System

Abstract

A system is provided.SOLUTION: A system comprising: means for filtering emails received externally by a communication device; means for identifying potentially fraudulent emails and storing the emails in an analysis queue; means for analyzing the emails stored in the analysis queue using a natural-language processing technique to identify fraudulent emails; means for generating disguised information based on emails identified as fraudulent emails and inputting the disguised information to a fraudulent site; and means for receiving feedback from a user to retrain a AI model.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] In recent years, fraudulent acts using email have been increasing rapidly, resulting in frequent leaks of personal information and financial losses. Conventional countermeasures against fraudulent emails rely on users' vigilance or advance detection by email filtering systems, but these methods are highly susceptible to false positives and missed detections. Furthermore, there are limitations to their effectiveness in preventing fraudulent acts themselves. Therefore, the objective of this invention is to provide a new method that neutralizes fraudulent acts by intentionally falling for the fraudulent emails themselves, ultimately eradicating fraud. [Means for solving the problem]

[0005] The present invention provides a means for a communication device to filter emails received from outside, identify potentially fraudulent emails, and store the emails in an analysis queue. It also includes a means for analyzing the emails stored in the analysis queue using natural language processing technology to identify fraudulent emails. It also provides a means for generating false information based on emails identified as fraudulent and inputting it into a fraudulent website. It also includes a means for receiving feedback from users and retraining the AI ​​model. This prevents attackers from collecting accurate information when sending false information to a fraudulent website via fraudulent email, reducing the success rate of fraudulent activity. Ultimately, this method can be used to deter fraudulent activity itself.

[0006] A "communication device" is a device that has the function of receiving e-mail from outside and analyzing its contents.

[0007] "Email" is an electronic letter sent and received over the Internet, and is a means of communication that primarily consists of text information.

[0008] "Filtering" is the process of sorting incoming emails based on specific criteria to detect inappropriate or suspicious emails.

[0009] "Potentially fraudulent email" is email that is created with the intent to phish or spam and may cause harm to the recipient.

[0010] An "analysis queue" is a data structure that temporarily stores emails in a particular order for subsequent analysis processing.

[0011] "Natural language processing technology" is a technology that enables computers to understand, analyze, and generate human language.

[0012] A "fraudulent email" is an email created with the intent of defrauding the recipient and containing content intended to steal personal information or money.

[0013] "False information" is information that is intentionally false and created to thwart fraud.

[0014] A "fraudulent website" is a website designed with the intent of defrauding visitors by tricking them into giving up personal information or money.

[0015] "User" refers to the person who operates and manages the system and provides feedback, or is a user of the system.

[0016] An "AI model" is an algorithm and its implementation that uses artificial intelligence technology to analyze and judge data.

[0017] "Retraining" is the process by which an AI model improves its accuracy and performance based on new data and feedback. [Brief explanation of the drawings]

[0018] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8]FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 11] FIG. 3 is a sequence diagram showing a processing flow of the data processing system according to the first embodiment. [Figure 12] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 1. [Figure 13] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system according to the second embodiment when an emotion engine is combined. [Figure 14] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 2 when an emotion engine is combined. DETAILED DESCRIPTION OF THE INVENTION

[0019] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0020] First, the terms used in the following description will be explained.

[0021] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, a processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), and an APU (Accelerated Processing Unit).

[0022] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0023] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0024] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), Bluetooth (registered trademark), etc.

[0025] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0026] [First embodiment]

[0027] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0028] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0029] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0030] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0031] The reception device 38 includes a touch panel 38A, a microphone 38B, and the like, and receives user input. The touch panel 38A detects contact with an indicator (for example, a pen or a finger) to receive user input by the touch of the indicator. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0032] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form of expression that the user 20 can perceive (for example, audio and / or text). The display 40A displays visible information such as text and images in accordance with instructions from the processor 46. The speaker 40B outputs audio in accordance with instructions from the processor 46. The camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0033] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0034] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0035] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0036] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0037] In the smart device 14, the processor 46 performs the reception output process. The storage 50 stores a reception output program 60. The reception output program 60 is used in conjunction with the specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0038] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0039] The present invention relates to a fraudulent email prevention system, and provides an efficient method for preventing fraudulent emails in particular. The system of the present invention consists of three main components: a communication device (server), an analysis terminal (terminal), and a user.

[0040] 1. Receiving and filtering emails

[0041] The server receives email from outside. The server connects to the mail server and receives emails sent to users. It then filters out potentially fraudulent emails based on the header information and body content of the received emails.

