System

Abstract

An object of a system according to an embodiment is to detect a suspicious behavior of an employee in real time and to quickly cope with the suspicious behavior.SOLUTION: A system according to an embodiment includes an activity monitoring unit, a suspicious action detection unit, a warning transmission unit, and a countermeasure proposal unit. The activity monitoring unit monitors the activity of the employee in real time. The suspicious behavior detection unit detects suspicious behavior from the activity monitored by the activity monitoring unit. The warning sending unit sends a warning based on the abnormality detected by the suspicious action detection unit. The countermeasure proposal unit proposes an appropriate countermeasure based on the warning transmitted by the warning transmission unit.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] Conventional technology has the drawback of making it difficult to detect suspicious employee behavior in real time and respond quickly.

[0005] The system according to the embodiment aims to detect suspicious employee behavior in real time and deal with it promptly. [Means for solving the problem]

[0006] The system according to the embodiment includes an activity monitoring unit, a suspicious behavior detection unit, a warning transmission unit, and a countermeasure proposal unit. The activity monitoring unit monitors employee activities in real time. The suspicious behavior detection unit detects suspicious behavior from the activities monitored by the activity monitoring unit. The warning transmission unit issues a warning based on an abnormality detected by the suspicious behavior detection unit. The countermeasure proposal unit proposes appropriate countermeasures based on the warning transmitted by the warning transmission unit. [Effects of the Invention]

[0007] The system according to the embodiment can detect suspicious employee behavior in real time and deal with it quickly. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10]1 shows an emotion map onto which multiple emotions are mapped. DETAILED DESCRIPTION OF THE INVENTION

[0009] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0010] First, the terms used in the following description will be explained.

[0011] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, the processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), an APU (Accelerated Processing Unit), or a TPU (Tensor Processing Unit).

[0012] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0013] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0014] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), and Bluetooth (registered trademark).

[0015] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0016] [First embodiment] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0017] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0018] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0019] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0020] The reception device 38 includes a touch panel 38A and a microphone 38B, and receives user input. The touch panel 38A detects contact with a pointer (for example, a pen or a finger) to receive user input by the touch of the pointer. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 (see FIG. 2) acquires the data indicating the user input.

[0021] Output device 40 includes a display 40A and a speaker 40B, and presents data to a user by outputting the data in a form of expression that the user can perceive (e.g., audio and / or text). Display 40A displays visible information such as text and images in accordance with instructions from processor 46. Speaker 40B outputs audio in accordance with instructions from processor 46. Camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0022] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0023] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0024] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0025] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0026] In the smart device 14, the specific processing is performed by the processor 46. The storage 50 stores a specific processing program 60. The specific processing program 60 is used together with the specific processing program 56 by the data processing system 10. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. Note that the smart device 14 may have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59.

[0027] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device (e.g., a generation server) may have the data generation model 58. In this case, the data processing device 12 obtains a processing result (prediction result, etc.) using the data generation model 58 by communicating with the server device having the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device owned by a user (e.g., a mobile phone, a robot, a home appliance, etc.). Next, an example of processing by the data processing system 10 according to the first embodiment will be described.

[0028] (Example 1) A security system according to an embodiment of the present invention utilizes generative AI to detect and quickly address unauthorized access. This security system monitors employee activity in real time and automatically detects suspicious behavior. When an abnormality is detected, the generative AI immediately issues an alert and proposes appropriate countermeasures. It also tracks the route and cause of the unauthorized access and proposes measures to prevent recurrence. This enables the security system to comprehensively resolve customers' security issues.

[0029] A security system according to an embodiment includes an activity monitoring unit, a suspicious behavior detection unit, a warning unit, and a countermeasure proposal unit. The activity monitoring unit monitors employee activity in real time. For example, it collects information such as which files employees accessed, which websites they visited, and which applications they used. The suspicious behavior detection unit detects suspicious behavior from the activity monitored by the activity monitoring unit. For example, it detects downloading large amounts of data at unusual times or accessing files that are not normally accessed. The warning unit issues a warning based on the abnormality detected by the suspicious behavior detection unit. For example, it issues a warning such as, "Suspicious access has been detected. Please change your password immediately." The countermeasure proposal unit proposes appropriate countermeasures based on the warning issued by the warning unit. For example, it proposes specific countermeasures such as, "Please strengthen your firewall settings" or "Please implement two-factor authentication." Employee activity—What activities are targeted? It is necessary to clarify the type of activity. For example, work behavior, system access, communication history, etc. Real-time monitoring—It is necessary to clarify specific methods and technologies for real-time monitoring. For example, it is necessary to use sensors or analyze logs in real time. Suspicious behavior - Specific criteria and examples of suspicious behavior must be clarified. For example, deviations from normal behavior patterns, abnormal access attempts, etc. Issuing a warning - The method and content of issuing a warning must be clarified. For example, email notification, alert display, audio warning, etc. Appropriate measures - Specific content and criteria of appropriate measures must be clarified. For example, strengthening access restrictions, implementing security education, etc. As a result, the security system according to the embodiment can comprehensively solve security issues by monitoring employee activity in real time, detecting suspicious behavior, quickly issuing warnings, and proposing appropriate measures.

[0030] The activity monitoring unit learns employee behavior patterns based on employee activity data, enabling more accurate detection of abnormal behavior. For example, the activity monitoring unit collects employee activity data, and the generation AI learns each employee's behavior patterns. For example, it analyzes patterns of files accessed and applications used during normal working hours to detect abnormal behavior. Activity data: The specific type and collection method of activity data must be clarified. For example, log data, sensor information, etc. Learning behavior patterns: The method and algorithm for learning behavior patterns must be clarified. For example, machine learning algorithms, data mining technology, etc. High-precision detection: The specific criteria and methods for high-precision detection must be clarified. For example, reducing the false positive rate and improving the accuracy of the detection algorithm. This improves the accuracy of detecting abnormal behavior by learning employee behavior patterns.

[0031] The activity monitoring unit can compare employee activity data with behavior outside of working hours to identify suspicious behavior both inside and outside of working hours. For example, the activity monitoring unit compares employee activity data with behavior outside of working hours, and the generation AI identifies suspicious behavior. For example, analyzing patterns of files and applications accessed outside of working hours to detect abnormal behavior. Behavior outside of working hours - The specific definition of behavior outside of working hours and the collection method must be clarified. For example, system access outside of working hours, private communication history, etc. Suspicious behavior inside and outside of working hours - The specific criteria and examples of suspicious behavior inside and outside of working hours must be clarified. For example, unauthorized access outside of working hours, abnormal operations during working hours, etc. This makes it possible to identify suspicious behavior by comparing behavior inside and outside of working hours.

