System

Abstract

An object of a system according to an embodiment is to quickly and appropriately cope with a cyberattacks and minimize damage.SOLUTION: A system according to an embodiment includes an cyberattacks detection unit, an attack pattern analysis unit, an automatic handling unit, an interaction automatization unit, and a damage minimization unit. The cyberattacks detection unit detects cyberattacks. The attack pattern analysis unit analyzes the abnormal activity detected by the cyberattacks detection unit and identifies an attack pattern. The automatic handling unit automatically executes an appropriate handling according to the attack pattern specified by the attack pattern analysis unit. The dialog automation unit automates a dialog with an attacker. The damage minimizer takes action to minimize damage to the system.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] Conventional technologies have made it difficult to respond quickly and appropriately to cyber attacks, making it difficult to minimize damage.

[0005] The system according to the embodiment aims to respond quickly and appropriately to cyber attacks and minimize damage. [Means for solving the problem]

[0006] The system according to the embodiment includes a cyber-attack detection unit, an attack pattern analysis unit, an automatic response unit, a dialogue automation unit, and a damage minimization unit. The cyber-attack detection unit detects cyber-attacks. The attack pattern analysis unit analyzes abnormal activity detected by the cyber-attack detection unit and identifies an attack pattern. The automatic response unit automatically executes appropriate responses according to the attack pattern identified by the attack pattern analysis unit. The dialogue automation unit automates dialogue with the attacker. The damage minimization unit takes measures to minimize damage to the system. [Effects of the Invention]

[0007] The system according to the embodiment can respond quickly and appropriately to cyber attacks and minimize damage. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10] 1 shows an emotion map onto which multiple emotions are mapped. DETAILED DESCRIPTION OF THE INVENTION

[0009] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0010] First, the terms used in the following description will be explained.

[0011] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, the processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), an APU (Accelerated Processing Unit), or a TPU (Tensor Processing Unit).

[0012] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0013] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0014] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), and Bluetooth (registered trademark).

[0015] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0016] [First embodiment] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0017] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0018] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0019] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0020] The reception device 38 includes a touch panel 38A and a microphone 38B, and receives user input. The touch panel 38A detects contact with a pointer (for example, a pen or a finger) to receive user input by the touch of the pointer. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 (see FIG. 2) acquires the data indicating the user input.

[0021] Output device 40 includes a display 40A and a speaker 40B, and presents data to a user by outputting the data in a form of expression that the user can perceive (e.g., audio and / or text). Display 40A displays visible information such as text and images in accordance with instructions from processor 46. Speaker 40B outputs audio in accordance with instructions from processor 46. Camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0022] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0023] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0024] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0025] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0026] In the smart device 14, the specific processing is performed by the processor 46. The storage 50 stores a specific processing program 60. The specific processing program 60 is used together with the specific processing program 56 by the data processing system 10. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. Note that the smart device 14 may have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59.

[0027] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device (e.g., a generation server) may have the data generation model 58. In this case, the data processing device 12 obtains a processing result (prediction result, etc.) using the data generation model 58 by communicating with the server device having the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device owned by a user (e.g., a mobile phone, a robot, a home appliance, etc.). Next, an example of processing by the data processing system 10 according to the first embodiment will be described.

[0028] (Example 1) The security autobot system according to an embodiment of the present invention is a system that detects cyber-attacks, automates dialogue with the attackers, and minimizes damage from the attacks. As a result, the security autobot system can respond to cyber-attacks quickly and effectively, ensuring the safety of the system.

[0029] The security autobot system according to the embodiment includes a cyberattack detection unit, an attack pattern analysis unit, an automatic response unit, a dialogue automation unit, and a damage minimization unit. The cyberattack detection unit detects cyberattacks. For example, it monitors network traffic and system logs in real time to detect abnormal activity. The cyberattack detection unit can also detect large volumes of requests that differ from normal traffic patterns and unauthorized access attempts. The attack pattern analysis unit analyzes the abnormal activity detected by the cyberattack detection unit and identifies attack patterns. For example, it identifies patterns such as DDoS attacks, SQL injections, and phishing attacks. The attack pattern analysis unit can also identify attack patterns based on detailed data of the detected abnormal activity. The automatic response unit automatically takes appropriate action based on the attack pattern identified by the attack pattern analysis unit. For example, in the case of a DDoS attack, it blocks the IP address of the attack source. In the case of SQL injection, it can also disable the corresponding query. The dialogue automation unit automates dialogue with the attacker. For example, it provides false information to the attacker to elicit details of the attack. The dialogue automation unit can also conduct dialogue to extract the attacker's intentions and methods. The damage minimization unit takes measures to minimize damage to the system, such as backing up important data. It can also isolate part of the system. As a result, the security autobot system according to the embodiment can detect cyberattacks and automate dialogue with the attacker, thereby minimizing damage from the attack. For example, in the event of a DDoS attack, the AI ​​can immediately detect the attack and block the IP address of the attacker, preventing system downtime. In addition, in the event of a phishing attack, the AI ​​can automate dialogue with the attacker and extract details of the attack, which can be used to develop future countermeasures.

[0030] When detecting anomalies in network traffic, the cyber-attack detection unit learns the attacker's behavioral patterns and can predict future attacks. For example, when AI detects anomalies in network traffic, the cyber-attack detection unit uses past attack data to learn the attacker's behavioral patterns. For example, it detects abnormal traffic from a specific IP address and analyzes the past behavior of that IP address. The cyber-attack detection unit can also predict future attacks based on the attacker's behavioral patterns. This makes it possible to predict future attacks and take defensive measures in advance.