[0042] Examples:

[0043] Let's say you receive two emails, one from "example@trusted.com" and one from "unknown@example.com." If your server filters the email from "unknown@example.com" and determines it is likely to be fraudulent, it places the email in a queue for analysis.

[0044] 2. AI-based fraudulent email identification

[0045] Emails stored in the analysis queue are processed on the terminal. The terminal is equipped with an AI module that uses natural language processing technology to perform detailed analysis of the email body. If the email is identified as fraudulent, the results are fed back to the server.

[0046] Examples:

[0047] The device detects if the email body contains phrases asking you to "update your bank account information" or suspicious link URLs, and identifies it as a fraudulent email.

[0048] 3. Visiting phishing sites and sending false information

[0049] If the email is identified as fraudulent, the server prepares fake data such as an unused email address or phone number, accesses the phishing site URL listed in the fraudulent email, enters the fake information into a form, and submits it.

[0050] Examples:

[0051] The server uses the email address "fakeuser@example.com" to access the phishing site, then enters a false name, address, credit card information, etc., and submits the form. This operation allows the attacker to obtain only false information, reducing the effectiveness of the fraud.

[0052] 4. Feedback and Retraining

[0053] Users monitor the system's operation, check the AI's verdicts, and if they're incorrect, provide feedback to retrain the model, improving the system's accuracy and its ability to detect future fraudulent emails.

[0054] Examples:

[0055] The user accesses the system's management console and checks the details of the information sent to the phishing site. If there is a false positive, that information is fed back to the AI ​​model. This information is used to retrain the AI ​​and improve its accuracy the next time.

[0056] conclusion

[0057] The system of the present invention can intentionally fall for fraudulent emails, providing false information to attackers and reducing the success rate of fraudulent activities. Furthermore, the AI ​​model is retrained based on user feedback, allowing the system's accuracy to be continuously improved. This configuration makes it possible to effectively deter fraudulent activities.

[0058] The processing flow will be explained below.

[0059] Step 1:

[0060] The server receives email from the outside. It connects to the mail server and receives emails sent to users.

[0061] Step 2:

[0062] The server filters the header information and body content of emails received based on specific criteria, such as the sender's domain, keywords in the subject line, and specific phrases in the body of the email.

[0063] Step 3:

[0064] The server identifies potentially fraudulent emails and places them in a queue for analysis. For example, if an email from "unknown@example.com" is determined to be highly likely to be fraudulent, it will be moved to the analysis queue.

[0065] Step 4:

[0066] The device retrieves the emails stored in the analysis queue.

[0067] Step 5:

[0068] The device's AI module analyzes the email using natural language processing technology, extracting features from the email body such as phishing links, phrases indicating urgency, and requests for personal information.

[0069] Step 6:

[0070] The device will score whether the email is fraudulent or not based on the extracted features. If the score exceeds a certain level, it will be determined to be fraudulent.

[0071] Step 7:

[0072] The device determines whether the email is fraudulent and sends the results back to the server.

[0073] Step 8:

[0074] The server prepares fake information such as unused email addresses and phone numbers based on emails that are determined to be fraudulent.

[0075] Step 9:

[0076] The server accesses the phishing site URL included in the fraudulent email.

[0077] Step 10:

[0078] The server analyzes the phishing site's form and fills in the fields with prepared fake information, such as a fake name, address, and credit card information.

[0079] Step 11:

[0080] The server submits the form on the phishing site, sending false information to the attacker, which prevents the attacker from obtaining the correct information, reducing the success rate of the fraud.

[0081] Step 12:

[0082] Users monitor the system's operations and judgment results. Users access the system's management console to check details.

[0083] Step 13:

[0084] If a user makes a false positive, they can provide that information back to the system, which will then use it to retrain the AI ​​model.

[0085] Step 14:

[0086] The device's AI module retrains based on feedback provided by the user, improving the accuracy of the model.

[0087] Through this series of processing steps, the system of the present invention effectively identifies fraudulent emails and neutralizes the fraudulent activity, and the accuracy and efficiency of the system improves through continuous learning based on user feedback.

[0088] Example 1

[0089] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0090] Fraudulent emails are increasing year by year, and the methods are becoming more sophisticated. Conventional filtering systems are incomplete in identifying fraudulent emails, increasing the risk of users falling prey to fraudulent schemes. Furthermore, effective countermeasures against attackers are lacking after identifying fraudulent emails. Furthermore, continuous re-learning is necessary to improve the accuracy of the system, and a method for efficiently incorporating user feedback is needed.

