment results as JSON data and sends them to the terminal in real time. This includes a process to display the results in a format that is easy for the user to understand.

[1718] Terminal handling

[1719] URL input acceptance: The terminal provides an interface for accepting website URLs entered by the user. This interface can be a web browser, a dedicated application, or a GUI.

[1720] Sending URL: The terminal generates and sends an HTTP request to send the entered URL to the server.

[1721] Receiving and displaying results: The terminal receives the judgment results from the server and displays them to the user in real time. The display format can vary, including warning messages, alerts, and detailed analysis results.

[1722] User operations

[1723] Entering a URL: The user enters the URL of a suspicious website using the interface provided by the device.

[1724] Review the results: Users review the results displayed on their device and take appropriate action regarding suspected phishing websites, if necessary, such as avoiding the site or reporting it to their security department.

[1725] Specific examples

[1726] For example, if a user wants to check the security of a bank's login page, the process would be as follows:

[1727] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[1728] 2. The device generates and sends a request to send the URL to the server.

[1729] 3. The server receives the URL, visits the page, and downloads the image.

[1730] 4. The server inputs the downloaded image into a generative AI model (e.g., Pytesseract) to generate text data (e.g., "Please log in").

[1731] 5. The server analyzes the generated text to see if it contains keywords related to phishing sites.

[1732] 6. The server determines that the site is likely to be a phishing site and notifies the device of the result in real time.

[1733] 7. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[1734] Prompt Sentence Examples

[1735] Check out http: / / example.com / suspicious_site.

[1736] This allows users to instantly confirm the safety of suspicious websites.Compared to conventional text-based phishing site detection methods, this invention makes it possible to detect phishing sites that consist only of images with high accuracy.

[1737] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[1738] Step 1:

[1739] URL input reception (terminal)

[1740] The user inputs the URL of a website into the terminal interface, which can be a web browser, a dedicated application, or a GUI. When the user inputs the URL and presses the check button, the terminal receives this information and obtains the input data (URL) to proceed to the next processing step.

[1741] Step 2:

[1742] Send URL (device)

[1743] The device receives the URL entered by the user and sends it to the server as an HTTP request. This request includes the URL to be verified and serves as input data for the server to retrieve web page information. After sending the request, the device waits for a response from the server.

[1744] Step 3:

[1745] Acquisition of image data (server)

[1746] The server accesses the web page based on the URL received from the terminal. It uses an HTTP request to download the image data of the web page and obtains the image data. The obtained image data is the input data to be converted to text data in the next step.

[1747] Step 4:

[1748] Convert image data to text data (server)

[1749] The server inputs the acquired image data into a generative AI model (e.g., Pytesseract), extracts text information from the image, and generates text data. This process formats the image data as text data, which becomes input data for phishing site detection in the next step.

[1750] Step 5:

[1751] Phishing site detection (server)

[1752] The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login," "password," "verification," "login"). Based on these keywords, it determines whether the website is a phishing site. The determination result (whether it is likely to be a phishing site or not) is output data that is notified to the terminal in the next step.

[1753] Step 6:

[1754] Notification of judgment results (server)

[1755] The server formats the phishing site detection results as JSON data and sends them to the device in real time. This notification contains information about the possibility that the website is a phishing site. The notified detection results become input data for display on the device.

[1756] Step 7:

[1757] Receiving and displaying results (terminal)

[1758] The device analyzes the phishing site detection results received from the server and displays them to the user in real time. Specifically, the results are displayed as warning messages, alerts, or detailed analysis results. This display allows the user to confirm the safety of the website and take appropriate action if necessary.

[1759] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[1760] The present invention is a system that converts image data into text data to detect phishing sites, and combines it with an emotion engine that recognizes user emotions. Specific embodiments of this system are described below.

[1761] Overall system configuration

[1762] This system consists of three main components: a server, a terminal, and a user. The server receives website URLs sent by users, acquires image data, converts it to text data, determines whether the website is a phishing site, and displays the results based on the user's sentiment. The terminal provides an interface that receives input from users and sends it to the server. Users check suspicious websites through this terminal.

[1763] Server Processing

[1764] The server performs the following process:

[1765] 1. Image Data Acquisition:

[1766] The server receives the website URL sent from the device, accesses this URL, and downloads the image data on the web page. The image is retrieved using an HTTP request.

