System

Abstract

An object of the system according to the embodiment is to analyze a suspicious mail or link and automatically detect a phishing scam.SOLUTION: A system includes a mail analysis part, a link analysis part, a phishing detection part, and a warning part. The mail analysis unit analyzes contents of a suspicious mail. The link analysis unit analyzes a link of the mail analyzed by the mail analysis unit. The phishing detection part detects phishing fraud based on the content of the link analyzed by the link analysis part. The warning unit issues a warning to the user based on the suspicious element detected by the phishing detection unit.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] Conventional technologies do not adequately analyze suspicious emails and links automatically to detect phishing scams, and there is room for improvement.

[0005] The system according to the embodiment aims to analyze suspicious emails and links and automatically detect phishing scams. [Means for solving the problem]

[0006] The system according to the embodiment includes a mail analysis unit, a link analysis unit, a phishing detection unit, and a warning unit. The mail analysis unit analyzes the content of suspicious mail. The link analysis unit analyzes links in mail analyzed by the mail analysis unit. The phishing detection unit detects phishing scams based on the content of the links analyzed by the link analysis unit. The warning unit issues a warning to the user based on suspicious elements detected by the phishing detection unit. [Effects of the Invention]

[0007] The system according to the embodiment can analyze suspicious emails and links and automatically detect phishing scams. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10]1 shows an emotion map onto which multiple emotions are mapped. DETAILED DESCRIPTION OF THE INVENTION

[0009] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0010] First, the terms used in the following description will be explained.

[0011] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, the processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), an APU (Accelerated Processing Unit), or a TPU (Tensor Processing Unit).

[0012] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0013] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0014] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), and Bluetooth (registered trademark).

[0015] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0016] [First embodiment] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0017] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0018] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0019] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0020] The reception device 38 includes a touch panel 38A and a microphone 38B, and receives user input. The touch panel 38A detects contact with a pointer (for example, a pen or a finger) to receive user input by the touch of the pointer. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 (see FIG. 2) acquires the data indicating the user input.

[0021] Output device 40 includes a display 40A and a speaker 40B, and presents data to a user by outputting the data in a form of expression that the user can perceive (e.g., audio and / or text). Display 40A displays visible information such as text and images in accordance with instructions from processor 46. Speaker 40B outputs audio in accordance with instructions from processor 46. Camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0022] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0023] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0024] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0025] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0026] In the smart device 14, the specific processing is performed by the processor 46. The storage 50 stores a specific processing program 60. The specific processing program 60 is used together with the specific processing program 56 by the data processing system 10. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. Note that the smart device 14 may have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59.

[0027] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device (e.g., a generation server) may have the data generation model 58. In this case, the data processing device 12 obtains a processing result (prediction result, etc.) using the data generation model 58 by communicating with the server device having the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device owned by a user (e.g., a mobile phone, a robot, a home appliance, etc.). Next, an example of processing by the data processing system 10 according to the first embodiment will be described.

[0028] (Example 1) A security system according to an embodiment of the present invention utilizes generative AI technology to detect social engineering attacks. This system automatically detects suspicious email content and links, as well as fraudulent activities such as phishing scams, and issues a warning to the user. This allows the security system to ensure a safe online environment for users and protect personal information and assets.

[0029] A security system according to an embodiment includes an email analysis unit, a link analysis unit, a phishing detection unit, and a warning unit. The email analysis unit analyzes the content of suspicious emails. For example, the generation AI analyzes the content of emails received by a user and detects suspicious elements. The generation AI detects, for example, unnatural wording in the email body or a spoofed sender address. The link analysis unit analyzes links in emails analyzed by the email analysis unit. For example, the generation AI analyzes links included in emails or web pages and detects suspicious links. The generation AI detects, for example, cases where the linked URL is an unreliable domain or the linked page is a phishing site. The phishing detection unit detects phishing scams based on the content of the links analyzed by the link analysis unit. For example, the generation AI detects fraudulent activities due to phishing scams. The generation AI detects, for example, fake login pages and fake payment pages. The warning unit issues a warning to the user based on the suspicious elements detected by the phishing detection unit. For example, if the generation AI detects a suspicious email, link, or phishing scam, it issues a warning to the user. The generation AI warns the user, for example, via a pop-up notification or email notification. As a result, the security system according to the embodiment can ensure a safe online environment for users and protect personal information and assets. For example, by detecting suspicious emails or links in advance, users can reduce the risk of falling victim to phishing scams. Furthermore, by issuing a warning to users, it is possible to raise their awareness of security.