[0032] The activity monitoring unit can link employee activity data with other security systems to perform comprehensive security monitoring. For example, the activity monitoring unit links employee activity data with a physical access control system to perform comprehensive security monitoring. For example, it can integrate employee entry / exit records with activity data to detect abnormal behavior. Other security systems - The specific types of other security systems and how they are linked must be clarified. For example, physical access control systems, network monitoring systems, etc. Comprehensive security monitoring - The specific content and methods of comprehensive security monitoring must be clarified. For example, integrating data from multiple security systems and implementing real-time monitoring. This enables comprehensive security monitoring by linking with other security systems.

[0033] The activity monitoring unit can also use employee activity data to improve work efficiency and make suggestions for improving work processes. For example, the activity monitoring unit uses employee activity data to improve work efficiency, and the generative AI makes suggestions for improving work processes. For example, it analyzes employee work hours and application usage to propose efficient work processes. Data for work efficiency - The specific type of data and how it will be used to improve work efficiency must be clarified. For example, reducing work hours, optimizing resource allocation, etc. Proposals for improving work processes - The specific content and method of proposals for improving work processes must be clarified. For example, reviewing work flows, introducing tools, etc. This makes it possible to propose improvements to work processes by using the data to improve work efficiency.

[0034] The suspicious behavior detection unit can improve its detection capabilities by training the suspicious behavior detection algorithm on past unauthorized access cases. For example, the suspicious behavior detection unit trains the suspicious behavior detection algorithm on past unauthorized access cases, giving the generating AI more advanced detection capabilities. For example, it analyzes past unauthorized access patterns and identifies anomalous behavior. Detection algorithm - The specific type of detection algorithm and implementation method must be clarified. For example, machine learning algorithms, rule-based detection methods, etc. Past unauthorized access cases - The specific content of past unauthorized access cases and the collection method must be clarified. For example, past log data, records of security incidents, etc. This improves the suspicious behavior detection ability by training the system on past unauthorized access cases.

[0035] The suspicious behavior detection unit can also take into account abnormal network traffic patterns when detecting suspicious behavior, enabling comprehensive detection. For example, the suspicious behavior detection unit can take into account abnormal network traffic patterns when detecting suspicious behavior, allowing the generation AI to perform more comprehensive detection. For example, it can analyze abnormal data transfer volumes and communication patterns to identify abnormal behavior. Abnormal network traffic patterns - It is necessary to clarify the specific definition and detection method of abnormal network traffic patterns. For example, abnormal packet counts, abnormal communication destinations, etc. This makes it possible to detect suspicious behavior more comprehensively by taking into account abnormal network traffic patterns.

[0036] The suspicious behavior detection unit can share the results of suspicious behavior detection with other companies and organizations to jointly strengthen security measures. The suspicious behavior detection unit can, for example, share the results of suspicious behavior detection with other companies and organizations to jointly strengthen security measures. For example, by sharing abnormal behavior patterns and countermeasures, security measures can be strengthened. Sharing with other companies and organizations - The specific method and content of sharing with other companies and organizations must be clarified. For example, using a data sharing platform or conducting joint research. This allows security measures to be strengthened by sharing detection results with other companies and organizations.

[0037] The suspicious behavior detection unit can reflect the results of suspicious behavior detection in employee education programs to improve security awareness. The suspicious behavior detection unit can, for example, reflect the results of suspicious behavior detection in employee education programs to improve security awareness. For example, security education is provided to employees based on cases of detected abnormal behavior. Reflection in education programs - The specific methods and content for reflecting the results in the education programs must be clarified. For example, updating training content, adding practical exercises, etc. In this way, by reflecting the detection results in the education programs, employee security awareness can be improved.

[0038] The warning sending unit can refer to the employee's past behavioral history when issuing a warning and propose individually customized countermeasures. The warning sending unit, for example, can refer to the employee's past behavioral history when issuing a warning and propose individually customized countermeasures. For example, if similar abnormal behavior has occurred in the past, the warning can be issued based on those countermeasures. Past behavioral history - The specific type and collection method of past behavioral history must be clarified. For example, log data, business records, etc. Individually customized countermeasures - The specific content and method of individually customized countermeasures must be clarified. For example, measures based on the behavior patterns of individual employees, individual feedback, etc. This makes it possible to propose individually customized countermeasures by referring to the employee's past behavioral history.

[0039] The warning unit can simultaneously notify the employee's supervisor and security personnel when issuing the warning, thereby encouraging a prompt response. The warning unit can simultaneously notify the employee's supervisor and security personnel when issuing the warning, thereby encouraging a prompt response. For example, if suspicious access is detected, an email or alert is sent to the supervisor or security personnel. Notification to supervisors and security personnel - The specific method and content of notification to supervisors and security personnel must be clarified. For example, email notification, alert display, etc. This allows supervisors and security personnel to be notified when the warning is issued, thereby enabling a prompt response.

[0040] The warning unit can coordinate the issuance of warnings and the proposal of countermeasures with other security systems to implement comprehensive security measures. For example, the warning unit can coordinate the issuance of warnings and the proposal of countermeasures with other security systems to implement comprehensive security measures. For example, it can coordinate with a physical access control system to restrict access when abnormal behavior is detected. Cooperation with other security systems - The specific methods and details of cooperation with other security systems must be clarified. For example, the use of APIs, methods of data sharing, etc. This allows cooperation with other security systems to enable comprehensive security measures.

[0041] The warning department can reflect the issuance of warnings and proposed countermeasures in employee education programs to improve security awareness. The warning department can, for example, reflect the issuance of warnings and proposed countermeasures in employee education programs to improve security awareness. For example, provide security education to employees based on cases of detected abnormal behavior. Reflection in education programs - The specific methods and content for reflecting in education programs must be clarified. For example, updating training content, adding practical exercises, etc. In this way, by reflecting the issuance of warnings and proposed countermeasures in education programs, employee security awareness can be improved.

[0042] When tracing the route or cause of unauthorized access, the unauthorized access tracking unit can refer to past unauthorized access cases and identify similar patterns. For example, when tracing the route or cause of unauthorized access, the unauthorized access tracking unit refers to past unauthorized access cases and the generation AI identifies similar patterns. For example, analyzing past unauthorized access patterns and identifying similar routes and causes. Past unauthorized access cases - The specific content and collection method of past unauthorized access cases must be clarified. For example, past log data, records of security incidents, etc. Identifying similar patterns - The specific methods and criteria for identifying similar patterns must be clarified. For example, pattern matching algorithms, data mining technology, etc. This makes it easier to identify similar patterns by referring to past unauthorized access cases.