[1767] 2. Convert image data to text data:

[1768] The server inputs the acquired image data into the image2text model to convert the image into text data. This process extracts the textual information in the image and outputs it as formatted text.

[1769] 3. Phishing site identification:

[1770] The generated text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and based on these keywords, it determines whether the website is a phishing site.

[1771] 4. Recognizing user emotions with the emotion engine:

[1772] The server uses an emotion engine that recognizes the user's emotions and collects emotional information from the user's facial expressions and voice. The server analyzes this emotional information and adjusts the display method to make the site information more easily accepted by the user.

[1773] 5. Output of judgment result:

[1774] The judgment results are formatted as JSON data and returned to the device, including warning messages and display methods adjusted based on the user's emotions.

[1775] Terminal handling

[1776] The terminal performs the following process:

[1777] 1. URL input acceptance:

[1778] The terminal provides an interface for accepting the URL of a website entered by the user, which may be a web browser, a dedicated application, or a GUI.

[1779] 2. Send URL:

[1780] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[1781] 3. Collecting Emotional Data:

[1782] The device uses the user's camera and microphone to capture the user's facial expressions and voice, and sends this data to the server.

[1783] 4. Receiving and displaying results:

[1784] The device analyzes the JSON formatted judgment result received from the server and displays the judgment result to the user based on the adjusted warning message and display method.

[1785] User operations

[1786] The user performs the following operations:

[1787] 1. Enter the URL:

[1788] The user enters the URL of the suspicious website using the interface provided by the terminal.

[1789] 2. Providing Emotion Data:

[1790] Users provide emotional data using their device's camera and microphone, and this operation is usually done automatically.

[1791] 3. Check the results:

[1792] Users can check the results and warning messages displayed on their devices and take appropriate action if necessary regarding suspected phishing websites, such as avoiding the site or reporting it to the security department.

[1793] Specific examples

[1794] For example, if a user wants to check the security of a bank's login page, the process would be as follows:

[1795] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[1796] 2. The terminal generates and sends a request to the server for the entered URL.

[1797] 3. The device uses a camera and microphone to collect the user's facial expressions and voice data and send it to the server.

[1798] 4. The server receives the URL, visits the page and downloads the image.

[1799] 5. The server converts the downloaded image into an image2text model and generates text data (e.g., "Please log in").

[1800] 6. The server analyzes the generated text to see if it contains keywords associated with phishing sites.

[1801] 7. The server uses an emotion engine to recognize the user's emotions and determines the warning message and display method according to the user's state.

[1802] 8. The server returns JSON format data containing the judgment result and the adjusted display method to the terminal.

[1803] 9. The device analyzes the received judgment result and displays to the user, "This site may be a phishing site."

[1804] This allows users to confirm the safety of the site and receive the results in an interface that suits their emotional state.The present invention not only improves the accuracy of phishing site detection, but also improves the user experience.

[1805] The processing flow will be explained below.

[1806] Step 1:

[1807] The user enters the URL of a suspicious website into the terminal and presses the check button.

[1808] Step 2:

[1809] The terminal generates an HTTP request to send the input URL.

[1810] Step 3:

[1811] The terminal sends the generated HTTP request to the server.

[1812] Step 4:

[1813] The device uses the user's camera and microphone to collect facial and voice data.

[1814] Step 5:

[1815] The device sends the collected facial expression and voice data to a server.

[1816] Step 6:

[1817] The server receives the URL sent from the terminal.

[1818] Step 7:

[1819] The server accesses the received URL and downloads the image data from the web page, for example, by using an HTTP request to retrieve the image.

[1820] Step 8:

[1821] The server stores the downloaded image data in its memory.

[1822] Step 9:

[1823] The server initializes the image2text model and converts the image data into text data. In this process, it uses a machine learning model to extract text information from the image and output it as text data.

[1824] Step 10:

[1825] The server analyzes the generated text data and checks whether it contains certain keywords associated with phishing sites (e.g., "login," "password," "verification").

[1826] Step 11:

[1827] The server determines whether the website is a phishing site based on whether the keyword is included.

[1828] Step 12:

[1829] The server uses an emotion engine to analyze the facial expression and voice data sent to it in order to analyze the user's emotions.