[0091] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0092] In this invention, the server includes means for filtering emails received by the communication device from outside, means for identifying potentially fraudulent emails and storing the emails in an analysis queue, means for analyzing the emails stored in the analysis queue using natural language processing technology to identify fraudulent emails, means for generating unused identification information based on emails identified as fraudulent emails and inputting it into a fraudulent website, means for receiving feedback from users and retraining the AI ​​model, means for automating access to the fraudulent website, and means for feeding back the analyzed information to the server. This enables early identification of fraudulent emails and effective countermeasures against attackers, and allows the accuracy of the system to be continuously improved.

[0093] "Communication equipment" refers to hardware or software that receives email from outside and provides that information to an internal system.

[0094] "Filtering" refers to the process of scanning incoming emails based on specific criteria to screen out potentially fraudulent emails.

[0095] An "analysis queue" is a queue where emails that have been filtered as potentially fraudulent are temporarily stored for further analysis at a later date.

[0096] "Natural language processing technology" refers to technology that uses computers to analyze and understand human language.

[0097] "Fraudulent email" refers to emails that are intended to deceive users and illegally obtain personal or financial information.

[0098] "Fake information" refers to false information provided to fraudulent sites that imitates real user information.

[0099] "Fraudulent Site" refers to a website designed for the purpose of committing fraud.

[0100] "Feedback" refers to the process of providing users with opinions and corrections regarding the system's judgment results, which are used to help the AI ​​model learn.

[0101] "Relearning" refers to the process by which an AI model improves its performance by retraining it based on new data and feedback.

[0102] "Automation" refers to the process where a system performs a series of operations independently without human intervention.

[0103] "Identification information" refers to information that uniquely identifies a specific individual or device.

[0104] The present invention relates to a fraudulent email prevention system, and provides an efficient method for preventing fraudulent emails in particular. The system of the present invention consists of three main components: a communication device (server), an analysis terminal (terminal), and a user.

[0105] First, the server receives email from an external mail server. The server retrieves new email using the IMAP or POP3 protocol and filters the received email. The filtering is done using the Python email package or other analysis tools. For example, the server periodically checks incoming email from "mail.example.com" and analyzes header information such as the sender address and subject line, as well as the body of the email.

[0106] The server then compares the email with blacklists and rule-based filtering systems and places potentially fraudulent emails in a queue for analysis. For example, if the sender address is "unknown@example.com," the email is added to the analysis queue as a fraudulent email.

[0107] Emails stored in the analysis queue are processed on the terminal. AI frameworks such as TensorFlow and PyTorch are installed on the terminal, and these are used to perform detailed analysis of the email body using natural language processing (NLP). For example, if the terminal detects a phrase in the email body that suggests fraud, such as "Please update your bank account information," it will identify the email as fraudulent and feed the result back to the server.

[0108] If the email is identified as fraudulent, the server generates fake information such as an unused email address and phone number using the Faker library. For example, it generates a random email address such as "fakeuser@example.com" and fake names, addresses, and credit card information.

[0109] The server then uses a browser automation tool such as Selenium to access the phishing site URL listed in the fraudulent email, enter the generated fake information into a form, and submit it. This reduces the effectiveness of the fraudulent activity because the attacker can only obtain false information. For example, the server accesses "http: / / phishingsite.com," enters fake names and credit card information, and submits it.

[0110] Users access the system's management console to monitor the AI's judgment of fraudulent emails. If the judgment is incorrect, the user can provide feedback to retrain the model. For example, if a user checks the details of the information sent to a phishing site and finds an incorrect judgment, they can feed that information back into the AI ​​model and use it for retraining.

[0111] This enables early identification of fraudulent emails and effective countermeasures against attackers, allowing the accuracy of the system to be continuously improved.

[0112] Prompt Sentence Examples

[0113] text

[0114] Please generate a program that analyzes emails received by the system and determines whether they are fraudulent. Furthermore, if an email is identified as fraudulent, please add a process to access a phishing site using false information and send false information on the front end. Also, please include a procedure to retrain the AI ​​model based on user feedback.

[0115] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0116] Step 1:

[0117] The server receives email from an external mail server. The server retrieves new mail using the IMAP or POP3 protocol.