[0043] The unauthorized access tracking unit can perform detailed analysis of network traffic to trace the route and cause of unauthorized access. For example, the generation AI performs detailed analysis of network traffic to trace the route and cause of unauthorized access. For example, it analyzes abnormal data transfer volume and communication patterns to identify the route and cause of unauthorized access. Detailed analysis of network traffic - It is necessary to clarify the specific methods and techniques for detailed analysis of network traffic. For example, packet analysis, use of traffic monitoring tools, etc. This makes it easier to identify the route and cause of unauthorized access by performing detailed analysis of network traffic.

[0044] The unauthorized access tracking department can share the results of tracing the route and cause of unauthorized access with other companies and organizations to jointly strengthen security measures. The unauthorized access tracking department can, for example, share the results of tracing the route and cause of unauthorized access with other companies and organizations to jointly strengthen security measures. For example, by sharing abnormal behavior patterns and countermeasures, security measures can be strengthened. Sharing with other companies and organizations - The specific method and content of sharing with other companies and organizations must be clarified. For example, using a data sharing platform or conducting joint research. This allows security measures to be strengthened by sharing tracing results with other companies and organizations.

[0045] The unauthorized access tracking department can reflect the results of tracing the route and cause of unauthorized access in employee education programs, thereby improving security awareness. The unauthorized access tracking department can, for example, reflect the results of tracing the route and cause of unauthorized access in employee education programs, thereby improving security awareness. For example, security education is provided to employees based on cases of detected abnormal behavior. Reflection in education programs - The specific methods and content for reflecting the results in education programs must be clarified. For example, updating training content, adding practical exercises, etc. In this way, reflecting the tracing results in education programs can improve employee security awareness.

[0046] The recurrence prevention measure proposal unit can propose effective measures by learning from past cases of unauthorized access when proposing recurrence prevention measures. For example, the recurrence prevention measure proposal unit learns from past cases of unauthorized access when proposing recurrence prevention measures, and the generation AI proposes effective measures. For example, past unauthorized access patterns are analyzed to identify effective recurrence prevention measures. Past unauthorized access cases - The specific content and collection method of past unauthorized access cases must be clarified. For example, past log data, records of security incidents, etc. In this way, by learning from past cases of unauthorized access, effective recurrence prevention measures can be proposed.

[0047] The recurrence prevention measure proposal unit can also take into account abnormal network traffic patterns when proposing recurrence prevention measures, allowing it to propose comprehensive measures. For example, the recurrence prevention measure proposal unit can take into account abnormal network traffic patterns when proposing recurrence prevention measures, and the generation AI can propose comprehensive measures. For example, it can analyze abnormal data transfer volumes and communication patterns to identify effective recurrence prevention measures. Abnormal network traffic patterns - It is necessary to clarify the specific definition and detection method of abnormal network traffic patterns. For example, the number of abnormal packets, abnormal communication destinations, etc. This makes it possible to propose comprehensive recurrence prevention measures by taking into account abnormal network traffic patterns.

[0048] The Recurrence Prevention Measures Proposal Department can share proposed recurrence prevention measures with other companies and organizations to jointly strengthen security measures. The Recurrence Prevention Measures Proposal Department can, for example, share proposed recurrence prevention measures with other companies and organizations to jointly strengthen security measures. For example, sharing effective recurrence prevention measures to strengthen security measures. Sharing with other companies and organizations - The specific method and content of sharing with other companies and organizations must be clarified. For example, using a data sharing platform, conducting joint research, etc. In this way, security measures can be strengthened by sharing recurrence prevention measures with other companies and organizations.

[0049] The Recurrence Prevention Measures Proposal Department can reflect the proposed recurrence prevention measures in employee training programs to improve security awareness. The Recurrence Prevention Measures Proposal Department can, for example, reflect the proposed recurrence prevention measures in employee training programs to improve security awareness. For example, provide security education to employees based on effective recurrence prevention measures. Reflection in training programs - The specific methods and content for reflecting the measures in the training programs must be clarified. For example, updating training content, adding practical exercises, etc. In this way, by reflecting the proposed recurrence prevention measures in the training programs, it is possible to improve employee security awareness.

[0050] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0051] The activity monitoring unit can also use employee activity data for health management purposes, monitoring employee health. For example, it can analyze employees' work hours and break times to detect signs of overwork. Data for health management - The specific types of data for health management and how it will be used need to be clarified. For example, balance of work hours, frequency of breaks, etc. By monitoring employee health, overwork and health risks can be detected early and appropriate measures can be taken.

[0052] The Activity Monitoring Department can use employee activity data to evaluate team cooperation and make suggestions for team building. For example, it can analyze the frequency of communication between employees and the status of collaborative work to evaluate team cooperation. Team building suggestions - The specific content and methods of team building suggestions need to be clarified. For example, proposing workshops to improve teamwork or introducing communication tools. This allows the evaluation of team cooperation and making suggestions for team building to improve team performance.

[0053] The Activity Monitoring Department can also use employee activity data for business risk management, enabling early risk detection and countermeasures. For example, it can analyze employee work content and work environment to identify high-risk behaviors and environments. Data for risk management - The specific types of data for risk management and how it will be used must be clarified. For example, the frequency of dangerous work, the safety of the work environment, etc. This will strengthen business risk management, enable early risk detection and countermeasures, and provide a safe work environment.

[0054] The Activity Monitoring Department can also use employee activity data for project management, allowing them to grasp the progress of a project in real time. For example, they can analyze employees' working hours and task completion status to evaluate the progress of a project. Data for project management - The specific types of data for project management and how it will be used must be clarified. For example, task progress, work time allocation, etc. This allows them to grasp the progress of a project in real time and take appropriate measures to improve the success rate of the project.

[0055] The Activity Monitoring Department can also use employee activity data as data for skill development and make suggestions for improving employees' skills. For example, it can analyze employees' work content and the tools they use to identify areas where skills are lacking. Data for skill development - The specific type of data for skill development and how it will be used must be clarified. For example, details of work content, frequency of tool use, etc. This will allow suggestions for improving employees' skills to be made, promoting employee growth and improving the quality of work.