[0030] The email analysis unit can identify suspicious behavior by analyzing the sender's past behavioral history and email sending patterns. For example, the email analysis unit uses a generation AI to analyze the sender's past email sending history and identify behavior that deviates from normal sending patterns. For example, it can detect when an email that is usually sent during business hours is sent late at night. This allows the system to identify abnormal behavior by the sender and detect suspicious emails with greater accuracy.

[0031] The email analysis unit can analyze images and attachments included in email content and detect suspicious elements using image recognition technology. For example, the email analysis unit uses a generation AI to analyze image files attached to emails and detect suspicious elements using image recognition technology. For example, it can identify fake logos and images that have been unnaturally edited. This makes it possible to detect suspicious elements included in images and attachments and detect suspicious emails with higher accuracy.

[0032] The email analysis unit covers a wide range of communication methods, not only analyzing email content but also messages on social media and chat apps. For example, the generation AI analyzes messages on Facebook and WhatsApp to detect suspicious content. This covers a wide range of communication methods, making it possible to detect more suspicious messages.

[0033] The email analysis unit can share the results of suspicious email detection with a company's security team in real time, enabling a rapid response. For example, the email analysis unit's generation AI can share the results of suspicious email detection with a company's security team in real time. For example, it can notify the security team of detailed information about the detected suspicious email. This allows for a rapid response by sharing the results of suspicious email detection in real time.

[0034] The link analysis unit analyzes the content of linked pages in real time and can identify phishing sites from the page structure and content. For example, the link analysis unit uses a generation AI to analyze the content of linked pages in real time and identify phishing sites from the page structure and content. For example, it detects layouts and designs that differ from legitimate login pages. This allows the content of linked pages to be analyzed in real time and phishing sites to be identified, ensuring user safety.

[0035] The link analysis unit can identify suspicious links by analyzing not only the URL of the linked site but also the metadata and redirect history associated with the link. For example, the link analysis unit can identify suspicious links by analyzing not only the URL of the linked site but also the metadata and redirect history associated with the link. For example, it can detect links that go through multiple redirects. This ensures user safety by analyzing the metadata and redirect history associated with the link and identifying suspicious links.

[0036] The link analysis unit can provide the results of detection of suspicious links as a browser extension and display a warning before the user clicks on the link. For example, the link analysis unit can provide the results of detection of suspicious links by the generation AI as a browser extension and display a warning before the user clicks on the link. For example, a warning message can be displayed when the mouse hovers over a link. In this way, the detection results of suspicious links can be provided as a browser extension and a warning can be displayed before the user clicks on the link, ensuring user safety.

[0037] The link analysis unit can reflect the results of suspicious link detection in a company's security policy and automatically update link filtering rules. For example, the link analysis unit reflects the results of suspicious link detection by the generation AI in a company's security policy and automatically updates link filtering rules. For example, newly detected suspicious domains are added to a filtering list. This reflects the results of suspicious link detection in a company's security policy and automatically updates link filtering rules, strengthening security across the entire company.

[0038] The phishing detection unit can analyze the design and layout of a phishing site and identify differences from legitimate sites. For example, the phishing detection unit uses a generative AI to analyze the design and layout of a phishing site and identify differences from legitimate sites. For example, it detects unnatural button placements and color usage not found on legitimate sites. This allows the unit to analyze the design and layout of a phishing site and identify differences from legitimate sites, improving the accuracy of phishing fraud detection.

[0039] The phishing detection unit can analyze a user's past browsing history and behavioral patterns to identify abnormal behavior. For example, the generation AI analyzes a user's past browsing history and behavioral patterns to identify abnormal behavior. For example, it can detect when a user suddenly accesses a site that is not normally accessed. This allows the system to analyze a user's past browsing history and behavioral patterns and identify abnormal behavior, thereby improving the accuracy of phishing scam detection.

[0040] The phishing detection unit can apply the results of phishing detection to mobile and desktop apps, ensuring protection across all devices. For example, the generative AI can detect phishing scams on smartphones and tablets. This allows the results of phishing detection to be applied to mobile and desktop apps, ensuring protection across all devices and ensuring user safety.