[0118] Enter your mail server connection information (e.g., mail.example.com)

[0119] Output: Received email data

[0120] What it does: The server periodically connects to the mail server and checks for new email using the IMAP protocol. If there is new email, it downloads it and stores it locally.

[0121] Step 2:

[0122] The server analyzes the header information and body content of the email received using the Python email package.

[0123] Input: Received email data

[0124] Output: Email header information and body content

[0125] Specific operation: The server parses the email data and extracts the sender address, subject, and email body. For example, it extracts the sender address "unknown@example.com" and the subject "Important: Update your account information."

[0126] Step 3:

[0127] The server uses a filtering system to identify potentially fraudulent emails and place them in a queue for analysis.

[0128] Input: Email header information and body content

[0129] Output: List of potentially fraudulent emails

[0130] What happens: The server uses filtering rules to identify potentially fraudulent emails by comparing them with blacklists. If there is a high probability of fraud, the email is queued for analysis. For example, if the sender address is on a blacklist, the email is added to the analysis queue.

[0131] Step 4:

[0132] The terminal retrieves emails stored in the analysis queue and performs detailed analysis using a natural language processing (NLP) module.

[0133] Input: Potentially fraudulent email data

[0134] Output: Fraudulent email identification results

[0135] How it works: The device retrieves an email from the analysis queue and passes the email body to the NLP module. The NLP module analyzes the email body for phrases that suggest fraud, detecting phrases such as "update your bank account information." If the email is identified as fraudulent, the result is fed back to the server.

[0136] Step 5:

[0137] The server generates an unused identity, for example using the Faker library.

[0138] Input: Fraudulent email identification results

[0139] Output: Fake information (e.g. random email address, name, address, credit card information)

[0140] What it does: The server uses the Faker library to generate random email addresses, such as "fakeuser@example.com", and create fake names, addresses, and credit card information.

[0141] Step 6:

[0142] The server accesses the phishing site, enters the generated fake information, and submits it. This is done using a browser automation tool such as Selenium.

[0143] Input: Fake information and the URL of the phishing site included in the fraudulent email

[0144] Output: Status of completion of sending fake information to phishing site

[0145] What happens: The server uses Selenium to launch a browser, access the URL in the fraudulent email, enter the generated fake information into the form on the phishing site, and click the submit button to send the false information to the attacker.

[0146] Step 7:

[0147] Users access the system's management console and monitor the AI's results in identifying fraudulent emails.

[0148] Input: System result

[0149] Output: Feedback on the judgment result

[0150] What happens: A user logs in to the admin console and checks the list of emails that have been identified as fraudulent. The system checks whether the emails in question have been correctly identified and provides information about any false positives.

[0151] Step 8:

[0152] The server receives feedback from users and retrains the AI ​​model using TensorFlow's retraining function.

[0153] Input: User feedback

[0154] Output: Retrained AI model

[0155] What it does: The server creates a new dataset and retrains the AI ​​model using TensorFlow's retraining function. The retrained AI model is then applied to the system to improve the accuracy of the next judgment.

[0156] This enables early identification of fraudulent emails and effective countermeasures against attackers, allowing the accuracy of the system to be continuously improved.

[0157] (Application example 1)

[0158] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0159] In today's communications environment, fraudulent emails and phishing attacks are on the rise, putting users' personal information and assets at risk. Conventional email filtering systems have limited accuracy in detecting fraudulent emails and often require manual management by users. Furthermore, they lack the means to not only identify fraudulent emails but also deceive attackers. In addition, there is a lack of systems with re-learning capabilities that effectively utilize user feedback. To address these issues, a more advanced and efficient fraudulent email prevention system is needed.

[0160] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0161] In this invention, the server includes: means for filtering emails received by the communication device from outside; means for identifying potentially fraudulent emails and storing the emails in an analysis queue; means for analyzing the emails stored in the analysis queue using natural language processing technology to identify fraudulent emails; means for generating false information based on emails identified as fraudulent emails and inputting the false information into a fraudulent website; means for receiving feedback from users and retraining the AI ​​model; means for monitoring emails in real time on a smart device and automatically identifying and processing fraudulent emails; and means for determining whether an email is fraudulent using prompt sentences generated by the AI ​​model. This enables advanced identification of fraudulent emails and immediate response, as well as continuous improvement of the system's accuracy using user feedback.

[0162] A "communications device" is a device for sending and receiving data, including e-mail.

[0163] "Filtering" is the process of examining emails received from outside and selecting those that meet certain conditions.