[0031] The cyber attack detection unit can visualize the progress of an attack in real time in response to abnormal activity and issue a warning to the administrator. For example, the cyber attack detection unit will build a system that visualizes the progress of an attack in real time in response to abnormal activity detected by AI. For example, it will display the location of the attack and its progression route on a map. The cyber attack detection unit can also issue a warning to the administrator. For example, it will send an email notification or SMS alert. This will allow the progress of the attack to be visualized in real time and alert the administrator, enabling a rapid response.

[0032] The cyber attack detection unit can monitor not only network traffic but also data from IoT devices and cloud services. For example, the cyber attack detection unit will build a system in which AI monitors not only network traffic but also IoT device data. For example, it will collect data from IoT devices in real time and detect anomalies. The cyber attack detection unit can also monitor data from cloud services. For example, it will analyze log data from cloud services and detect anomalies. By including data from IoT devices and cloud services in the monitoring targets, a wider range of security measures will be possible.

[0033] When the cyber-attack detection unit detects an anomaly, the AI ​​automatically coordinates with other security systems to implement comprehensive defensive measures. For example, the cyber-attack detection unit will build a system in which the AI ​​automatically coordinates with other security systems when it detects an anomaly. For example, it will coordinate with firewalls and IDS / IPS to implement comprehensive defensive measures. The cyber-attack detection unit can also coordinate with other security systems to implement defensive measures when it detects an anomaly. This allows comprehensive defensive measures to be implemented by coordinating with other security systems.

[0034] When analyzing attack patterns, the attack pattern analysis unit uses past attack data to track the evolution of attacks and predict future attack patterns. For example, when AI analyzes attack patterns, the attack pattern analysis unit builds a system that uses past attack data to track the evolution of attacks. For example, it analyzes past attack data and identifies the evolution of attacks. The attack pattern analysis unit can also predict future attack patterns. For example, it makes predictions based on changes in attack methods and the technological evolution of attackers. In this way, by tracking the evolution of attacks using past attack data and predicting future attack patterns, it is possible to take defensive measures in advance.

[0035] The attack pattern analysis unit can share the results of attack pattern analysis with other security systems and build cooperative defensive measures. For example, the attack pattern analysis unit builds a system in which AI shares the results of attack pattern analysis with other security systems. For example, the attack pattern analysis unit shares the results of attack pattern analysis with firewalls and IDS / IPS to implement cooperative defensive measures. The attack pattern analysis unit can also implement defensive measures in cooperation with other security systems. In this way, by sharing the results of attack pattern analysis with other security systems, cooperative defensive measures can be built.

[0036] The attack pattern analysis unit can incorporate attack data from different industries and regions into its attack pattern analysis, allowing it to perform analysis from a global perspective. For example, the attack pattern analysis unit will build a system in which AI incorporates attack data from different industries into its attack pattern analysis. For example, it will analyze attack data from the financial and medical industries to identify common attack patterns. The attack pattern analysis unit can also analyze attack trends by region. For example, it will identify attack patterns based on attack data by region. This makes it possible to incorporate attack data from different industries and regions, allowing for analysis from a global perspective.

[0037] When executing an automatic response, the automatic response unit can evaluate the effectiveness of the response in real time and adjust the response method as necessary. For example, when AI executes an automatic response, the automatic response unit builds a system that evaluates the effectiveness of the response in real time. For example, it monitors the effectiveness of the response and adjusts the response method as necessary. The automatic response unit can also adjust the response method based on the effectiveness of the response. This makes it possible to evaluate the effectiveness of the response in real time and adjust the response method as necessary, thereby enabling optimal response.

[0038] The automatic response unit can monitor the attacker's behavior when taking automatic responses and build a feedback loop to maximize the effectiveness of the response. For example, the automatic response unit builds a system that monitors the attacker's behavior when AI takes automatic responses. For example, it monitors the attacker's behavior in real time and builds a feedback loop to maximize the effectiveness of the response. The automatic response unit can also adjust the response method based on the feedback loop. This makes it possible to monitor the attacker's behavior and build a feedback loop to maximize the effectiveness of the response, thereby enabling optimal responses.

[0039] When taking automatic action, the automatic response unit can work in cooperation with other security systems to implement comprehensive defensive measures. For example, when AI takes automatic action, the automatic response unit builds a system that works in cooperation with other security systems. For example, it works in cooperation with firewalls and IDS / IPS to implement comprehensive defensive measures. The automatic response unit can also work in cooperation with other security systems to implement defensive measures. This makes it possible to implement comprehensive defensive measures by working in cooperation with other security systems.

[0040] The automatic response unit reports the results of the automatic response to the administrator in real time, ensuring the transparency of the response. For example, the automatic response unit builds a system in which AI reports the results of the automatic response to the administrator in real time. For example, the results of the response are displayed on a dashboard so that the administrator can check them immediately. The automatic response unit can also notify the administrator of the results of the response. In this way, the transparency of the response can be ensured by reporting the results of the automatic response to the administrator in real time.