[0056] The activity monitoring department can also use employee activity data as data for environmental improvements and make suggestions for improving the work environment. For example, it can analyze employees' work locations and environments and make suggestions for providing a comfortable work environment. Data for environmental improvement - The specific types of data for environmental improvement and how it will be used must be clarified. For example, the temperature and lighting conditions of the work area. This can improve the work environment by making suggestions for improving it, thereby improving employee comfort and increasing work efficiency.

[0057] The processing flow of the first embodiment will be briefly explained below.

[0058] Step 1: Activity monitoring monitors employee activity in real time, collecting information such as which files employees access, which websites they visit, and which applications they use. Step 2: The Suspicious Behavior Detection Unit detects suspicious behavior from the activities monitored by the Activity Monitoring Unit, such as downloading large amounts of data at unusual times or accessing files that are not normally accessed. Step 3: The warning unit issues a warning based on the abnormality detected by the suspicious behavior detection unit. For example, it may issue a warning such as, "Suspicious access has been detected. Please change your password immediately." Step 4: The countermeasure proposal section proposes appropriate countermeasures based on the warning sent by the warning sending section. For example, it proposes specific countermeasures such as "strengthen firewall settings" or "introduce two-factor authentication."

[0059] (Example 2) A security system according to an embodiment of the present invention utilizes generative AI to detect and quickly address unauthorized access. This security system monitors employee activity in real time and automatically detects suspicious behavior. When an abnormality is detected, the generative AI immediately issues an alert and proposes appropriate countermeasures. It also tracks the route and cause of the unauthorized access and proposes measures to prevent recurrence. This enables the security system to comprehensively resolve customers' security issues.

[0060] A security system according to an embodiment includes an activity monitoring unit, a suspicious behavior detection unit, a warning unit, and a countermeasure proposal unit. The activity monitoring unit monitors employee activity in real time. For example, it collects information such as which files employees accessed, which websites they visited, and which applications they used. The suspicious behavior detection unit detects suspicious behavior from the activity monitored by the activity monitoring unit. For example, it detects downloading large amounts of data at unusual times or accessing files that are not normally accessed. The warning unit issues a warning based on the abnormality detected by the suspicious behavior detection unit. For example, it issues a warning such as, "Suspicious access has been detected. Please change your password immediately." The countermeasure proposal unit proposes appropriate countermeasures based on the warning issued by the warning unit. For example, it proposes specific countermeasures such as, "Please strengthen your firewall settings" or "Please implement two-factor authentication." Employee activity—What activities are targeted? It is necessary to clarify the type of activity. For example, work behavior, system access, communication history, etc. Real-time monitoring—It is necessary to clarify specific methods and technologies for real-time monitoring. For example, it is necessary to use sensors or analyze logs in real time. Suspicious behavior - Specific criteria and examples of suspicious behavior must be clarified. For example, deviations from normal behavior patterns, abnormal access attempts, etc. Issuing a warning - The method and content of issuing a warning must be clarified. For example, email notification, alert display, audio warning, etc. Appropriate measures - Specific content and criteria of appropriate measures must be clarified. For example, strengthening access restrictions, implementing security education, etc. As a result, the security system according to the embodiment can comprehensively solve security issues by monitoring employee activity in real time, detecting suspicious behavior, quickly issuing warnings, and proposing appropriate measures.

[0061] The activity monitoring unit learns employee behavior patterns based on employee activity data, enabling more accurate detection of abnormal behavior. For example, the activity monitoring unit collects employee activity data, and the generation AI learns each employee's behavior patterns. For example, it analyzes patterns of files accessed and applications used during normal working hours to detect abnormal behavior. Activity data: The specific type and collection method of activity data must be clarified. For example, log data, sensor information, etc. Learning behavior patterns: The method and algorithm for learning behavior patterns must be clarified. For example, machine learning algorithms, data mining technology, etc. High-precision detection: The specific criteria and methods for high-precision detection must be clarified. For example, reducing the false positive rate and improving the accuracy of the detection algorithm. This improves the accuracy of detecting abnormal behavior by learning employee behavior patterns.

[0062] The activity monitoring unit can compare employee activity data with behavior outside of working hours to identify suspicious behavior both inside and outside of working hours. For example, the activity monitoring unit compares employee activity data with behavior outside of working hours, and the generation AI identifies suspicious behavior. For example, analyzing patterns of files and applications accessed outside of working hours to detect abnormal behavior. Behavior outside of working hours - The specific definition of behavior outside of working hours and the collection method must be clarified. For example, system access outside of working hours, private communication history, etc. Suspicious behavior inside and outside of working hours - The specific criteria and examples of suspicious behavior inside and outside of working hours must be clarified. For example, unauthorized access outside of working hours, abnormal operations during working hours, etc. This makes it possible to identify suspicious behavior by comparing behavior inside and outside of working hours.

[0063] The activity monitoring unit can use an emotion estimation function to monitor employees' emotional states and issue a warning if stress or dissatisfaction is increasing. The activity monitoring unit, for example, uses the emotion estimation function to monitor employees' emotional states in real time. For example, it can analyze employees' facial expressions and voices and issue a warning if stress or dissatisfaction is increasing. Emotion estimation function - The specific technology and method for the emotion estimation function must be clarified. For example, facial expression recognition, voice analysis, biometrics, etc. Emotional state - The specific definition and evaluation method for the emotional state must be clarified. For example, stress level, dissatisfaction level, happiness level, etc. In the event of increased stress or dissatisfaction - The specific criteria and detection method for increased stress or dissatisfaction must be clarified. For example, if a certain stress level is exceeded or if there are continuous expressions of dissatisfaction. This allows the system to monitor employees' emotional states and issue a warning if stress or dissatisfaction is increasing, allowing early action to be taken.

[0064] The activity monitoring unit can link employee activity data with other security systems to perform comprehensive security monitoring. For example, the activity monitoring unit links employee activity data with a physical access control system to perform comprehensive security monitoring. For example, it can integrate employee entry / exit records with activity data to detect abnormal behavior. Other security systems - The specific types of other security systems and how they are linked must be clarified. For example, physical access control systems, network monitoring systems, etc. Comprehensive security monitoring - The specific content and methods of comprehensive security monitoring must be clarified. For example, integrating data from multiple security systems and implementing real-time monitoring. This enables comprehensive security monitoring by linking with other security systems.