[1830] Step 13:

[1831] The server identifies the user's emotional state based on the analysis results of the emotion engine, such as impatience, anxiety, or relief.

[1832] Step 14:

[1833] The server adjusts the way the phishing site detection results are displayed and the content of the warning message according to the user's emotional state recognized by the emotion engine.

[1834] Step 15:

[1835] The server returns JSON format data containing the adjusted judgment results to the terminal.

[1836] Step 16:

[1837] The terminal analyzes the JSON formatted judgment result received from the server.

[1838] Step 17:

[1839] Based on the analysis results, the device displays the phishing site determination results to the user with a warning message and display method that is tailored to the user. For example, it may display a message saying "This site may be a phishing site" and change the color and font depending on the user's feelings.

[1840] In this way, users can quickly check the safety of suspicious sites and receive the results in an interface that suits their emotional state.

[1841] Example 2

[1842] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1843] In modern society, the proliferation of phishing sites has increased the risk of users accessing malicious websites and losing personal information and assets. Conventional phishing site detection systems have limitations in the accuracy of converting image data into text and identifying phishing sites. Furthermore, they are unable to provide appropriate warnings that take into account the user's emotional state. This can impair the user experience, creating a need for improved safety. Furthermore, there is a need to minimize the impact on users by generating warning messages that reflect the user's emotional state, in addition to identifying phishing sites.

[1844] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for acquiring image data, means for converting the image data into text data, means for determining whether a website is a phishing site based on the text data, means for analyzing the user's emotional data and generating a warning message based on the emotional state, and means for outputting the determination result and the warning message. This makes it possible to detect phishing sites with high accuracy and provide an appropriate warning message according to the user's emotional state.

[1845] "Image data" refers to visual information obtained from a web page, including photographs, diagrams, graphs, and other image information stored in digital format.

[1846] "Text data" is image data converted into character information, and is data that includes readable characters and text information.

[1847] A "phishing site" is a fake web page created by a malicious third party to look like a legitimate site in order to fraudulently obtain users' personal information and authentication information.

[1848] "Emotion data" is information that represents the user's emotional state, and is data collected from the user's facial expressions, voice, actions, and the like.

[1849] "Emotion engine" refers to software or hardware technology for analyzing emotion data and recognizing a user's emotional state.

[1850] A "warning message" is a message that warns users about the risks of phishing sites, and is a statement intended to inform users of the dangers.

[1851] The "determination result" is a result indicating whether or not a website is a phishing site based on an analysis of image data and text data.

[1852] A "generative model" refers to an algorithm or machine learning model that uses AI technology to generate text data from image data.

[1853] The present invention is a system that combines a system that converts image data into text data to detect phishing sites with an emotion engine that recognizes user emotions. Specific embodiments of this system are described below.

[1854] Overall system configuration

[1855] This system consists of three main components: a server, a terminal, and a user. The server receives website URLs, acquires image data, converts it to text data, determines whether the website is a phishing site, and displays the results based on the user's sentiment. The terminal provides an interface that receives input from the user and sends it to the server. The user checks suspicious websites through this terminal.

[1856] Hardware and Software Configuration

[1857] The server uses the following hardware and software:

[1858] A network interface for sending and receiving HTTP requests

[1859] Analyzing web pages with an HTML parser (e.g. BeautifulSoup)

[1860] HTTP client for downloading image data

[1861] Image2Text model for extracting text from images (OCR technology)

[1862] Keyword search and machine learning models to analyze text data and identify phishing sites

[1863] An emotion engine (e.g., OpenCV, Google Speech-to-Text API) that analyzes user emotions

[1864] A software stack for sending and receiving data in JSON format

[1865] The hardware and software used by the device:

[1866] An interface (web browser, dedicated application, or GUI) that allows users to enter URLs

[1867] A device that uses a camera and microphone to capture a user's facial expressions and voice

[1868] A network interface for generating and sending HTTP requests to a server

[1869] a display and display software for displaying the judgment results received from the server;

[1870] User Action:

[1871] Enter the URL of the suspicious website

[1872] Use your device's camera and microphone to provide emotional data

[1873] Check the judgment results and warning messages displayed on the device and take necessary action.