[0164] An "analysis queue" is a collection of emails that have been filtered and are temporarily stored for further analysis and inspection.

[0165] "Natural language processing technology" is a technology that allows computers to understand human language, and is used when analyzing the content of email text.

[0166] "Fraudulent email" refers to email created and sent with the intent to deceive the recipient and illegally obtain personal information or money.

[0167] "Fake information" is false data prepared to deceive attackers and is information entered into fraudulent websites.

[0168] "Feedback" refers to evaluations and opinions provided by users regarding the system's operational results and judgments.

[0169] "Retraining" is the process of updating and improving an existing AI model based on user feedback.

[0170] A "smart device" is a portable electronic device that can connect to the Internet, such as a smartphone or tablet.

[0171] A "prompt sentence" is an input sentence used in natural language analysis by an AI model.

[0172] The system for implementing this invention mainly consists of three main components: a communication device (server), an analysis terminal (terminal), and a user. This system uses smart devices to monitor emails in real time and automatically detects, identifies, and removes fraudulent emails. The specific operation of each component is shown below.

[0173] First, the server filters emails received from outside and identifies potentially fraudulent emails. Identified emails are stored in an analysis queue and passed on to subsequent processing steps. Next, emails stored in the analysis queue are processed on the device and analyzed in detail using natural language processing technology installed on the device. The natural language processing technology used here utilizes OpenAI's API.

[0174] If a fraudulent email is identified, the server generates fake information and uses it to fill in and submit forms on the fraudulent website. This fake information includes unused email addresses, false names, addresses, and credit card information. This reduces the effectiveness of fraudulent activities by limiting the attacker to false information.

[0175] Furthermore, users can monitor the system's operation and check the AI's judgments. By receiving user feedback and retraining the AI ​​model on the device, the system's accuracy is continuously improved.

[0176] The specific hardware used is a smartphone or tablet, and the software uses Python, the IMAP library (imaplib), the SMTP library (smtplib), and the OpenAI API. The combination of these elements creates an efficient and effective fraud email prevention system.

[0177] For example, if an email is received from the address "unknown@example.com" asking the user to "update their bank account information," the system will identify the email as fraudulent. The user will then click on the phishing link provided and enter false information. Examples of prompts used in this process include:

[0178] Prompt statement:

[0179] "Please check if this email is fraudulent: This email is asking you to update your bank account information. Click the link below to complete the process: http: / / phishing-link.example.com"

[0180] In this way, the system can detect fraudulent emails in real time and keep users safe by deceiving attackers.

[0181] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0182] Step 1:

[0183] The server receives emails from the outside world. As input, it has unread emails stored in the inbox. The server connects to the mail server using the IMAP protocol and pulls the emails from the inbox. The output of this step is all the retrieved email data.

[0184] Step 2:

[0185] The server filters incoming emails. The input is the email data obtained in step 1. It analyzes the header information and body of the incoming emails to identify emails that match certain criteria (e.g., unknown senders, suspicious content). In this step, it stores emails that are likely to be fraudulent in an analysis queue. The output is the emails stored in the analysis queue.

[0186] Step 3:

[0187] The device receives emails stored in the analysis queue and analyzes them using natural language processing technology. The input is the email data in the analysis queue. The device uses the OpenAI API to analyze the email body and identify whether it is a fraudulent email. During this process, it sends a prompt to the generative AI model. For example, "Please diagnose whether this email is a fraudulent email: [email content]." The output is the determination result of whether the email is a fraudulent email.

[0188] Step 4:

[0189] The server generates fake information based on emails identified as fraudulent. The inputs are the results of the judgment in step 3 and the contents of the fraudulent email. The server prepares unused email addresses, false names, addresses, credit card information, etc., and enters them into a form on the fraudulent website and submits it. The output of this step is the fake information sent to the fraudulent website.

[0190] Step 5:

[0191] The user monitors the system's operation and checks the AI's judgment results. The inputs include the system's judgment results and records of false information transmissions. The user accesses this information through a browser or a dedicated application. The output is user feedback, which is used to retrain the AI ​​model.

[0192] Step 6:

[0193] The device receives feedback from the user and retrains the AI ​​model. The input is the feedback data provided by the user. The device sends this feedback data to the OpenAI API and retrains the AI ​​model. This improves the accuracy of fraudulent email detection from the next time onwards. The output of this step is an updated AI model.