[0065] The activity monitoring unit can also use employee activity data to improve work efficiency and make suggestions for improving work processes. For example, the activity monitoring unit uses employee activity data to improve work efficiency, and the generative AI makes suggestions for improving work processes. For example, it analyzes employee work hours and application usage to propose efficient work processes. Data for work efficiency - The specific type of data and how it will be used to improve work efficiency must be clarified. For example, reducing work hours, optimizing resource allocation, etc. Proposals for improving work processes - The specific content and method of proposals for improving work processes must be clarified. For example, reviewing work flows, introducing tools, etc. This makes it possible to propose improvements to work processes by using the data to improve work efficiency.

[0066] The activity monitoring unit can use the emotion estimation function to monitor the emotional state of employees in real time and provide feedback to elicit positive emotions. The activity monitoring unit, for example, uses the emotion estimation function to monitor the emotional state of employees in real time and provide feedback to elicit positive emotions. For example, the activity monitoring unit analyzes the employee's facial expressions and voice and provides positive feedback. Feedback to elicit positive emotions - The specific content and method of feedback to elicit positive emotions needs to be clarified. For example, providing compliments or advice to improve motivation. In this way, employee motivation can be improved by monitoring the emotional state of employees in real time and providing feedback to elicit positive emotions.

[0067] The suspicious behavior detection unit can improve its detection capabilities by training the suspicious behavior detection algorithm on past unauthorized access cases. For example, the suspicious behavior detection unit trains the suspicious behavior detection algorithm on past unauthorized access cases, giving the generating AI more advanced detection capabilities. For example, it analyzes past unauthorized access patterns and identifies anomalous behavior. Detection algorithm - The specific type of detection algorithm and implementation method must be clarified. For example, machine learning algorithms, rule-based detection methods, etc. Past unauthorized access cases - The specific content of past unauthorized access cases and the collection method must be clarified. For example, past log data, records of security incidents, etc. This improves the suspicious behavior detection ability by training the system on past unauthorized access cases.

[0068] The suspicious behavior detection unit can also take into account abnormal network traffic patterns when detecting suspicious behavior, enabling comprehensive detection. For example, the suspicious behavior detection unit can take into account abnormal network traffic patterns when detecting suspicious behavior, allowing the generation AI to perform more comprehensive detection. For example, it can analyze abnormal data transfer volumes and communication patterns to identify abnormal behavior. Abnormal network traffic patterns - It is necessary to clarify the specific definition and detection method of abnormal network traffic patterns. For example, abnormal packet counts, abnormal communication destinations, etc. This makes it possible to detect suspicious behavior more comprehensively by taking into account abnormal network traffic patterns.

[0069] The suspicious behavior detection unit can use the emotion estimation function to detect a sudden change in an employee's emotional state as suspicious behavior. For example, the suspicious behavior detection unit uses the emotion estimation function to detect a sudden change in an employee's emotional state as suspicious behavior. For example, it analyzes the employee's facial expressions and voice to identify sudden changes in emotional state. In the case of a sudden change in emotional state - It is necessary to clarify specific criteria and detection methods for sudden changes in emotional state. For example, a sudden rise in stress levels in a short period of time, a sudden expression of dissatisfaction, etc. This allows sudden changes in an employee's emotional state to be detected as suspicious behavior, allowing early countermeasures to be taken.

[0070] The suspicious behavior detection unit can share the results of suspicious behavior detection with other companies and organizations to jointly strengthen security measures. The suspicious behavior detection unit can, for example, share the results of suspicious behavior detection with other companies and organizations to jointly strengthen security measures. For example, by sharing abnormal behavior patterns and countermeasures, security measures can be strengthened. Sharing with other companies and organizations - The specific method and content of sharing with other companies and organizations must be clarified. For example, using a data sharing platform or conducting joint research. This allows security measures to be strengthened by sharing detection results with other companies and organizations.

[0071] The suspicious behavior detection unit can reflect the results of suspicious behavior detection in employee education programs to improve security awareness. The suspicious behavior detection unit can, for example, reflect the results of suspicious behavior detection in employee education programs to improve security awareness. For example, security education is provided to employees based on cases of detected abnormal behavior. Reflection in education programs - The specific methods and content for reflecting the results in the education programs must be clarified. For example, updating training content, adding practical exercises, etc. In this way, by reflecting the detection results in the education programs, employee security awareness can be improved.

[0072] When the suspicious behavior detection unit detects suspicious behavior using the emotion estimation function, it can analyze the emotional state of employees and propose appropriate countermeasures. For example, when the suspicious behavior detection unit detects suspicious behavior using the emotion estimation function, it can analyze the emotional state of employees and propose appropriate countermeasures. For example, it can analyze employees' facial expressions and voices and propose appropriate countermeasures if stress or dissatisfaction is increasing. Appropriate countermeasures - The specific content and criteria for appropriate countermeasures need to be clarified. For example, providing counseling or improving the work environment. In this way, by analyzing the emotional state of employees and proposing appropriate countermeasures when suspicious behavior is detected, it is possible to reduce employee stress and dissatisfaction and prevent recurrence.

[0073] The warning sending unit can refer to the employee's past behavioral history when issuing a warning and propose individually customized countermeasures. The warning sending unit, for example, can refer to the employee's past behavioral history when issuing a warning and propose individually customized countermeasures. For example, if similar abnormal behavior has occurred in the past, the warning can be issued based on those countermeasures. Past behavioral history - The specific type and collection method of past behavioral history must be clarified. For example, log data, business records, etc. Individually customized countermeasures - The specific content and method of individually customized countermeasures must be clarified. For example, measures based on the behavior patterns of individual employees, individual feedback, etc. This makes it possible to propose individually customized countermeasures by referring to the employee's past behavioral history.

[0074] The warning unit can simultaneously notify the employee's supervisor and security personnel when issuing the warning, thereby encouraging a prompt response. The warning unit can simultaneously notify the employee's supervisor and security personnel when issuing the warning, thereby encouraging a prompt response. For example, if suspicious access is detected, an email or alert is sent to the supervisor or security personnel. Notification to supervisors and security personnel - The specific method and content of notification to supervisors and security personnel must be clarified. For example, email notification, alert display, etc. This allows supervisors and security personnel to be notified when the warning is issued, thereby enabling a prompt response.

[0075] The warning transmission unit can use the emotion estimation function to monitor the emotional state of the employee who received the warning and provide support to reduce stress. The warning transmission unit can, for example, use the emotion estimation function to monitor the emotional state of the employee who received the warning and provide support to reduce stress. For example, it can analyze the employee's facial expressions and voice and provide support if stress is increasing. Support to reduce stress - The specific content and method of support to reduce stress must be clarified. For example, providing counseling, implementing a relaxation program, etc. In this way, the emotional state of the employee who received the warning can be monitored and support to reduce stress can be provided, thereby reducing the psychological burden on the employee.