[1874] What the program does

[1875] The server receives the website URL sent from the device and accesses this URL to retrieve the image data on the webpage. The image data is downloaded using an HTTP request and then analyzed for image tags in the webpage using an HTML parser. The image data is then input into the image2text model, which converts the image into text data. This text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and a machine learning model is used to identify phishing sites.

[1876] Furthermore, the server receives the user's emotional data sent from the device and inputs it into the emotion engine. The emotion engine analyzes the user's facial expressions and voice to detect their emotional state. Based on the detected emotion, the server generates a warning message in a format that is easy for the user to accept, in conjunction with the phishing site judgment result. The generated warning message and judgment result are sent to the device in JSON format.

[1877] The device analyzes the received JSON format data and displays it appropriately to the user. Specifically, it organizes warning messages and judgment results so that the user can understand them immediately, and displays them on the screen.

[1878] Users should check the results displayed and take appropriate action if they suspect phishing, such as avoiding the site or reporting it to the security department.

[1879] Specific examples

[1880] For example, if a user wants to check the security of their bank's login page, they might do the following:

[1881] 1. The user enters the URL of the bank's login page into the terminal and presses the check button.

[1882] 2. The device generates and sends a request to the server for the entered URL, and simultaneously collects the user's facial expression and voice data using the camera and microphone and sends them to the server.

[1883] 3. The server receives the URL, visits the page, and downloads the image.

[1884] 4. The server converts the downloaded image into an image2text model and generates text data (e.g., "Please log in").

[1885] 5. The server analyzes the generated text data, checks whether it contains specific keywords, and uses a machine learning model to identify phishing sites.

[1886] 6. The server uses an emotion engine to analyze the user's facial expressions and voice data and recognize the user's emotional state.

[1887] 7. The server generates an appropriate warning message based on the emotion data and the phishing judgment result. This message and the judgment result are sent to the device in JSON format.

[1888] 8. The device analyzes the received data and displays a warning message to the user saying, "This site may be a phishing site."

[1889] Examples of prompt statements

[1890] Below are some example prompts to input to a generative AI model:

[1891] "Enter the bank login page URL 'https: / / example-bank.com / login' into your phishing detection system to verify its safety. Also, generate a warning message that reflects the user's emotional state."

[1892] In this way, the phishing site detection system according to the present invention provides appropriate warnings according to the user's emotional state, and achieves highly accurate detection of phishing sites.

[1893] The flow of the identification process in the second embodiment will be described with reference to FIG.

[1894] Step 1:

[1895] The server receives the URL from the terminal. The server receives the HTTP request and obtains the website URL in the request body. Input: Website URL from the terminal. Output: Obtained website URL in the server.

[1896] Step 2:

[1897] The server retrieves the image data of a web page. The server makes an HTTP request to the retrieved URL and downloads the HTML of the web page. Next, it uses an HTML parser (e.g. BeautifulSoup) to analyze the image tags in the web page and create a list of image URLs. It then sends an HTTP request to each image URL in the list to retrieve the image data. Input: Website URL. Output: Web page image data.

[1898] Step 3:

[1899] The server converts image data into text data. The server inputs the acquired image data into the image2text model to extract the text information in the image. In this process, OCR technology is used to convert the image data into text format. Input: Image data. Output: Text data.

[1900] Step 4:

[1901] The server identifies phishing sites. The server analyzes the generated text data and checks whether it contains specific keywords (e.g., "login," "password," "verification"). It also uses a machine learning model to score the likelihood of a phishing site from the text features and determines whether it exceeds a certain threshold. Input: Text data. Output: Phishing site identification result.

[1902] Step 5:

[1903] The server analyzes the emotion data using an emotion engine. The server receives the user's facial expression and voice data sent from the device and inputs it into the emotion engine. The emotion engine analyzes this data and detects the user's emotional state. For example, facial expressions are analyzed using facial recognition technology (e.g., OpenCV) and emotions are inferred using voice recognition (e.g., Google Speech-to-Text API). Input: User's facial expression data, voice data. Output: User's emotional state.

[1904] Step 6:

[1905] The server generates a result based on the judgment result and emotional data. The server creates an appropriate warning message based on the phishing site judgment result and the user's emotional data. For example, if the user is surprised, it generates a warning message such as "Caution! This site may be phishing." Input: phishing site judgment result, user's emotional state. Output: Result including the adjusted warning message.