[0041] When automating dialogue with an attacker, the dialogue automation unit can learn the attacker's behavioral patterns and maximize the effectiveness of the dialogue. For example, when AI automates dialogue with an attacker, the dialogue automation unit builds a system that learns the attacker's behavioral patterns. For example, it analyzes past dialogue data and identifies the attacker's behavioral patterns. The dialogue automation unit can also maximize the effectiveness of the dialogue based on the attacker's behavioral patterns. In this way, by learning the attacker's behavioral patterns and maximizing the effectiveness of the dialogue, the attacker's intentions can be more effectively extracted.

[0042] The dialogue automation unit can analyze the content of the dialogue in real time and extract information to identify the attacker's intentions. The dialogue automation unit, for example, builds a system in which AI analyzes the content of the dialogue in real time. For example, it performs text analysis of the content of the dialogue and extracts information to identify the attacker's intentions. The dialogue automation unit can also analyze the content of the dialogue in real time and identify the attacker's intentions. This enables a rapid response by analyzing the content of the dialogue in real time and extracting information to identify the attacker's intentions.

[0043] The dialogue automation unit can work with other security systems when interacting with an attacker to implement comprehensive defensive measures. For example, the dialogue automation unit builds a system that works with other security systems when AI interacts with an attacker. For example, it works with firewalls and IDS / IPS to implement comprehensive defensive measures. The dialogue automation unit can also work with other security systems to implement defensive measures. This allows for comprehensive defensive measures to be implemented by working with other security systems.

[0044] The dialogue automation unit can report the content of the dialogue to an administrator in real time, ensuring dialogue transparency. For example, the dialogue automation unit builds a system in which AI reports the content of the dialogue to an administrator in real time. For example, the dialogue content can be displayed on a dashboard so that the administrator can check it immediately. The dialogue automation unit can also notify the administrator of the content of the dialogue. In this way, by reporting the content of the dialogue to the administrator in real time, dialogue transparency can be ensured.

[0045] When taking measures to minimize damage, the Damage Minimization Unit can monitor the progress of the damage in real time and adjust the measures as necessary. For example, when the AI ​​takes measures to minimize damage, the Damage Minimization Unit builds a system that monitors the progress of the damage in real time. For example, it monitors the progress of the damage and adjusts measures as necessary. The Damage Minimization Unit can also adjust measures based on the progress of the damage. In this way, damage can be minimized by monitoring the progress of the damage in real time and adjusting measures as necessary.

[0046] When minimizing damage, the Damage Minimization Department can incorporate data from different industries and regions and take measures from a global perspective. For example, the Damage Minimization Department will build a system in which AI incorporates data from different industries when minimizing damage. For example, it will analyze data from the financial and medical industries and identify common measures. The Damage Minimization Department can also take measures based on data by region. For example, it will analyze attack trends by region and identify measures from a global perspective. In this way, by incorporating data from different industries and regions, it will be possible to take measures from a global perspective.

[0047] The damage minimization unit can report the results of damage minimization to the administrator in real time, ensuring the transparency of the countermeasures. For example, the damage minimization unit can build a system in which AI reports the results of damage minimization to the administrator in real time. For example, the results of the countermeasures can be displayed on a dashboard so that the administrator can check them immediately. The damage minimization unit can also notify the administrator of the results of the countermeasures. In this way, the transparency of the countermeasures can be ensured by reporting the results of damage minimization to the administrator in real time.

[0048] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0049] The Security Autobot System can further include a user education department. The user education department educates users about the risks of cyber attacks and countermeasures. For example, it teaches them how to identify phishing emails and how to create secure passwords. The user education department can also periodically conduct security training to raise users' security awareness. This allows users to respond more effectively to cyber attacks.

[0050] The Security Autobot System can further include a threat intelligence department. The threat intelligence department collects external threat intelligence data and reflects it in the system's defense measures. For example, it collects the latest attack methods and vulnerability information and updates the system's defense measures. The threat intelligence department can also share information with other security agencies and companies and cooperate to address threats. This allows for a swift and effective response to the latest threats.

[0051] The Security Autobot System can further include a risk assessment unit. The risk assessment unit assesses the risk of the entire system, prioritizes the measures, and implements countermeasures. For example, it assesses the risk to important data and systems, and prioritizes the implementation of countermeasures for the parts with the highest risk. The risk assessment unit can also periodically assess risks and adjust countermeasures according to changes in risk. This allows for effective management of the risk of the entire system.

[0052] The Security Autobot System can further include a user behavior analysis unit. The user behavior analysis unit analyzes user behavior patterns and detects abnormal behavior. For example, it learns normal login times and the types of data accessed, and issues an alert if abnormal behavior occurs. The user behavior analysis unit can also request additional authentication if abnormal behavior is detected. This allows for effective response to internal threats.

[0053] The Security Autobot System can also be equipped with a data encryption unit. The data encryption unit encrypts important data in the system to protect it from unauthorized access. For example, it encrypts customer information and confidential documents in a database. The data encryption unit can also encrypt data when it is sent and received, ensuring the security of communications. This increases the confidentiality of data and prevents information leaks due to cyber attacks.

[0054] The processing flow of the first embodiment will be briefly explained below.