[0041] The phishing detection unit can reflect the results of phishing detection in a company's security education program, thereby improving employees' security awareness. For example, the phishing detection unit uses a generative AI to reflect the results of phishing detection in a company's security education program, thereby improving employees' security awareness. For example, detected phishing cases can be added to education materials. In this way, the results of phishing detection can be reflected in a company's security education program, improving employees' security awareness and strengthening the security of the entire company.

[0042] The warning unit can customize the content of the warning message based on the user's level of understanding and past reactions to provide an effective warning. For example, the generation AI customizes the content of the warning message based on the user's level of understanding and past reactions to provide an effective warning. For example, the message is adjusted based on the user's reaction when receiving a similar warning in the past. In this way, the content of the warning message can be customized based on the user's level of understanding and past reactions to provide an effective warning, thereby deepening the user's understanding and encouraging a prompt response.

[0043] The warning unit can include specific countermeasures and next steps in the warning message, allowing the user to respond immediately. For example, the generation AI can include specific countermeasures and next steps in the warning message, allowing the user to respond immediately. For example, it can present steps for deleting suspicious emails and how to change passwords. In this way, including specific countermeasures and next steps in the warning message allows the user to respond immediately, encouraging a quick response.

[0044] The warning unit provides a warning message through a voice assistant or smart speaker, making it possible to accommodate the visually impaired and elderly. For example, the generation AI provides a warning message through a voice assistant or smart speaker, making it possible to accommodate the visually impaired and elderly. For example, the warning message is delivered aloud through Amazon Alexa or Google Home. This allows the warning message to be provided through a voice assistant or smart speaker, making it possible to accommodate the visually impaired and elderly, providing effective warnings to a greater number of users.

[0045] The warning unit can integrate warning messages into a company's security dashboard, allowing administrators to grasp the warning status of all users at a glance. For example, the warning unit uses a generation AI to integrate warning messages into a company's security dashboard, allowing administrators to grasp the warning status of all users at a glance. For example, the warning history of each user is displayed on the dashboard. This allows warning messages to be integrated into a company's security dashboard, allowing administrators to grasp the warning status of all users at a glance, thereby strengthening security management across the company.

[0046] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0047] The security system can further include a behavior analysis unit that analyzes a user's behavior history. The behavior analysis unit, for example, analyzes the patterns of websites and applications that a user normally accesses and identifies abnormal behavior. For example, it detects access to a specific site during a time when access is not normally made, or access from a device that is not normally used. This allows the system to identify abnormal behavior based on the user's behavior patterns and detect suspicious behavior with greater accuracy.

[0048] The security system may further include a biometric authentication unit that analyzes the user's biometric information. The biometric authentication unit authenticates the user using biometric information such as fingerprints, facial recognition, or voiceprints. For example, fingerprint authentication is required when opening an email, preventing unauthorized access. This authentication using biometric information strengthens security and prevents unauthorized access.

[0049] The security system may further include a device monitoring unit that monitors the security status of the user's device. The device monitoring unit, for example, monitors the status of the device's virus scan or firewall, and issues a warning if an abnormality is detected. For example, a warning is displayed if a virus infection is suspected or if the firewall is disabled. This allows the security status of the device to be monitored, and a prompt response can be taken if an abnormality is detected.

[0050] The security system may further include a network analysis unit that analyzes the user's network traffic. The network analysis unit may, for example, analyze the user's network traffic in real time to detect suspicious traffic. For example, it may detect large amounts of data transmission that do not normally occur or suspicious connections to specific IP addresses. This allows the security system to strengthen by analyzing network traffic and detecting suspicious traffic.

[0051] The security system may further include an environment monitoring unit that monitors the user's physical environment. The environment monitoring unit may monitor the physical environment using, for example, surveillance cameras and sensors in an office or home. For example, the environment monitoring unit may detect the intrusion of a suspicious person or abnormal behavior. This allows for enhanced security by monitoring the physical environment and detecting suspicious behavior.

[0052] The processing flow of the first embodiment will be briefly explained below.