[1906] Step 7:

[1907] The server sends the results to the terminal. The server formats the generated warning message and phishing site judgment results in JSON format and sends them to the terminal as an HTTP response. Input: Warning message, phishing site judgment results. Output: JSON format response to the terminal.

[1908] Step 8:

[1909] The terminal displays the results. The terminal analyzes the received JSON format data and displays it appropriately to the user. Specifically, it displays warning messages and judgment results appropriately on a GUI (graphical user interface) and organizes the information so that the user can understand it immediately. Input: JSON format response from the server. Output: Content displayed to the user.

[1910] Step 9:

[1911] The user checks the results and takes the necessary action. The user checks the displayed results and takes appropriate action, such as not using the site or reporting it to the security department, if they suspect phishing. They also take action based on the response message that is based on emotional data. Input: Displayed results on the device. Output: User's response action.

[1912] (Application example 2)

[1913] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1914] Conventional phishing site detection systems only display warnings for significant risks, and often issue warnings without considering the user's emotional state. This reduces the effectiveness of the warning and poses the risk of users taking the wrong action. Another issue is that it is difficult to accurately identify phishing sites using simple keyword extraction alone.

[1915] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for acquiring image data, means for converting the image data into text data, means for determining whether a website is a phishing site based on the text data, means for recognizing the user's emotions, and means for adjusting and outputting the determination result based on the emotions. This makes it possible to provide an appropriate warning according to the user's emotional state, significantly improving the accuracy of phishing site detection and the user experience.

[1916] The "means for acquiring image data" is a function for collecting image data from web pages on the Internet or screenshots provided by users.

[1917] "Means for converting image data into text data" refers to a function for converting character information in an image into text data using optical character recognition technology or a generative AI model.

[1918] The "means for determining whether a website is a phishing site based on text data" is a function for determining whether a website is a phishing site by analyzing the generated text data and detecting specific keywords or patterns.

[1919] The "means for recognizing the user's emotions" is a function for collecting the user's facial expressions and voice through a camera or microphone, and analyzing this to determine the user's emotional state.

[1920] The "means for adjusting and outputting the judgment result based on emotion" is a function for adjusting the judgment result of a phishing site according to the user's emotional state and conveying it to the user in the most appropriate format.

[1921] A system for implementing the present invention has the following configuration: The system receives a website URL or screenshot entered by a user, and provides a function for determining its safety. The system also has a function for adjusting the display method of the results depending on the user's emotional state.

[1922] Overall system configuration

[1923] It consists of three main elements: the server, the terminal, and the user.

[1924] The server receives the website URL sent from the terminal, acquires the image data, converts it into text data, determines whether the site is a phishing site, and displays the results based on the user's sentiment.

[1925] The terminal provides an interface that receives input from the user and transmits it to the server.

[1926] The user checks suspicious websites through this terminal.

[1927] Server Processing

[1928] The server performs the following process:

[1929] 1. Image Data Acquisition:

[1930] The server receives the website URL sent from the device, accesses this URL, and downloads the image data on the web page. The image is retrieved using an HTTP request.

[1931] 2. Convert image data to text data:

[1932] The server inputs the acquired image data into a generative AI model to convert the image into text data, a process that extracts textual information from the image and outputs it as formatted text.

[1933] 3. Phishing site identification:

[1934] The generated text data is analyzed to check whether it contains specific keywords (e.g., "login," "password," "verification"), and based on these keywords, it determines whether the website is a phishing site.

[1935] 4. Recognizing user emotions with the emotion engine:

[1936] The server uses an emotion engine that recognizes the user's emotions and collects emotional information from the user's facial expressions and voice. The server analyzes this emotional information and adjusts the display method to make the site information more easily accepted by the user.

[1937] 5. Output of judgment result:

[1938] The judgment results are formatted as JSON data and returned to the device, including warning messages and display methods adjusted based on the user's emotions.

[1939] Terminal handling

[1940] The terminal performs the following process:

[1941] 1. URL input acceptance:

[1942] The terminal provides an interface for accepting the URL of a website entered by the user, which may be a web browser, a dedicated application, or a GUI.