[0194] Furthermore, an emotion engine that estimates the user's emotion may be combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0195] This invention relates to a fraudulent email prevention system, and provides an efficient method for preventing fraudulent emails in particular. The system of this invention consists of four main components: a communication device (server), an analysis terminal (terminal), a user, and an emotion engine.

[0196] 1. Receiving and filtering emails

[0197] The server receives email from outside. The server connects to the mail server and receives emails sent to users. It then filters out potentially fraudulent emails based on the header information and body content of the received emails.

[0198] Examples:

[0199] Let's say you receive two emails, one from "example@trusted.com" and one from "unknown@example.com." If your server filters the email from "unknown@example.com" and determines it is likely to be fraudulent, it places the email in a queue for analysis.

[0200] 2. AI-based fraudulent email identification

[0201] Emails stored in the analysis queue are processed on the terminal. The terminal is equipped with an AI module that uses natural language processing technology to perform detailed analysis of the email body. If the email is identified as fraudulent, the results are fed back to the server.

[0202] Examples:

[0203] The device detects if the email body contains phrases asking you to "update your bank account information" or suspicious link URLs, and identifies it as a fraudulent email.

[0204] 3. Visiting phishing sites and sending false information

[0205] If the email is identified as fraudulent, the server prepares fake data such as an unused email address or phone number, accesses the phishing site URL listed in the fraudulent email, enters the fake information into a form, and submits it.

[0206] Examples:

[0207] The server uses the email address "fakeuser@example.com" to access the phishing site, then enters a false name, address, credit card information, etc., and submits the form. This operation allows the attacker to obtain only false information, reducing the effectiveness of the fraud.

[0208] 4. Feedback and Retraining

[0209] Users monitor the system's operation, check the AI's verdicts, and if they're incorrect, provide feedback to retrain the model, improving the system's accuracy and its ability to detect future fraudulent emails.

[0210] Examples:

[0211] The user accesses the system's management console and checks the details of the information sent to the phishing site. If there is a false positive, that information is fed back to the AI ​​model. This information is used to retrain the AI ​​and improve its accuracy the next time.

[0212] 5. Incorporating an Emotional Engine

[0213] The system of the present invention incorporates an emotion engine for recognizing the user's emotions, assessing the user's emotional state from their inputs and actions, and adapting the system's response.

[0214] Examples:

[0215] When a user provides feedback, the emotion engine analyzes the user's emotional state (e.g., stress, satisfaction). For example, if the user is dissatisfied, the system immediately takes measures to improve the problem. The user's emotion data is also used to retrain the AI ​​model, improving the analysis accuracy by taking emotion data into account.

[0216] conclusion

[0217] The system of the present invention can intentionally fall for fraudulent emails, providing false information to attackers and reducing the success rate of fraudulent activities. Furthermore, by incorporating an emotion engine, it is possible to recognize the user's emotional state and adapt the system's response. Continuous learning through user feedback improves the system's accuracy and efficiency. This configuration makes it possible to effectively deter fraudulent activities.

[0218] The processing flow will be explained below.

[0219] Step 1:

[0220] The server receives email from the outside. The server connects to the mail server and receives emails sent to users.

[0221] Step 2:

[0222] The server filters the header information and body content of received emails based on specific criteria, such as the sender's domain, keywords in the subject line, and specific phrases in the body of the email.

[0223] Step 3:

[0224] The server identifies potentially fraudulent emails and places them in a queue for analysis. For example, if an email from "unknown@example.com" is determined to be likely fraudulent, it will be moved to the analysis queue.

[0225] Step 4:

[0226] The terminal retrieves the emails stored in the analysis queue. The terminal checks the analysis queue at regular intervals and retrieves newly stored emails.

[0227] Step 5:

[0228] The device's AI module analyzes the email using natural language processing technology, extracting features from the email body such as phishing links, phrases indicating urgency, and requests for personal information.

[0229] Step 6:

[0230] The device will score whether the email is fraudulent or not based on the extracted features. If the score exceeds a certain level, it will be determined to be fraudulent.

[0231] Step 7:

[0232] The device determines whether the email is fraudulent and sends the results back to the server.

[0233] Step 8:

[0234] The server prepares fake information such as unused email addresses and phone numbers based on emails that are determined to be fraudulent.

[0235] Step 9:

[0236] The server accesses the phishing site URL included in the fraudulent email.

[0237] Step 10:

[0238] The server analyzes the phishing site's form and fills in the fields with prepared fake information, such as a fake name, address, and credit card information.