[0055] Step 1: The cyber-attack detection unit detects cyber-attacks. For example, it monitors network traffic and system logs in real time to detect abnormal activity. It can also detect large numbers of requests that differ from normal traffic patterns and unauthorized access attempts. Step 2: The attack pattern analysis unit analyzes the abnormal activity detected by the cyber attack detection unit and identifies the attack pattern. For example, it identifies patterns such as DDoS attacks, SQL injections, and phishing attacks. It can also identify attack patterns based on detailed data of the detected abnormal activity. Step 3: The automatic response unit automatically takes appropriate action based on the attack pattern identified by the attack pattern analysis unit. For example, in the case of a DDoS attack, the IP address of the attacking source can be blocked. In the case of SQL injection, the relevant query can be disabled. Step 4: The dialogue automation unit automates dialogue with the attacker. For example, it can provide false information to the attacker to extract details of the attack. It can also conduct dialogue to extract the attacker's intentions and methods. Step 5: The damage minimization department takes measures to minimize damage to the system, for example, backing up important data, or isolating parts of the system.

[0056] (Example 2) The security autobot system according to an embodiment of the present invention is a system that detects cyber-attacks, automates dialogue with the attackers, and minimizes damage from the attacks. As a result, the security autobot system can respond to cyber-attacks quickly and effectively, ensuring the safety of the system.

[0057] The security autobot system according to the embodiment includes a cyberattack detection unit, an attack pattern analysis unit, an automatic response unit, a dialogue automation unit, and a damage minimization unit. The cyberattack detection unit detects cyberattacks. For example, it monitors network traffic and system logs in real time to detect abnormal activity. The cyberattack detection unit can also detect large volumes of requests that differ from normal traffic patterns and unauthorized access attempts. The attack pattern analysis unit analyzes the abnormal activity detected by the cyberattack detection unit and identifies attack patterns. For example, it identifies patterns such as DDoS attacks, SQL injections, and phishing attacks. The attack pattern analysis unit can also identify attack patterns based on detailed data of the detected abnormal activity. The automatic response unit automatically takes appropriate action based on the attack pattern identified by the attack pattern analysis unit. For example, in the case of a DDoS attack, it blocks the IP address of the attack source. In the case of SQL injection, it can also disable the corresponding query. The dialogue automation unit automates dialogue with the attacker. For example, it provides false information to the attacker to elicit details of the attack. The dialogue automation unit can also conduct dialogue to extract the attacker's intentions and methods. The damage minimization unit takes measures to minimize damage to the system, such as backing up important data. It can also isolate part of the system. As a result, the security autobot system according to the embodiment can detect cyberattacks and automate dialogue with the attacker, thereby minimizing damage from the attack. For example, in the event of a DDoS attack, the AI ​​can immediately detect the attack and block the IP address of the attacker, preventing system downtime. In addition, in the event of a phishing attack, the AI ​​can automate dialogue with the attacker and extract details of the attack, which can be used to develop future countermeasures.

[0058] When detecting anomalies in network traffic, the cyber-attack detection unit learns the attacker's behavioral patterns and can predict future attacks. For example, when AI detects anomalies in network traffic, the cyber-attack detection unit uses past attack data to learn the attacker's behavioral patterns. For example, it detects abnormal traffic from a specific IP address and analyzes the past behavior of that IP address. The cyber-attack detection unit can also predict future attacks based on the attacker's behavioral patterns. This makes it possible to predict future attacks and take defensive measures in advance.

[0059] The cyber attack detection unit can visualize the progress of an attack in real time in response to abnormal activity and issue a warning to the administrator. For example, the cyber attack detection unit will build a system that visualizes the progress of an attack in real time in response to abnormal activity detected by AI. For example, it will display the location of the attack and its progression route on a map. The cyber attack detection unit can also issue a warning to the administrator. For example, it will send an email notification or SMS alert. This will allow the progress of the attack to be visualized in real time and alert the administrator, enabling a rapid response.

[0060] The cyber-attack detection unit can use the emotion estimation function to infer the attacker's intentions and analyze the motives behind the attacks. For example, the cyber-attack detection unit uses the emotion estimation function to build a system in which AI infers the attacker's intentions. For example, it analyzes the emotions from the attacker's behavioral patterns and communication content to identify the motives behind the attacks. The cyber-attack detection unit can also analyze the motives behind the attacks based on the attacker's intentions. This makes it possible to infer the attacker's intentions and analyze the motives behind the attacks, thereby enabling more effective countermeasures to be taken.

[0061] The cyber attack detection unit can monitor not only network traffic but also data from IoT devices and cloud services. For example, the cyber attack detection unit will build a system in which AI monitors not only network traffic but also IoT device data. For example, it will collect data from IoT devices in real time and detect anomalies. The cyber attack detection unit can also monitor data from cloud services. For example, it will analyze log data from cloud services and detect anomalies. By including data from IoT devices and cloud services in the monitoring targets, a wider range of security measures will be possible.

[0062] When the cyber-attack detection unit detects an anomaly, the AI ​​automatically coordinates with other security systems to implement comprehensive defensive measures. For example, the cyber-attack detection unit will build a system in which the AI ​​automatically coordinates with other security systems when it detects an anomaly. For example, it will coordinate with firewalls and IDS / IPS to implement comprehensive defensive measures. The cyber-attack detection unit can also coordinate with other security systems to implement defensive measures when it detects an anomaly. This allows comprehensive defensive measures to be implemented by coordinating with other security systems.

[0063] The cyber-attack detection unit can use the emotion estimation function to monitor the user's emotional state and issue a warning when abnormal behavior occurs. For example, the cyber-attack detection unit builds a system in which AI uses the emotion estimation function to monitor the user's emotional state. For example, it analyzes the user's facial expressions and voice to detect abnormal emotional states. The cyber-attack detection unit can also issue a warning when abnormal behavior occurs. For example, it detects deviations from normal behavior patterns and issues a warning. This makes it possible to monitor the user's emotional state and issue a warning when abnormal behavior occurs, enabling a rapid response.