[1943] 2. Send URL:

[1944] The terminal generates and transmits an HTTP request for transmitting the input URL to the server.

[1945] 3. Collecting Emotional Data:

[1946] The device uses the user's camera and microphone to capture the user's facial expressions and voice, and sends this data to the server.

[1947] 4. Receiving and displaying results:

[1948] The device analyzes the JSON formatted judgment result received from the server and displays the judgment result to the user based on the adjusted warning message and display method.

[1949] User operations

[1950] The user performs the following operations:

[1951] 1. Enter the URL:

[1952] The user enters the URL of the suspicious website using the interface provided by the terminal.

[1953] 2. Providing Emotion Data:

[1954] Users provide emotional data using their device's camera and microphone, and this operation is usually done automatically.

[1955] 3. Check the results:

[1956] Users can check the results and warning messages displayed on their devices and take appropriate action if necessary regarding websites suspected of phishing.

[1957] Specific examples

[1958] When a user wants to check the safety of a payment page on an online shopping site, they enter the URL into the app, which determines whether the site is phishing and, if the user is nervous, displays a high-urgency warning message.

[1959] Prompt Sentence Examples

[1960] "Please analyze the following URL to determine if it is a phishing site: 'https: / / example-phishing-site.com'"

[1961] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[1962] Step 1:

[1963] The user enters the URL or screenshot of a suspicious website into the device. The device takes the URL or image file path entered by the user and prepares it to send to the server. The input data includes the URL in string format and the image file path. An HTTP request is generated as output.

[1964] Step 2:

[1965] The terminal sends the URL or image data obtained from the user to the server. Specifically, it creates and sends an HTTP request. The input data includes the URL string or image file. The output data is the result of sending the request to the server.

[1966] Step 3:

[1967] The server accesses the received URL and retrieves the image data on the web page. It uses an HTTP request to download the image from the web page. The input data includes the URL string. The output data is the downloaded image data.

[1968] Step 4:

[1969] The server converts the acquired image data into text data using a generative AI model. Specifically, it extracts character information from the image using optical character recognition (OCR) technology and generates it as formatted text data. The input data is image data, and the output data is the generated text data.

[1970] Step 5:

[1971] The server analyzes the generated text data and checks for specific keywords to determine whether it is a phishing site. For example, it checks whether the text data contains keywords such as "login" or "password." The input data is the text data, and the output data is the phishing site determination result (true / false).

[1972] Step 6:

[1973] The server uses an emotion engine to recognize the user's emotional state and analyzes the user's facial expressions and voice. This analysis uses data collected from the user's camera and microphone. The input data is the user's facial expressions and voice data, and the output data is emotional information (e.g., surprise, fear, relief, etc.).

[1974] Step 7:

[1975] The server adjusts the warning message based on the phishing site detection result and the user's emotional information, and sends it to the terminal in the optimal format. Specifically, it adjusts the urgency and expression method according to the emotional information. The input data are the phishing site detection result and the user's emotional information, and the output data is the adjusted warning message.

[1976] Step 8:

[1977] The terminal analyzes the tailored warning message received from the server and displays it to the user in an appropriate format, such as a pop-up message or a sound notification. The input data is the warning message from the server, and the output data is the displayed warning message.

[1978] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[1979] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1980] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the robot 414.

[1981] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[1982] FIG. 9 is a diagram illustrating an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and actions arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion includes both affect and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[1983] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[1984] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[1985] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. Emotions can also be created for robots, automobiles, motorcycles, and other devices, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on Voice Emotion Recognition and Emotional Brain Physiological Signal Analysis Systems, Tokushima University, Doctoral Dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the "reaction" domain, where sensation is dominant. The right half of the emotion map lists emotions belonging to the "situation" domain, where situational awareness is dominant.

[1986] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[1987] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[1988] The system according to the present disclosure has been described above mainly with respect to the functions of the data processing device 12, but the system according to the present disclosure is not necessarily implemented on a server. The system according to the present disclosure may be implemented as a general information processing system. The present disclosure may be implemented, for example, as a software program running on a personal computer or an application running on a smartphone, etc. The method according to the present disclosure may be provided to users in the form of SaaS (Software as a Service).