[0239] Step 11:

[0240] The server submits the form on the phishing site, sending false information to the attacker, which prevents the attacker from obtaining the correct information, reducing the success rate of the fraud.

[0241] Step 12:

[0242] Users monitor the system's operations and judgment results. Users access the system's management console to check details.

[0243] Step 13:

[0244] If a user makes a false positive, they can provide that information back to the system, which will then use it to retrain the AI ​​model.

[0245] Step 14:

[0246] The device's AI module retrains based on feedback provided by the user, improving the accuracy of the model.

[0247] Step 15:

[0248] To recognize emotions from user input and behavior, the device uses an emotion engine that analyzes the content, speed, and behavioral patterns of the user's input.

[0249] Step 16:

[0250] The device's emotion engine classifies the user's emotional state into multiple categories (e.g., joy, anger, sadness, happiness).

[0251] Step 17:

[0252] The device's emotion engine adapts how and when feedback is provided based on the user's emotional state, for example, providing feedback in a simpler way if the user is feeling stressed.

[0253] Step 18:

[0254] The device's emotion engine also uses the user's emotion data to retrain the AI ​​model, improving the accuracy of future analysis.

[0255] Through this series of processing steps, the system of the present invention effectively identifies fraudulent emails and neutralizes the fraudulent activities. Also, by taking into account the user's emotions, a more intuitive and adaptive feedback process is realized, improving the accuracy and efficiency of the system.

[0256] Example 2

[0257] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0258] In modern society, fraudulent emails are becoming more prevalent, causing many people to suffer financial losses and the leakage of personal information. Conventional methods have limited detection accuracy and countermeasures against fraudulent emails, making it difficult to effectively prevent them. Furthermore, systems often respond in a fixed manner without taking the user's emotional state into account, resulting in a poor user experience. Given these circumstances, there is a need for a system that can accurately detect fraudulent emails and respond to the user's emotional state.

[0259] The identification process by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means. In this invention, the server includes means for filtering electronic information received from an external device by a communication device, means for identifying potentially fraudulent electronic information and storing the electronic information in an analysis queue, means for analyzing the electronic information stored in the analysis queue using natural language processing technology and identifying fraudulent information, means for generating false information based on the electronic information identified as fraudulent information and inputting it to a fraudulent website, means for receiving feedback from a user and retraining the generation AI model, and means for evaluating the user's emotional state using an emotion engine and adapting the system's response. This enables highly accurate detection of fraudulent emails, improves the user experience, and enables effective and flexible deterrence of fraudulent activities.

[0260] "Communications equipment" refers to any device that receives electronic information from the outside and processes the data internally.

[0261] "Electronic Information" refers to data transmitted in electronic form, such as by email.

[0262] "Filtering" refers to the process of sorting received electronic information based on specific criteria to remove inappropriate data.

[0263] "Analysis queue" refers to a data structure for temporarily storing electronic information that requires analysis.

[0264] "Natural language processing technology" refers to a method by which computers understand and analyze human language.

[0265] "Fraudulent Information" means electronic information created with the intent to commit fraud.

[0266] "False information" refers to false data intentionally generated to prevent fraud.

[0267] A "phishing site" is a website designed to defraud users of their personal information.

[0268] "Feedback" refers to the evaluations and opinions provided by users regarding the system's judgment results.

[0269] A "generative AI model" refers to an artificial intelligence algorithm that learns patterns from large amounts of data and is trained to perform specific tasks.

[0270] "Emotion engine" refers to the algorithms and software used to assess a user's emotional state and adapt the system's response.

[0271] "Header information" refers to metadata such as the sender, recipient, date and time included at the beginning of electronic information.

[0272] "Scoring" refers to the process of numerically assessing the importance and risk of electronic information based on specific criteria.

[0273] The present invention is a fraudulent email prevention system that consists of four main components: a communication device, an analysis terminal, a user, and an emotion engine. A specific embodiment of this system will be described in detail below.

[0274] Receiving and filtering emails

[0275] The server connects to the mail server using IMAP or POP3 protocols to receive emails sent to users. The received emails are analyzed for header information and body content, and then filtered based on specific spam filter rules and blacklists. For example, emails from "unknown@example.com" are filtered and stored in a queue for analysis.