[0053] Step 1: The email analysis unit analyzes the contents of the suspicious email. For example, the generation AI analyzes the contents of the email received by the user and detects suspicious elements. For example, the generation AI detects unnatural wording in the body of the email or cases where the sender's address is forged. Step 2: The link analysis unit analyzes the links in the email analyzed by the email analysis unit. For example, the generation AI analyzes links contained in emails and web pages to detect suspicious links. For example, the generation AI detects when the linked URL is from an untrusted domain or when the linked page is a phishing site. Step 3: The phishing detection unit detects phishing scams based on the content of the links analyzed by the link analysis unit. For example, the generation AI detects fraudulent activities through phishing scams. For example, the generation AI detects fake login pages, fake payment pages, etc. Step 4: The warning unit issues a warning to the user based on the suspicious elements detected by the phishing detection unit. For example, if the generation AI detects a suspicious email, link, or phishing scam, it will issue a warning to the user. The generation AI will warn the user, for example, through a pop-up notification or email notification.

[0054] (Example 2) A security system according to an embodiment of the present invention utilizes generative AI technology to detect social engineering attacks. This system automatically detects suspicious email content and links, as well as fraudulent activities such as phishing scams, and issues a warning to the user. This allows the security system to ensure a safe online environment for users and protect personal information and assets.

[0055] A security system according to an embodiment includes an email analysis unit, a link analysis unit, a phishing detection unit, and a warning unit. The email analysis unit analyzes the content of suspicious emails. For example, the generation AI analyzes the content of emails received by a user and detects suspicious elements. The generation AI detects, for example, unnatural wording in the email body or a spoofed sender address. The link analysis unit analyzes links in emails analyzed by the email analysis unit. For example, the generation AI analyzes links included in emails or web pages and detects suspicious links. The generation AI detects, for example, cases where the linked URL is an unreliable domain or the linked page is a phishing site. The phishing detection unit detects phishing scams based on the content of the links analyzed by the link analysis unit. For example, the generation AI detects fraudulent activities due to phishing scams. The generation AI detects, for example, fake login pages and fake payment pages. The warning unit issues a warning to the user based on the suspicious elements detected by the phishing detection unit. For example, if the generation AI detects a suspicious email, link, or phishing scam, it issues a warning to the user. The generation AI warns the user, for example, via a pop-up notification or email notification. As a result, the security system according to the embodiment can ensure a safe online environment for users and protect personal information and assets. For example, by detecting suspicious emails or links in advance, users can reduce the risk of falling victim to phishing scams. Furthermore, by issuing a warning to users, it is possible to raise their awareness of security.

[0056] The email analysis unit can identify suspicious behavior by analyzing the sender's past behavioral history and email sending patterns. For example, the email analysis unit uses a generation AI to analyze the sender's past email sending history and identify behavior that deviates from normal sending patterns. For example, it can detect when an email that is usually sent during business hours is sent late at night. This allows the system to identify abnormal behavior by the sender and detect suspicious emails with greater accuracy.

[0057] The email analysis unit can analyze images and attachments included in email content and detect suspicious elements using image recognition technology. For example, the email analysis unit uses a generation AI to analyze image files attached to emails and detect suspicious elements using image recognition technology. For example, it can identify fake logos and images that have been unnaturally edited. This makes it possible to detect suspicious elements included in images and attachments and detect suspicious emails with higher accuracy.

[0058] The email analysis unit uses the emotion estimation function to infer the sender's intentions and emotions from the email content and can identify malicious emails. For example, the email analysis unit uses the generative AI to analyze the email content and then uses the emotion estimation function to infer the sender's intentions and emotions. For example, it can detect aggressive or threatening emotions from the email text. This makes it possible to infer the sender's intentions and emotions and identify malicious emails, enabling more accurate detection of suspicious emails.

[0059] The email analysis unit covers a wide range of communication methods, not only analyzing email content but also messages on social media and chat apps. For example, the generation AI analyzes messages on Facebook and WhatsApp to detect suspicious content. This covers a wide range of communication methods, making it possible to detect more suspicious messages.

[0060] The email analysis unit can share the results of suspicious email detection with a company's security team in real time, enabling a rapid response. For example, the email analysis unit's generation AI can share the results of suspicious email detection with a company's security team in real time. For example, it can notify the security team of detailed information about the detected suspicious email. This allows for a rapid response by sharing the results of suspicious email detection in real time.