[1989] In the above embodiment, an example was given in which the specific processing is performed by one computer 22, but the technology of the present disclosure is not limited to this, and the specific processing may be distributed and performed by a plurality of computers including the computer 22. For example, the data generation model 58 may be provided in an external device of the data processing device 12, and data may be generated in the external device in accordance with input data.

[1990] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[1991] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[1992] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[1993] The hardware resource for executing a specific process can be any of the following processors: An example of a processor is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. Another example of a processor is a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[1994] The hardware resource that executes the specific processing may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific processing may be a single processor.

[1995] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[1996] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[1997] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[1998] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[1999] The following is further disclosed regarding the above embodiment.

[2000] (Claim 1)

[2001] means for acquiring image data;

[2002] means for converting image data into text data;

[2003] means for determining whether a website is a phishing site based on the text data;

[2004] means for outputting the determination result;

[2005] A system including:

[2006] (Claim 2)

[2007] 10. The system of claim 1,

[2008] The system further includes means for extracting specific keywords from the acquired image data and using the keywords to determine whether the site is a phishing site.

[2009] (Claim 3)

[2010] 10. The system of claim 1,

[2011] The system further includes means for using the generative model to generate the text data.

[2012]

[2013] "Example 1"

[2014] (Claim 1)

[2015] means for receiving a website URL and retrieving the web page content;

[2016] means for downloading image data from the retrieved web page;

[2017] A means for converting the downloaded image data into text data using a generative model;

[2018] A means for analyzing specific keywords based on text data and determining whether a website is a phishing site;

[2019] A means to format and output the judgment results in JSON format,

[2020] A system including:

[2021] (Claim 2)

[2022] 2. The system according to claim 1, further comprising means for extracting specific keywords from the acquired image data and using the keywords to determine whether the site is a phishing site.

[2023] (Claim 3)

[2024] 10. The system of claim 1, further comprising means for using a generative model to generate the text data.

[2025] "Application Example 1"

[2026] (Claim 1)

[2027] means for acquiring image data;

[2028] means for converting image data into text data;

[2029] means for determining whether a website is a phishing site based on the text data;

[2030] A means for notifying the terminal of the judgment result in real time;

[2031] A system including:

[2032] (Claim 2)

[2033] 2. The system according to claim 1, further comprising means for extracting specific keywords from the acquired image data and using the keywords to determine whether the site is a phishing site.

[2034] (Claim 3)

[2035] 10. The system of claim 1, further comprising means for using a generative model to generate the text data.

[2036] "Example 2: Combining Emotion Engines"

[2037] (Claim 1)

[2038] means for acquiring image data;

[2039] means for converting image data into text data;

[2040] means for determining whether a website is a phishing site based on the text data;

[2041] means for analyzing the user's emotional data and generating a warning message based on the user's emotional state;

[2042] means for outputting the determination result and a warning message;

[2043] A system including:

[2044] (Claim 2)

[2045] 2. The system according to claim 1, wherein specific keywords are extracted from the acquired image data and used to determine whether the site is a phishing site.

[2046] (Claim 3)

[2047] 10. The system of claim 1, wherein a generative model is used to generate the text data.

[2048]

[2049] "Application example 2 when combining emotion engines"

[2050] (Claim 1)

[2051] means for acquiring image data;

[2052] means for converting image data into text data;

[2053] means for determining whether a website is a phishing site based on the text data;

[2054] means for recognizing a user's emotion;

[2055] a means for adjusting and outputting a judgment result based on the emotion;

[2056] A system including:

[2057] (Claim 2)

[2058] 2. The system according to claim 1, further comprising means for extracting specific keywords from the acquired image data and using the keywords to determine whether the site is a phishing site.

[2059] (Claim 3)

[2060] 10. The system of claim 1, further comprising means for using a generative model to generate the text data. [Explanation of symbols]

[2061] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot< / url:> < / url:> < / url:> < / url:>

Claims

1. means for acquiring image data; means for converting image data into text data; means for determining whether a website is a phishing site based on the text data; means for outputting the determination result; A system including:

2. 10. The system of claim 1, The system further includes means for extracting specific keywords from the acquired image data and using the keywords to determine whether the site is a phishing site.

3. 10. The system of claim 1, The system further includes means for using the generative model to generate the text data.

Images