[0064] When analyzing attack patterns, the attack pattern analysis unit uses past attack data to track the evolution of attacks and predict future attack patterns. For example, when AI analyzes attack patterns, the attack pattern analysis unit builds a system that uses past attack data to track the evolution of attacks. For example, it analyzes past attack data and identifies the evolution of attacks. The attack pattern analysis unit can also predict future attack patterns. For example, it makes predictions based on changes in attack methods and the technological evolution of attackers. In this way, by tracking the evolution of attacks using past attack data and predicting future attack patterns, it is possible to take defensive measures in advance.

[0065] The attack pattern analysis unit can share the results of attack pattern analysis with other security systems and build cooperative defensive measures. For example, the attack pattern analysis unit builds a system in which AI shares the results of attack pattern analysis with other security systems. For example, the attack pattern analysis unit shares the results of attack pattern analysis with firewalls and IDS / IPS to implement cooperative defensive measures. The attack pattern analysis unit can also implement defensive measures in cooperation with other security systems. In this way, by sharing the results of attack pattern analysis with other security systems, cooperative defensive measures can be built.

[0066] The attack pattern analysis unit can use the emotion estimation function to analyze the emotional state of an attacker and identify the psychological factors behind the attack. For example, the attack pattern analysis unit uses the emotion estimation function to build a system in which AI analyzes the emotional state of an attacker. For example, it analyzes emotions from the content of the attacker's communications and behavior patterns to identify the psychological factors behind the attack. The attack pattern analysis unit can also analyze the psychological factors behind the attack based on the attacker's emotional state. This allows for more effective countermeasures to be taken by analyzing the attacker's emotional state and identifying the psychological factors behind the attack.

[0067] The attack pattern analysis unit can incorporate attack data from different industries and regions into its attack pattern analysis, allowing it to perform analysis from a global perspective. For example, the attack pattern analysis unit will build a system in which AI incorporates attack data from different industries into its attack pattern analysis. For example, it will analyze attack data from the financial and medical industries to identify common attack patterns. The attack pattern analysis unit can also analyze attack trends by region. For example, it will identify attack patterns based on attack data by region. This makes it possible to incorporate attack data from different industries and regions, allowing for analysis from a global perspective.

[0068] The attack pattern analysis unit can use the emotion estimation function to predict the user's emotional reaction based on the results of attack pattern analysis and propose appropriate countermeasures. For example, the attack pattern analysis unit builds a system in which AI uses the emotion estimation function to predict the user's emotional reaction based on the results of attack pattern analysis. For example, the attack pattern analysis unit can predict the user's anxiety or fear based on the results of attack pattern analysis and propose appropriate countermeasures. The attack pattern analysis unit can also propose appropriate countermeasures based on the user's emotional reaction. In this way, by predicting the user's emotional reaction based on the results of attack pattern analysis and proposing appropriate countermeasures, it is possible to increase the user's sense of security.

[0069] When executing an automatic response, the automatic response unit can evaluate the effectiveness of the response in real time and adjust the response method as necessary. For example, when AI executes an automatic response, the automatic response unit builds a system that evaluates the effectiveness of the response in real time. For example, it monitors the effectiveness of the response and adjusts the response method as necessary. The automatic response unit can also adjust the response method based on the effectiveness of the response. This makes it possible to evaluate the effectiveness of the response in real time and adjust the response method as necessary, thereby enabling optimal response.

[0070] The automatic response unit can monitor the attacker's behavior when taking automatic responses and build a feedback loop to maximize the effectiveness of the response. For example, the automatic response unit builds a system that monitors the attacker's behavior when AI takes automatic responses. For example, it monitors the attacker's behavior in real time and builds a feedback loop to maximize the effectiveness of the response. The automatic response unit can also adjust the response method based on the feedback loop. This makes it possible to monitor the attacker's behavior and build a feedback loop to maximize the effectiveness of the response, thereby enabling optimal responses.

[0071] The automatic response unit can use the emotion estimation function to monitor the emotional state of the attacker and optimize the response method. For example, the automatic response unit uses the emotion estimation function to build a system in which AI monitors the emotional state of the attacker. For example, it analyzes the emotions from the content of the attacker's communications and behavior patterns and optimizes the response method. The automatic response unit can also adjust the response method based on the attacker's emotional state. In this way, by monitoring the attacker's emotional state and optimizing the response method, more effective responses are possible.

[0072] When taking automatic action, the automatic response unit can work in cooperation with other security systems to implement comprehensive defensive measures. For example, when AI takes automatic action, the automatic response unit builds a system that works in cooperation with other security systems. For example, it works in cooperation with firewalls and IDS / IPS to implement comprehensive defensive measures. The automatic response unit can also work in cooperation with other security systems to implement defensive measures. This makes it possible to implement comprehensive defensive measures by working in cooperation with other security systems.

[0073] The automatic response unit reports the results of the automatic response to the administrator in real time, ensuring the transparency of the response. For example, the automatic response unit builds a system in which AI reports the results of the automatic response to the administrator in real time. For example, the results of the response are displayed on a dashboard so that the administrator can check them immediately. The automatic response unit can also notify the administrator of the results of the response. In this way, the transparency of the response can be ensured by reporting the results of the automatic response to the administrator in real time.