[0061] The email analysis unit can use the emotion estimation function to analyze the user's emotional response to the email they received and provide advice to reduce stress and anxiety. For example, the email analysis unit uses a generation AI to analyze the user's emotional response to the email they received and provide advice to reduce stress and anxiety. For example, it suggests breathing techniques or stretching to help them relax. This reduces the user's psychological burden by analyzing the user's emotional response and providing advice to reduce stress and anxiety.

[0062] The link analysis unit analyzes the content of linked pages in real time and can identify phishing sites from the page structure and content. For example, the link analysis unit uses a generation AI to analyze the content of linked pages in real time and identify phishing sites from the page structure and content. For example, it detects layouts and designs that differ from legitimate login pages. This allows the content of linked pages to be analyzed in real time and phishing sites to be identified, ensuring user safety.

[0063] The link analysis unit can identify suspicious links by analyzing not only the URL of the linked site but also the metadata and redirect history associated with the link. For example, the link analysis unit can identify suspicious links by analyzing not only the URL of the linked site but also the metadata and redirect history associated with the link. For example, it can detect links that go through multiple redirects. This ensures user safety by analyzing the metadata and redirect history associated with the link and identifying suspicious links.

[0064] The link analysis unit uses the emotion estimation function to analyze the user's emotional response when clicking on a link and can identify dangerous links. For example, the link analysis unit analyzes the user's emotional response when the generation AI clicks on a link and identifies dangerous links. For example, it detects the anxiety or doubt felt by the user when clicking on a link. This ensures the user's safety by analyzing the user's emotional response and identifying dangerous links.

[0065] The link analysis unit can provide the results of detection of suspicious links as a browser extension and display a warning before the user clicks on the link. For example, the link analysis unit can provide the results of detection of suspicious links by the generation AI as a browser extension and display a warning before the user clicks on the link. For example, a warning message can be displayed when the mouse hovers over a link. In this way, the detection results of suspicious links can be provided as a browser extension and a warning can be displayed before the user clicks on the link, ensuring user safety.

[0066] The link analysis unit can reflect the results of suspicious link detection in a company's security policy and automatically update link filtering rules. For example, the link analysis unit reflects the results of suspicious link detection by the generation AI in a company's security policy and automatically updates link filtering rules. For example, newly detected suspicious domains are added to a filtering list. This reflects the results of suspicious link detection in a company's security policy and automatically updates link filtering rules, strengthening security across the entire company.

[0067] The link analysis unit can use the emotion estimation function to provide an interactive guide to reduce anxiety or doubt when the user clicks on a link. For example, the link analysis unit uses the emotion estimation function to provide an interactive guide to reduce anxiety or doubt when the user clicks on a link. For example, the link analysis unit displays steps to confirm the safety of the link. This provides an interactive guide to reduce anxiety or doubt when the user clicks on a link, thereby increasing the user's sense of security.

[0068] The phishing detection unit can analyze the design and layout of a phishing site and identify differences from legitimate sites. For example, the phishing detection unit uses a generative AI to analyze the design and layout of a phishing site and identify differences from legitimate sites. For example, it detects unnatural button placements and color usage not found on legitimate sites. This allows the unit to analyze the design and layout of a phishing site and identify differences from legitimate sites, improving the accuracy of phishing fraud detection.

[0069] The phishing detection unit can analyze a user's past browsing history and behavioral patterns to identify abnormal behavior. For example, the generation AI analyzes a user's past browsing history and behavioral patterns to identify abnormal behavior. For example, it can detect when a user suddenly accesses a site that is not normally accessed. This allows the system to analyze a user's past browsing history and behavioral patterns and identify abnormal behavior, thereby improving the accuracy of phishing scam detection.

[0070] The phishing detection unit uses the emotion estimation function to analyze the emotional response of users when they access a phishing site and identify fraudulent sites. For example, the phishing detection unit uses a generation AI to analyze the emotional response of users when they access a phishing site and identify fraudulent sites. For example, it detects the anxiety and doubt that users feel when accessing a site. This improves the accuracy of phishing detection by analyzing users' emotional responses and identifying fraudulent sites.

[0071] The phishing detection unit can apply the results of phishing detection to mobile and desktop apps, ensuring protection across all devices. For example, the generative AI can detect phishing scams on smartphones and tablets. This allows the results of phishing detection to be applied to mobile and desktop apps, ensuring protection across all devices and ensuring user safety.