[0076] The warning unit can coordinate the issuance of warnings and the proposal of countermeasures with other security systems to implement comprehensive security measures. For example, the warning unit can coordinate the issuance of warnings and the proposal of countermeasures with other security systems to implement comprehensive security measures. For example, it can coordinate with a physical access control system to restrict access when abnormal behavior is detected. Cooperation with other security systems - The specific methods and details of cooperation with other security systems must be clarified. For example, the use of APIs, methods of data sharing, etc. This allows cooperation with other security systems to enable comprehensive security measures.

[0077] The warning department can reflect the issuance of warnings and proposed countermeasures in employee education programs to improve security awareness. The warning department can, for example, reflect the issuance of warnings and proposed countermeasures in employee education programs to improve security awareness. For example, provide security education to employees based on cases of detected abnormal behavior. Reflection in education programs - The specific methods and content for reflecting in education programs must be clarified. For example, updating training content, adding practical exercises, etc. In this way, by reflecting the issuance of warnings and proposed countermeasures in education programs, employee security awareness can be improved.

[0078] The warning transmission unit can use the emotion estimation function to monitor the emotional state of the employee who has received the warning in real time and provide feedback to elicit positive emotions. The warning transmission unit can, for example, use the emotion estimation function to monitor the emotional state of the employee who has received the warning in real time and provide feedback to elicit positive emotions. For example, the warning transmission unit can analyze the employee's facial expressions and voice and provide positive feedback. Feedback to elicit positive emotions - The specific content and method of feedback to elicit positive emotions needs to be clarified. For example, providing compliments or advice to improve motivation. In this way, the emotional state of the employee who has received the warning can be monitored in real time and feedback to elicit positive emotions can be provided, thereby improving employee motivation.

[0079] When tracing the route or cause of unauthorized access, the unauthorized access tracking unit can refer to past unauthorized access cases and identify similar patterns. For example, when tracing the route or cause of unauthorized access, the unauthorized access tracking unit refers to past unauthorized access cases and the generation AI identifies similar patterns. For example, analyzing past unauthorized access patterns and identifying similar routes and causes. Past unauthorized access cases - The specific content and collection method of past unauthorized access cases must be clarified. For example, past log data, records of security incidents, etc. Identifying similar patterns - The specific methods and criteria for identifying similar patterns must be clarified. For example, pattern matching algorithms, data mining technology, etc. This makes it easier to identify similar patterns by referring to past unauthorized access cases.

[0080] The unauthorized access tracking unit can perform detailed analysis of network traffic to trace the route and cause of unauthorized access. For example, the generation AI performs detailed analysis of network traffic to trace the route and cause of unauthorized access. For example, it analyzes abnormal data transfer volume and communication patterns to identify the route and cause of unauthorized access. Detailed analysis of network traffic - It is necessary to clarify the specific methods and techniques for detailed analysis of network traffic. For example, packet analysis, use of traffic monitoring tools, etc. This makes it easier to identify the route and cause of unauthorized access by performing detailed analysis of network traffic.

[0081] The unauthorized access tracking unit can use the emotion estimation function to analyze the emotional state of the employee who committed the unauthorized access and propose measures to prevent recurrence. The unauthorized access tracking unit can, for example, use the emotion estimation function to analyze the emotional state of the employee who committed the unauthorized access and propose measures to prevent recurrence. For example, it can analyze the employee's facial expressions and voice and propose appropriate measures to prevent recurrence if stress or dissatisfaction is high. Measures to prevent recurrence - The specific content and criteria of measures to prevent recurrence must be clarified. For example, reviewing security policies, strengthening employee education, etc. This makes it possible to prevent recurrence by analyzing the emotional state of the employee who committed the unauthorized access and proposing measures to prevent recurrence.

[0082] The unauthorized access tracking department can share the results of tracing the route and cause of unauthorized access with other companies and organizations to jointly strengthen security measures. The unauthorized access tracking department can, for example, share the results of tracing the route and cause of unauthorized access with other companies and organizations to jointly strengthen security measures. For example, by sharing abnormal behavior patterns and countermeasures, security measures can be strengthened. Sharing with other companies and organizations - The specific method and content of sharing with other companies and organizations must be clarified. For example, using a data sharing platform or conducting joint research. This allows security measures to be strengthened by sharing tracing results with other companies and organizations.

[0083] The unauthorized access tracking department can reflect the results of tracing the route and cause of unauthorized access in employee education programs, thereby improving security awareness. The unauthorized access tracking department can, for example, reflect the results of tracing the route and cause of unauthorized access in employee education programs, thereby improving security awareness. For example, security education is provided to employees based on cases of detected abnormal behavior. Reflection in education programs - The specific methods and content for reflecting the results in education programs must be clarified. For example, updating training content, adding practical exercises, etc. In this way, reflecting the tracing results in education programs can improve employee security awareness.

[0084] The unauthorized access tracking unit can use the emotion estimation function to monitor the emotional state of employees who have committed unauthorized access in real time and propose measures to prevent recurrence. The unauthorized access tracking unit can, for example, use the emotion estimation function to monitor the emotional state of employees who have committed unauthorized access in real time and propose measures to prevent recurrence. For example, it can analyze the employee's facial expressions and voice and propose appropriate measures to prevent recurrence if stress or dissatisfaction is increasing. Real-time monitoring of emotional state - It is necessary to clarify the specific methods and technologies for monitoring emotional state in real time. For example, the use of biometric sensors, real-time data analysis, etc. This makes it possible to monitor the emotional state of employees who have committed unauthorized access in real time and propose measures to prevent recurrence, thereby preventing recurrence.

[0085] The recurrence prevention measure proposal unit can propose effective measures by learning from past cases of unauthorized access when proposing recurrence prevention measures. For example, the recurrence prevention measure proposal unit learns from past cases of unauthorized access when proposing recurrence prevention measures, and the generation AI proposes effective measures. For example, past unauthorized access patterns are analyzed to identify effective recurrence prevention measures. Past unauthorized access cases - The specific content and collection method of past unauthorized access cases must be clarified. For example, past log data, records of security incidents, etc. In this way, by learning from past cases of unauthorized access, effective recurrence prevention measures can be proposed.