[0074] The automatic response unit can use the emotion estimation function to monitor the user's emotional state and minimize the impact of the response. For example, the automatic response unit uses the emotion estimation function to build a system in which AI monitors the user's emotional state. For example, it analyzes the user's facial expressions and voice and minimizes the impact of the response. The automatic response unit can also adjust the response method based on the user's emotional state. In this way, by monitoring the user's emotional state and minimizing the impact of the response, it is possible to reduce the user's stress.

[0075] When automating dialogue with an attacker, the dialogue automation unit can learn the attacker's behavioral patterns and maximize the effectiveness of the dialogue. For example, when AI automates dialogue with an attacker, the dialogue automation unit builds a system that learns the attacker's behavioral patterns. For example, it analyzes past dialogue data and identifies the attacker's behavioral patterns. The dialogue automation unit can also maximize the effectiveness of the dialogue based on the attacker's behavioral patterns. In this way, by learning the attacker's behavioral patterns and maximizing the effectiveness of the dialogue, the attacker's intentions can be more effectively extracted.

[0076] The dialogue automation unit can analyze the content of the dialogue in real time and extract information to identify the attacker's intentions. The dialogue automation unit, for example, builds a system in which AI analyzes the content of the dialogue in real time. For example, it performs text analysis of the content of the dialogue and extracts information to identify the attacker's intentions. The dialogue automation unit can also analyze the content of the dialogue in real time and identify the attacker's intentions. This enables a rapid response by analyzing the content of the dialogue in real time and extracting information to identify the attacker's intentions.

[0077] The dialogue automation unit can use the emotion estimation function to monitor the emotional state of the attacker and optimize the content of the dialogue. For example, the dialogue automation unit uses the emotion estimation function to build a system in which AI monitors the emotional state of the attacker. For example, it analyzes emotions from the content of the attacker's communications and behavioral patterns and optimizes the content of the dialogue. The dialogue automation unit can also adjust the content of the dialogue based on the attacker's emotional state. This makes it possible to monitor the attacker's emotional state and optimize the content of the dialogue, enabling more effective dialogue.

[0078] The dialogue automation unit can work with other security systems when interacting with an attacker to implement comprehensive defensive measures. For example, the dialogue automation unit builds a system that works with other security systems when AI interacts with an attacker. For example, it works with firewalls and IDS / IPS to implement comprehensive defensive measures. The dialogue automation unit can also work with other security systems to implement defensive measures. This allows for comprehensive defensive measures to be implemented by working with other security systems.

[0079] The dialogue automation unit can report the content of the dialogue to an administrator in real time, ensuring dialogue transparency. For example, the dialogue automation unit builds a system in which AI reports the content of the dialogue to an administrator in real time. For example, the dialogue content can be displayed on a dashboard so that the administrator can check it immediately. The dialogue automation unit can also notify the administrator of the content of the dialogue. In this way, by reporting the content of the dialogue to the administrator in real time, dialogue transparency can be ensured.

[0080] The dialogue automation unit can use the emotion estimation function to monitor the user's emotional state and minimize the impact of the dialogue. For example, the dialogue automation unit builds a system in which AI uses the emotion estimation function to monitor the user's emotional state. For example, it analyzes the user's facial expressions and voice to minimize the impact of the dialogue. The dialogue automation unit can also adjust the content of the dialogue based on the user's emotional state. This makes it possible to reduce the user's stress by monitoring the user's emotional state and minimizing the impact of the dialogue.

[0081] When taking measures to minimize damage, the Damage Minimization Unit can monitor the progress of the damage in real time and adjust the measures as necessary. For example, when the AI ​​takes measures to minimize damage, the Damage Minimization Unit builds a system that monitors the progress of the damage in real time. For example, it monitors the progress of the damage and adjusts measures as necessary. The Damage Minimization Unit can also adjust measures based on the progress of the damage. In this way, damage can be minimized by monitoring the progress of the damage in real time and adjusting measures as necessary.

[0082] The damage minimization unit can use the emotion estimation function to monitor the user's emotional state and minimize the impact of damage. For example, the damage minimization unit can build a system in which AI uses the emotion estimation function to monitor the user's emotional state. For example, it can analyze the user's facial expressions and voice to minimize the impact of damage. The damage minimization unit can also adjust countermeasures based on the user's emotional state. In this way, the user's emotional state can be monitored and the impact of damage minimized, thereby reducing stress for the user.

[0083] When minimizing damage, the Damage Minimization Department can incorporate data from different industries and regions and take measures from a global perspective. For example, the Damage Minimization Department will build a system in which AI incorporates data from different industries when minimizing damage. For example, it will analyze data from the financial and medical industries and identify common measures. The Damage Minimization Department can also take measures based on data by region. For example, it will analyze attack trends by region and identify measures from a global perspective. In this way, by incorporating data from different industries and regions, it will be possible to take measures from a global perspective.

[0084] The damage minimization unit can report the results of damage minimization to the administrator in real time, ensuring the transparency of the countermeasures. For example, the damage minimization unit can build a system in which AI reports the results of damage minimization to the administrator in real time. For example, the results of the countermeasures can be displayed on a dashboard so that the administrator can check them immediately. The damage minimization unit can also notify the administrator of the results of the countermeasures. In this way, the transparency of the countermeasures can be ensured by reporting the results of damage minimization to the administrator in real time.