[0072] The phishing detection unit can reflect the results of phishing detection in a company's security education program, thereby improving employees' security awareness. For example, the phishing detection unit uses a generative AI to reflect the results of phishing detection in a company's security education program, thereby improving employees' security awareness. For example, detected phishing cases can be added to education materials. In this way, the results of phishing detection can be reflected in a company's security education program, improving employees' security awareness and strengthening the security of the entire company.

[0073] The phishing detection unit can use the emotion estimation function to analyze the emotional reactions of users who receive a phishing warning and provide appropriate support. For example, the phishing detection unit uses a generation AI to analyze the emotional reactions of users who receive a phishing warning and provide appropriate support. For example, the phishing detection unit provides advice to reduce the anxiety and stress that users feel when they receive a warning. In this way, by analyzing the emotional reactions of users who receive a phishing warning and providing appropriate support, the psychological burden on users is reduced.

[0074] The warning unit can customize the content of the warning message based on the user's level of understanding and past reactions to provide an effective warning. For example, the generation AI customizes the content of the warning message based on the user's level of understanding and past reactions to provide an effective warning. For example, the message is adjusted based on the user's reaction when receiving a similar warning in the past. In this way, the content of the warning message can be customized based on the user's level of understanding and past reactions to provide an effective warning, thereby deepening the user's understanding and encouraging a prompt response.

[0075] The warning unit can include specific countermeasures and next steps in the warning message, allowing the user to respond immediately. For example, the generation AI can include specific countermeasures and next steps in the warning message, allowing the user to respond immediately. For example, it can present steps for deleting suspicious emails and how to change passwords. In this way, including specific countermeasures and next steps in the warning message allows the user to respond immediately, encouraging a quick response.

[0076] The warning unit can use the emotion estimation function to analyze the user's emotional reaction when receiving a warning message and provide advice to reduce stress. For example, the warning unit analyzes the user's emotional reaction when the generation AI receives a warning message and provides advice to reduce stress. For example, it suggests breathing techniques or stretching to help relax. In this way, the user's emotional reaction when receiving a warning message is analyzed and advice to reduce stress is provided, thereby reducing the user's psychological burden.

[0077] The warning unit provides a warning message through a voice assistant or smart speaker, making it possible to accommodate the visually impaired and elderly. For example, the generation AI provides a warning message through a voice assistant or smart speaker, making it possible to accommodate the visually impaired and elderly. For example, the warning message is delivered aloud through Amazon Alexa or Google Home. This allows the warning message to be provided through a voice assistant or smart speaker, making it possible to accommodate the visually impaired and elderly, providing effective warnings to a greater number of users.

[0078] The warning unit can integrate warning messages into a company's security dashboard, allowing administrators to grasp the warning status of all users at a glance. For example, the warning unit uses a generation AI to integrate warning messages into a company's security dashboard, allowing administrators to grasp the warning status of all users at a glance. For example, the warning history of each user is displayed on the dashboard. This allows warning messages to be integrated into a company's security dashboard, allowing administrators to grasp the warning status of all users at a glance, thereby strengthening security management across the company.

[0079] The warning unit can use the emotion estimation function to adjust the content and timing of the warning message to match the user's emotional state and provide an effective warning. For example, the generation AI uses the emotion estimation function to adjust the content and timing of the warning message to match the user's emotional state and provide an effective warning. For example, a warning can be displayed when the user is relaxed. In this way, the content and timing of the warning message can be adjusted to match the user's emotional state and an effective warning can be provided, thereby reducing the user's psychological burden and encouraging a prompt response.

[0080] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0081] The security system can further include a behavior analysis unit that analyzes a user's behavior history. The behavior analysis unit, for example, analyzes the patterns of websites and applications that a user normally accesses and identifies abnormal behavior. For example, it detects access to a specific site during a time when access is not normally made, or access from a device that is not normally used. This allows the system to identify abnormal behavior based on the user's behavior patterns and detect suspicious behavior with greater accuracy.

[0082] The security system may further include a biometric authentication unit that analyzes the user's biometric information. The biometric authentication unit authenticates the user using biometric information such as fingerprints, facial recognition, or voiceprints. For example, fingerprint authentication is required when opening an email, preventing unauthorized access. This authentication using biometric information strengthens security and prevents unauthorized access.