[0086] The recurrence prevention measure proposal unit can also take into account abnormal network traffic patterns when proposing recurrence prevention measures, allowing it to propose comprehensive measures. For example, the recurrence prevention measure proposal unit can take into account abnormal network traffic patterns when proposing recurrence prevention measures, and the generation AI can propose comprehensive measures. For example, it can analyze abnormal data transfer volumes and communication patterns to identify effective recurrence prevention measures. Abnormal network traffic patterns - It is necessary to clarify the specific definition and detection method of abnormal network traffic patterns. For example, the number of abnormal packets, abnormal communication destinations, etc. This makes it possible to propose comprehensive recurrence prevention measures by taking into account abnormal network traffic patterns.

[0087] The recurrence prevention measure proposal unit can analyze the emotional state of an employee using the emotion estimation function and propose appropriate recurrence prevention measures when stress or dissatisfaction is rising. The recurrence prevention measure proposal unit, for example, uses the emotion estimation function to analyze the emotional state of an employee and proposes appropriate recurrence prevention measures when stress or dissatisfaction is rising. For example, it analyzes the employee's facial expressions and voice and proposes measures to reduce stress. When stress or dissatisfaction is rising - It is necessary to clarify specific criteria and detection methods for when stress or dissatisfaction is rising. For example, when a certain stress level is exceeded, or when there are continuous expressions of dissatisfaction. In this way, by analyzing the emotional state of an employee and proposing appropriate recurrence prevention measures when stress or dissatisfaction is rising, it is possible to prevent recurrence.

[0088] The Recurrence Prevention Measures Proposal Department can share proposed recurrence prevention measures with other companies and organizations to jointly strengthen security measures. The Recurrence Prevention Measures Proposal Department can, for example, share proposed recurrence prevention measures with other companies and organizations to jointly strengthen security measures. For example, sharing effective recurrence prevention measures to strengthen security measures. Sharing with other companies and organizations - The specific method and content of sharing with other companies and organizations must be clarified. For example, using a data sharing platform, conducting joint research, etc. In this way, security measures can be strengthened by sharing recurrence prevention measures with other companies and organizations.

[0089] The Recurrence Prevention Measures Proposal Department can reflect the proposed recurrence prevention measures in employee training programs to improve security awareness. The Recurrence Prevention Measures Proposal Department can, for example, reflect the proposed recurrence prevention measures in employee training programs to improve security awareness. For example, provide security education to employees based on effective recurrence prevention measures. Reflection in training programs - The specific methods and content for reflecting the measures in the training programs must be clarified. For example, updating training content, adding practical exercises, etc. In this way, by reflecting the proposed recurrence prevention measures in the training programs, it is possible to improve employee security awareness.

[0090] The recurrence prevention measure proposal unit can use the emotion estimation function to monitor the emotional state of employees in real time and provide feedback to elicit positive emotions. The recurrence prevention measure proposal unit, for example, uses the emotion estimation function to monitor the emotional state of employees in real time and provide feedback to elicit positive emotions. For example, it analyzes the employee's facial expressions and voice and provides positive feedback. Feedback to elicit positive emotions - The specific content and method of feedback to elicit positive emotions needs to be clarified. For example, providing compliments, advice to improve motivation, etc. In this way, it is possible to improve employee motivation by monitoring the emotional state of employees in real time and providing feedback to elicit positive emotions.

[0091] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0092] The activity monitoring unit can also use employee activity data for health management purposes, monitoring employee health. For example, it can analyze employees' work hours and break times to detect signs of overwork. Data for health management - The specific types of data for health management and how it will be used need to be clarified. For example, balance of work hours, frequency of breaks, etc. By monitoring employee health, overwork and health risks can be detected early and appropriate measures can be taken.

[0093] The Activity Monitoring Department can use employee activity data to evaluate team cooperation and make suggestions for team building. For example, it can analyze the frequency of communication between employees and the status of collaborative work to evaluate team cooperation. Team building suggestions - The specific content and methods of team building suggestions need to be clarified. For example, proposing workshops to improve teamwork or introducing communication tools. This allows the evaluation of team cooperation and making suggestions for team building to improve team performance.

[0094] The activity monitoring unit uses the emotion estimation function to monitor the emotional state of employees and can provide feedback to improve motivation if the employee's motivation is declining. For example, it can analyze the employee's facial expressions and voice and provide encouraging messages or advice to improve motivation if their motivation is declining. This makes it possible to maintain and improve employee performance by monitoring the employee's emotional state and providing appropriate feedback if their motivation is declining.

[0095] The Activity Monitoring Department can also use employee activity data for business risk management, enabling early risk detection and countermeasures. For example, it can analyze employee work content and work environment to identify high-risk behaviors and environments. Data for risk management - The specific types of data for risk management and how it will be used must be clarified. For example, the frequency of dangerous work, the safety of the work environment, etc. This will strengthen business risk management, enable early risk detection and countermeasures, and provide a safe work environment.

[0096] The activity monitoring unit uses an emotion estimation function to monitor the emotional state of employees and can assign tasks according to their emotional state. For example, it can analyze an employee's facial expressions and voice and, if stress levels are high, adjust tasks by assigning them to less demanding tasks. This allows for tasks that take into account the employee's emotional state, reducing employee stress and improving work efficiency.

[0097] The Activity Monitoring Department can also use employee activity data for project management, allowing them to grasp the progress of a project in real time. For example, they can analyze employees' working hours and task completion status to evaluate the progress of a project. Data for project management - The specific types of data for project management and how it will be used must be clarified. For example, task progress, work time allocation, etc. This allows them to grasp the progress of a project in real time and take appropriate measures to improve the success rate of the project.

[0098] The activity monitoring unit uses the emotion estimation function to monitor employees' emotional states and can make suggestions for improving communication based on the employees' emotional states. For example, it can analyze employees' facial expressions and voices and, if communication is lacking, make suggestions to increase opportunities for communication. This makes it possible to improve the atmosphere in the workplace by making suggestions for improving communication that take into account the employees' emotional states.

[0099] The Activity Monitoring Department can also use employee activity data as data for skill development and make suggestions for improving employees' skills. For example, it can analyze employees' work content and the tools they use to identify areas where skills are lacking. Data for skill development - The specific type of data for skill development and how it will be used must be clarified. For example, details of work content, frequency of tool use, etc. This will allow suggestions for improving employees' skills to be made, promoting employee growth and improving the quality of work.

[0100] The activity monitoring unit uses the emotion estimation function to monitor the emotional state of employees and can suggest break times based on their emotional state. For example, it can analyze an employee's facial expressions and voice and suggest a break if fatigue accumulates. This allows the system to suggest break times that take into account the employee's emotional state, thereby maintaining employee health and improving work efficiency.