[0085] The damage minimization unit can use the emotion estimation function to monitor the user's emotional state and minimize the impact of damage. For example, the damage minimization unit can build a system in which AI uses the emotion estimation function to monitor the user's emotional state. For example, it can analyze the user's facial expressions and voice to minimize the impact of damage. The damage minimization unit can also adjust countermeasures based on the user's emotional state. In this way, the user's emotional state can be monitored and the impact of damage minimized, thereby reducing stress for the user.

[0086] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0087] The Security Autobot System can further include a user education department. The user education department educates users about the risks of cyber attacks and countermeasures. For example, it teaches them how to identify phishing emails and how to create secure passwords. The user education department can also periodically conduct security training to raise users' security awareness. This allows users to respond more effectively to cyber attacks.

[0088] The Security Autobot System can further include a threat intelligence department. The threat intelligence department collects external threat intelligence data and reflects it in the system's defense measures. For example, it collects the latest attack methods and vulnerability information and updates the system's defense measures. The threat intelligence department can also share information with other security agencies and companies and cooperate to address threats. This allows for a swift and effective response to the latest threats.

[0089] The Security Autobot System can further include a risk assessment unit. The risk assessment unit assesses the risk of the entire system, prioritizes the measures, and implements countermeasures. For example, it assesses the risk to important data and systems, and prioritizes the implementation of countermeasures for the parts with the highest risk. The risk assessment unit can also periodically assess risks and adjust countermeasures according to changes in risk. This allows for effective management of the risk of the entire system.

[0090] The Security Autobot System can further include a user behavior analysis unit. The user behavior analysis unit analyzes user behavior patterns and detects abnormal behavior. For example, it learns normal login times and the types of data accessed, and issues an alert if abnormal behavior occurs. The user behavior analysis unit can also request additional authentication if abnormal behavior is detected. This allows for effective response to internal threats.

[0091] The Security Autobot System can also be equipped with a data encryption unit. The data encryption unit encrypts important data in the system to protect it from unauthorized access. For example, it encrypts customer information and confidential documents in a database. The data encryption unit can also encrypt data when it is sent and received, ensuring the security of communications. This increases the confidentiality of data and prevents information leaks due to cyber attacks.

[0092] The Security Autobot system can also use emotion estimation to monitor the user's emotional state and adjust security measures accordingly. For example, if the user is feeling stressed, the system can adjust the content of dialogue and the frequency of notifications to reduce the user's burden. The emotion estimation function can also be used to provide additional support and guidance if the user is feeling anxious. This allows for flexible responses according to the user's emotional state.

[0093] The Security Autobot System can also use its emotion estimation function to monitor the attacker's emotional state and optimize the content of the dialogue. For example, if the attacker is irritated, the system can engage in calm dialogue to calm the attacker's emotions. Conversely, if the attacker is confident, the system can engage in provocative dialogue to induce the attacker to make a mistake. This enables effective dialogue that is tailored to the attacker's emotional state.

[0094] The Security Autobot System can also use its emotion estimation function to estimate the attacker's intentions and analyze the motives behind the attacks. For example, it can analyze the emotions of the attacker from the content of their communications and behavioral patterns to identify the motives behind the attacks. It can also use the emotion estimation function to analyze the motives behind the attacks based on the attacker's intentions. This allows more effective countermeasures to be taken by estimating the attacker's intentions and analyzing the motives behind the attacks.

[0095] The Security Autobot System also uses an emotion estimation function to monitor the user's emotional state and issue a warning if abnormal behavior occurs. For example, it can analyze the user's facial expressions and voice to detect abnormal emotional states. It can also detect deviations from normal behavior patterns and issue a warning. This allows for rapid response by monitoring the user's emotional state and issuing a warning if abnormal behavior occurs.

[0096] The Security Autobot System can also use its emotion estimation function to analyze the emotional state of an attacker and identify the psychological factors behind the attack. For example, it can analyze the emotion of an attacker from the content of their communications and behavioral patterns to identify the psychological factors behind the attack. It can also use the emotion estimation function to analyze the psychological factors behind an attack based on the attacker's emotional state. This allows for more effective countermeasures to be taken by analyzing the attacker's emotional state and identifying the psychological factors behind the attack.

[0097] The processing flow of the second embodiment will be briefly explained below.

[0098] Step 1: The cyber-attack detection unit detects cyber-attacks. For example, it monitors network traffic and system logs in real time to detect abnormal activity. It can also detect large numbers of requests that differ from normal traffic patterns and unauthorized access attempts. Step 2: The attack pattern analysis unit analyzes the abnormal activity detected by the cyber attack detection unit and identifies the attack pattern. For example, it identifies patterns such as DDoS attacks, SQL injections, and phishing attacks. It can also identify attack patterns based on detailed data of the detected abnormal activity. Step 3: The automatic response unit automatically takes appropriate action based on the attack pattern identified by the attack pattern analysis unit. For example, in the case of a DDoS attack, the IP address of the attacking source can be blocked. In the case of SQL injection, the relevant query can be disabled. Step 4: The dialogue automation unit automates dialogue with the attacker. For example, it can provide false information to the attacker to extract details of the attack. It can also conduct dialogue to extract the attacker's intentions and methods. Step 5: The damage minimization department takes measures to minimize damage to the system, for example, backing up important data, or isolating parts of the system.