[0083] The security system may further include a device monitoring unit that monitors the security status of the user's device. The device monitoring unit, for example, monitors the status of the device's virus scan or firewall, and issues a warning if an abnormality is detected. For example, a warning is displayed if a virus infection is suspected or if the firewall is disabled. This allows the security status of the device to be monitored, and a prompt response can be taken if an abnormality is detected.

[0084] The security system may further include a network analysis unit that analyzes the user's network traffic. The network analysis unit may, for example, analyze the user's network traffic in real time to detect suspicious traffic. For example, it may detect large amounts of data transmission that do not normally occur or suspicious connections to specific IP addresses. This allows the security system to strengthen by analyzing network traffic and detecting suspicious traffic.

[0085] The security system may further include an environment monitoring unit that monitors the user's physical environment. The environment monitoring unit may monitor the physical environment using, for example, surveillance cameras and sensors in an office or home. For example, the environment monitoring unit may detect the intrusion of a suspicious person or abnormal behavior. This allows for enhanced security by monitoring the physical environment and detecting suspicious behavior.

[0086] The security system can also estimate the user's emotions and adjust the content of the warning message based on the estimated emotions. For example, if the user is feeling stressed, the warning message can be changed to a more gentle expression. This reduces the user's psychological burden by providing a warning message that is appropriate for the user's emotional state, allowing for more effective warnings.

[0087] The security system can further estimate the user's emotions and assess the risk of phishing based on the estimated emotions. For example, if the user is feeling anxious, the system can determine that the risk of phishing is high and issue a stronger warning. This allows the system to assess the risk of phishing based on the user's emotional state and provide an appropriate warning.

[0088] The security system can also estimate the user's emotions and customize the content of security training based on the estimated emotions. For example, if the user is feeling stressed, the system can provide security training that includes advice on how to relax. This allows for effective security training that is tailored to the user's emotional state.

[0089] The security system can further estimate the user's emotions and warn users about phishing sites based on the estimated emotions. For example, if the user feels suspicious, the system can intensify the warnings about phishing sites. This ensures the user's safety by warning users about phishing sites based on their emotional state.

[0090] The security system can also estimate the user's emotions and adjust the security policy based on the estimated emotions. For example, if the user is relaxed, the security policy can be relaxed. This reduces the user's psychological burden by providing a security policy that corresponds to the user's emotional state, enabling effective security management.

[0091] The processing flow of the second embodiment will be briefly explained below.

[0092] Step 1: The email analysis unit analyzes the contents of the suspicious email. For example, the generation AI analyzes the contents of the email received by the user and detects suspicious elements. For example, the generation AI detects unnatural wording in the body of the email or cases where the sender's address is forged. Step 2: The link analysis unit analyzes the links in the email analyzed by the email analysis unit. For example, the generation AI analyzes links contained in emails and web pages to detect suspicious links. For example, the generation AI detects when the linked URL is from an untrusted domain or when the linked page is a phishing site. Step 3: The phishing detection unit detects phishing scams based on the content of the links analyzed by the link analysis unit. For example, the generation AI detects fraudulent activities through phishing scams. For example, the generation AI detects fake login pages, fake payment pages, etc. Step 4: The warning unit issues a warning to the user based on the suspicious elements detected by the phishing detection unit. For example, if the generation AI detects a suspicious email, link, or phishing scam, it will issue a warning to the user. The generation AI will warn the user, for example, through a pop-up notification or email notification.

[0093] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0094] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> Examples of generative AIs include the data generation model 58, such as a neural network model (e.g., a neural network model), and a neural network model (e.g., a neural network model). The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating speech, text data indicating text, and image data indicating an image is also input to the data generation model 58. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specification processing unit 290 performs the above-mentioned specification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0095] Furthermore, the processing by the data processing system 10 described above is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart device 14, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart device 14. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information necessary for processing from the smart device 14 or an external device, and the smart device 14 acquires or collects information necessary for processing from the data processing device 12 or an external device.

[0096] [Second embodiment] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0097] 3, the data processing system 210 includes the data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0098] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0099] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0100] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0101] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0102] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0103] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0104] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0105] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0106] In the smart glasses 214, the specific processing is performed by the processor 46. A specific processing program 60 is stored in the storage 50. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. Note that the smart glasses 214 may have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59.