[0101] The activity monitoring department can also use employee activity data as data for environmental improvements and make suggestions for improving the work environment. For example, it can analyze employees' work locations and environments and make suggestions for providing a comfortable work environment. Data for environmental improvement - The specific types of data for environmental improvement and how it will be used must be clarified. For example, the temperature and lighting conditions of the work area. This can improve the work environment by making suggestions for improving it, thereby improving employee comfort and increasing work efficiency.

[0102] The processing flow of the second embodiment will be briefly explained below.

[0103] Step 1: Activity monitoring monitors employee activity in real time, collecting information such as which files employees access, which websites they visit, and which applications they use. Step 2: The Suspicious Behavior Detection Unit detects suspicious behavior from the activities monitored by the Activity Monitoring Unit, such as downloading large amounts of data at unusual times or accessing files that are not normally accessed. Step 3: The warning unit issues a warning based on the abnormality detected by the suspicious behavior detection unit. For example, it may issue a warning such as, "Suspicious access has been detected. Please change your password immediately." Step 4: The countermeasure proposal section proposes appropriate countermeasures based on the warning sent by the warning sending section. For example, it proposes specific countermeasures such as "strengthen firewall settings" or "introduce two-factor authentication."

[0104] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0105] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> Examples of generative AIs include the data generation model 58, such as a neural network model (e.g., a neural network model), and a neural network model (e.g., a neural network model). The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating speech, text data indicating text, and image data indicating an image is also input to the data generation model 58. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specification processing unit 290 performs the above-mentioned specification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0106] Furthermore, the processing by the data processing system 10 described above is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart device 14, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart device 14. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information necessary for processing from the smart device 14 or an external device, and the smart device 14 acquires or collects information necessary for processing from the data processing device 12 or an external device.

[0107] [Second embodiment] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0108] 3, the data processing system 210 includes a data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0109] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0110] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0111] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0112] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0113] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0114] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0115] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0116] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0117] In the smart glasses 214, the specific processing is performed by the processor 46. A specific processing program 60 is stored in the storage 50. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. Note that the smart glasses 214 may have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59.

[0118] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0119] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0120] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0121] The data processing system 210 according to the second embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 210 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart glasses 214, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart glasses 214. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the smart glasses 214 or an external device, etc., and the smart glasses 214 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0122] [Third embodiment] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[0123] 5, the data processing system 310 includes the data processing device 12 and a headset type terminal 314. An example of the data processing device 12 is a server.

[0124] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0125] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[0126] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0127] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0128] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0129] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0130] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0131] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0132] In the headset type terminal 314, the identification process is performed by the processor 46. A identification program 60 is stored in the storage 50. The processor 46 reads the identification program 60 from the storage 50 and executes the read identification program 60 on the RAM 48. The identification process is realized by the processor 46 operating as a control unit 46A in accordance with the identification program 60 executed on the RAM 48. Note that the headset type terminal 314 may also have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59.

[0133] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0134] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0135] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0136] The data processing system 310 according to the third embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 310 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the headset type terminal 314, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the headset type terminal 314. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the headset type terminal 314 or an external device, etc., and the headset type terminal 314 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0137] [Fourth embodiment] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[0138] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0139] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0140] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[0141] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0142] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS image sensor or a CCD image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0143] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0144] The control object 443 includes a display device, LEDs in the eyes, and motors that drive the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[0145] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0146] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0147] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0148] In the robot 414, the processor 46 performs the identification process. A identification program 60 is stored in the storage 50. The processor 46 reads the identification program 60 from the storage 50 and executes the read identification program 60 on the RAM 48. The identification process is realized by the processor 46 operating as a control unit 46A in accordance with the identification program 60 executed on the RAM 48. The robot 414 may have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59.

[0149] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0150] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0151] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0152] The data processing system 410 according to the fourth embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 410 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the robot 414, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the robot 414. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the robot 414 or an external device, etc., and the robot 414 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0153] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[0154] FIG. 9 illustrates an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and behaviors arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion encompasses both emotions and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[0155] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[0156] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[0157] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is expressed, and when they approach the ideal, a state of pleasure is expressed. Emotions can also be created for robots, cars, and motorcycles, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is expressed, and when they approach the ideal, a state of pleasure is expressed. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on speech emotion recognition and brain physiological signal analysis systems for emotions, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the area called "reaction," where sensation is dominant. The right half of the emotion map lists emotions belonging to the area called "situation," where situational awareness is dominant.

[0158] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[0159] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[0160] In the above embodiment, an example was given in which a specific process is performed by one computer 22, but the technology disclosed herein is not limited to this, and distributed processing of the specific process may be performed by multiple computers including computer 22.

[0161] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[0162] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[0163] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[0164] The hardware resource for executing a specific process can be any of the following types of processors: A processor, for example, is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. A processor also includes a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[0165] The hardware resource that executes the specific process may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific process may be a single processor.

[0166] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[0167] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[0168] In the above example, the first to fourth embodiments have been described separately, but some or all of these embodiments may be combined. The smart device 14, smart glasses 214, headset terminal 314, and robot 414 are merely examples, and they may be combined, or other devices may be used. In the above example, the first and second embodiments have been described separately, but they may be combined.

[0169] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[0170] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference. [Explanation of symbols]

[0171] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot

Claims

1. an activity monitoring department that monitors employee activities in real time; a suspicious behavior detection unit that detects suspicious behavior from the activities monitored by the activity monitoring unit; a warning issuing unit that issues a warning based on an abnormality detected by the suspicious behavior detection unit; a countermeasure suggestion unit that suggests appropriate countermeasures based on the warning issued by the warning issuing unit. A system characterized by:

2. The activity monitoring unit The employee activity data is linked to other security systems to provide comprehensive security monitoring.

2. The system of claim 1.

3. The suspicious behavior detection unit The suspicious behavior detection algorithm will be trained on past cases of unauthorized access to further enhance its detection capabilities.

2. The system of claim 1.

4. The warning issuing unit When issuing the warning, the company will refer to the employee's past behavior history and propose individually customized countermeasures.

2. The system of claim 1.

5. The unauthorized access tracking department When tracing the route and cause of unauthorized access, refer to past cases of unauthorized access and identify similar patterns.

2. The system of claim 1.

6. The Recurrence Prevention Measures Proposal Department Analyze the employee's emotional state and, if stress or dissatisfaction is increasing, propose appropriate measures to prevent recurrence.

2. The system of claim 1.

7. The activity monitoring unit Monitor the employee's emotional state and issue alerts when stress or frustration is building 2. The system of claim 1.

Images