[0099] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0100] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> Examples of generative AIs include the data generation model 58, such as a neural network model (e.g., a neural network model), and a neural network model (e.g., a neural network model). The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating speech, text data indicating text, and image data indicating an image is also input to the data generation model 58. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specification processing unit 290 performs the above-mentioned specification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0101] Furthermore, the processing by the data processing system 10 described above is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart device 14, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart device 14. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information necessary for processing from the smart device 14 or an external device, and the smart device 14 acquires or collects information necessary for processing from the data processing device 12 or an external device.

[0102] [Second embodiment] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0103] 3, the data processing system 210 includes the data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0104] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0105] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0106] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0107] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0108] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0109] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0110] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0111] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0112] In the smart glasses 214, the specific processing is performed by the processor 46. A specific processing program 60 is stored in the storage 50. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. Note that the smart glasses 214 may have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59.

[0113] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0114] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0115] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0116] The data processing system 210 according to the second embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 210 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart glasses 214, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart glasses 214. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the smart glasses 214 or an external device, etc., and the smart glasses 214 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0117] [Third embodiment] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[0118] 5, the data processing system 310 includes the data processing device 12 and a headset type terminal 314. An example of the data processing device 12 is a server.

[0119] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0120] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[0121] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0122] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0123] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0124] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0125] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0126] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0127] In the headset type terminal 314, the identification process is performed by the processor 46. A identification program 60 is stored in the storage 50. The processor 46 reads the identification program 60 from the storage 50 and executes the read identification program 60 on the RAM 48. The identification process is realized by the processor 46 operating as a control unit 46A in accordance with the identification program 60 executed on the RAM 48. Note that the headset type terminal 314 may also have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59.

[0128] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0129] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0130] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0131] The data processing system 310 according to the third embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 310 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the headset type terminal 314, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the headset type terminal 314. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the headset type terminal 314 or an external device, etc., and the headset type terminal 314 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0132] [Fourth embodiment] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[0133] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0134] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0135] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[0136] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0137] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS image sensor or a CCD image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0138] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0139] The control object 443 includes a display device, LEDs in the eyes, and motors that drive the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[0140] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0141] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0142] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0143] In the robot 414, the processor 46 performs the identification process. A identification program 60 is stored in the storage 50. The processor 46 reads the identification program 60 from the storage 50 and executes the read identification program 60 on the RAM 48. The identification process is realized by the processor 46 operating as a control unit 46A in accordance with the identification program 60 executed on the RAM 48. The robot 414 may have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59.

[0144] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0145] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0146] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0147] The data processing system 410 according to the fourth embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 410 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the robot 414, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the robot 414. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the robot 414 or an external device, etc., and the robot 414 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0148] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[0149] FIG. 9 illustrates an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and behaviors arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion encompasses both emotions and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[0150] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[0151] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[0152] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is expressed, and when they approach the ideal, a state of pleasure is expressed. Emotions can also be created for robots, cars, and motorcycles, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is expressed, and when they approach the ideal, a state of pleasure is expressed. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on speech emotion recognition and brain physiological signal analysis systems for emotions, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the area called "reaction," where sensation is dominant. The right half of the emotion map lists emotions belonging to the area called "situation," where situational awareness is dominant.

[0153] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[0154] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[0155] In the above embodiment, an example was given in which a specific process is performed by one computer 22, but the technology disclosed herein is not limited to this, and distributed processing of the specific process may be performed by multiple computers including computer 22.

[0156] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[0157] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[0158] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[0159] The hardware resource for executing a specific process can be any of the following types of processors: A processor, for example, is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. A processor also includes a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[0160] The hardware resource that executes the specific process may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific process may be a single processor.

[0161] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[0162] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[0163] In the above example, the first to fourth embodiments have been described separately, but some or all of these embodiments may be combined. The smart device 14, smart glasses 214, headset terminal 314, and robot 414 are merely examples, and they may be combined, or other devices may be used. In the above example, the first and second embodiments have been described separately, but they may be combined.

[0164] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[0165] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference. [Explanation of symbols]

[0166] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot

Claims

1. a cyber attack detection unit that detects cyber attacks; an attack pattern analysis unit that analyzes abnormal activity detected by the cyber-attack detection unit and identifies an attack pattern; an automatic response unit that automatically executes an appropriate response in accordance with the attack pattern identified by the attack pattern analysis unit; a dialogue automation unit that automates dialogue with attackers; a damage minimization unit that takes measures to minimize damage to the system. A system characterized by:

2. The cyber attack detection unit Monitoring will include not only network traffic but also data from the IoT devices and cloud services.

2. The system of claim 1.

3. The attack pattern analysis unit When analyzing the attack patterns, past attack data is used to track the evolution of attacks and predict future attack patterns.

2. The system of claim 1.

4. The automatic response unit When executing automated countermeasures, the effectiveness of said countermeasures is evaluated in real time and the countermeasures are adjusted as necessary.

2. The system of claim 1.

5. The dialogue automation unit When automating dialogue with the attacker, the behavioral patterns of the attacker are learned and the effectiveness of the dialogue is maximized.

2. The system of claim 1.

6. The damage minimization unit As the measures to minimize the damage are taken, monitor the progress of the damage in real time and adjust the measures as necessary.

2. The system of claim 1.

7. The cyber attack detection unit Estimate the attacker's intentions and analyze the motivation behind the attack 2. The system of claim 1.

Images