[0107] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0108] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0109] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0110] The data processing system 210 according to the second embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 210 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart glasses 214, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart glasses 214. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the smart glasses 214 or an external device, etc., and the smart glasses 214 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0111] [Third embodiment] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[0112] 5, the data processing system 310 includes the data processing device 12 and a headset type terminal 314. An example of the data processing device 12 is a server.

[0113] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0114] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[0115] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0116] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0117] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0118] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0119] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0120] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0121] In the headset type terminal 314, the identification process is performed by the processor 46. A identification program 60 is stored in the storage 50. The processor 46 reads the identification program 60 from the storage 50 and executes the read identification program 60 on the RAM 48. The identification process is realized by the processor 46 operating as a control unit 46A in accordance with the identification program 60 executed on the RAM 48. Note that the headset type terminal 314 may also have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59.

[0122] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0123] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0124] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0125] The data processing system 310 according to the third embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 310 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the headset type terminal 314, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the headset type terminal 314. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the headset type terminal 314 or an external device, etc., and the headset type terminal 314 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0126] [Fourth embodiment] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[0127] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0128] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0129] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[0130] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0131] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS image sensor or a CCD image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0132] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0133] The control object 443 includes a display device, LEDs in the eyes, and motors that drive the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[0134] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0135] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0136] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0137] In the robot 414, the processor 46 performs the identification process. A identification program 60 is stored in the storage 50. The processor 46 reads the identification program 60 from the storage 50 and executes the read identification program 60 on the RAM 48. The identification process is realized by the processor 46 operating as a control unit 46A in accordance with the identification program 60 executed on the RAM 48. The robot 414 may have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59.

[0138] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0139] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0140] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0141] The data processing system 410 according to the fourth embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 410 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the robot 414, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the robot 414. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the robot 414 or an external device, etc., and the robot 414 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0142] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[0143] FIG. 9 illustrates an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and behaviors arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion encompasses both emotions and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[0144] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[0145] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[0146] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is expressed, and when they approach the ideal, a state of pleasure is expressed. Emotions can also be created for robots, cars, and motorcycles, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is expressed, and when they approach the ideal, a state of pleasure is expressed. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on speech emotion recognition and brain physiological signal analysis systems for emotions, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the area called "reaction," where sensation is dominant. The right half of the emotion map lists emotions belonging to the area called "situation," where situational awareness is dominant.

[0147] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[0148] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[0149] In the above embodiment, an example was given in which a specific process is performed by one computer 22, but the technology disclosed herein is not limited to this, and distributed processing of the specific process may be performed by multiple computers including computer 22.

[0150] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[0151] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[0152] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[0153] The hardware resource for executing a specific process can be any of the following types of processors: A processor, for example, is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. A processor also includes a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[0154] The hardware resource that executes the specific process may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific process may be a single processor.

[0155] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[0156] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[0157] In the above example, the first to fourth embodiments have been described separately, but some or all of these embodiments may be combined. The smart device 14, smart glasses 214, headset terminal 314, and robot 414 are merely examples, and they may be combined, or other devices may be used. In the above example, the first and second embodiments have been described separately, but they may be combined.

[0158] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[0159] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference. [Explanation of symbols]

[0160] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot

Claims

1. an email analysis unit that analyzes the contents of suspicious emails; a link analysis unit that analyzes links in the email analyzed by the email analysis unit; a phishing detection unit that detects phishing fraud based on the content of the link analyzed by the link analysis unit; a warning unit that issues a warning to a user based on the suspicious element detected by the phishing detection unit. A system characterized by:

2. The link analysis unit The content of the linked page is analyzed in real time, and phishing sites are identified based on the structure and content of the page.

2. The system of claim 1.

3. The phishing detection unit Analyze the design and layout of the phishing site and identify any differences between it and the legitimate site 2. The system of claim 1.

4. The warning unit The content of the warning message is customized based on the user's level of understanding and past responses, providing an effective warning.

2. The system of claim 1.

5. The email analysis unit Identify malicious emails by inferring the sender's intentions and emotions from the content of the email.

2. The system of claim 1.

6. The link analysis unit Analyzing the user's emotional response when clicking on the link and identifying dangerous links 2. The system of claim 1.

7. The phishing detection unit Analyzing the emotional response of the user when they visit a phishing site and identifying the fraudulent site 2. The system of claim 1.

8. The warning unit Analyzing the user's emotional response when receiving a warning message and providing advice to reduce stress 2. The system of claim 1.

Images