[0276] AI-based fraudulent email identification

[0277] The terminal takes emails stored in the analysis queue and analyzes them using natural language processing techniques. This analysis uses Python natural language processing libraries (e.g., NLTK and SpaCy). Specifically, the email body is tokenized and keywords and phrases characteristic of fraud are extracted. A machine learning model (e.g., a model using Scikit-learn or TensorFlow) is then applied to determine whether the email is fraudulent. For example, the terminal may detect phrases such as "update your bank account information" or suspicious links and identify the email as fraudulent.

[0278] Visiting phishing sites and sending false information

[0279] If the email is identified as fraudulent, the server generates fake information. Specifically, it prepares an unused email address and randomly generated personal information (such as name, address, phone number, and credit card information). It then sends an HTTP request to access the phishing site URL listed in the fraudulent email, enters the fake information into the form, and submits it. For example, the server accesses the phishing site using the email address "fakeuser@example.com" and submits the fake information.

[0280] Feedback and Retraining

[0281] Users access the system administration console to check the AI's judgment results and information sent to phishing sites. If an incorrect judgment is made, the user provides feedback. For example, they can input information such as "this email is legitimate" into the system. The feedback information is used to retrain the AI ​​model, and the accuracy of the system is improved by retraining the generative AI model (for example, a model implemented in TensorFlow or PyTorch).

[0282] Incorporating an emotion engine

[0283] The system incorporates an emotion engine to evaluate the user's emotional state. The emotion engine collects emotion data through the user's feedback process and UX interactions, and uses an emotion analysis model (e.g., Sentiment Analysis API or a custom emotion analysis model) to evaluate the user's emotional state (e.g., stress, satisfaction). If the user is dissatisfied, the system automatically takes appropriate measures. The emotion data is also incorporated into the AI ​​model's retraining process, further improving the accuracy of the analysis.

[0284] Example prompt: If two emails are received, one from "example@trusted.com" and one from "unknown@example.com", and the email from "unknown@example.com" is filtered and identified as a fraudulent email, place it in the analysis queue.

[0285] According to this embodiment, the accuracy of detecting fraudulent emails is improved, and the user experience is also improved at the same time. A system for maximizing the deterrent effect of fraudulent acts is provided.

[0286] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0287] Step 1: Receiving email and initial filtering

[0288] The server connects to an external mail server using the IMAP or POP3 protocol to receive new, unread emails, which are then temporarily stored before being analyzed.

[0289] Input: Unread emails received from external mail servers

[0290] Output: Archived unread emails

[0291] The server scans the header information (sender, subject, date and time of receipt, etc.) and part of the body of the email received, and filters out suspicious emails based on spam filtering rules and blacklists.

[0292] What happens: The server filters email from "unknown@example.com" to identify potentially fraudulent emails.

[0293] Input: Archived unread emails

[0294] Output: Filtered emails

[0295] Step 2: Queueing the analysis

[0296] The server stores filtered suspicious emails in an analysis queue, which serves as a temporary repository for subsequent detailed analysis.

[0297] Input: filtered email

[0298] Output: Emails queued for analysis

[0299] Step 3: Identifying fraudulent emails with AI

[0300] The device retrieves emails from the analysis queue, tokenizes and analyzes the email body using natural language processing techniques (e.g., NLTK or SpaCy), extracts keywords and phrases characteristic of fraud, and applies machine learning models (e.g., Scikit-learn or TensorFlow) to determine whether the email is fraudulent.

[0301] What it does: The device will detect phrases like "update your bank account information" and suspicious links and identify the email as fraudulent.

[0302] Input: Emails stored in the analysis queue

[0303] Output: Fraudulent email detection result

[0304] Step 4: Generate and send fake information

[0305] If the email is identified as fraudulent, the server generates an unused email address and randomly generated personal information (such as name, address, phone number, credit card information, etc.).

[0306] Input: Fraudulent email detection result

[0307] Output: Fake information

[0308] The server sends an HTTP request to access the phishing site URL listed in the fraudulent email, enters false information into the form, and submits it.

[0309] Specific actions: Access a phishing site using the email address "fakeuser@example.com" and send fake information.

[0310] Input: Fake information

[0311] Output: Result of sending to phishing site

[0312] Step 5: Feedback and Retraining

[0313] The user accesses the system management console to check the AI's judgment results and information sent to phishing sites. If there are any incorrect judgments, the user provides feedback. This feedback information is used to retrain the AI ​​model.

[0314] Specific action: The user enters information into the system, such as "this email is legitimate."

[0315] Input: AI judgment results, user evaluation

[0316] Output: AI model reflecting the correction results

[0317] Step 6: Incorporating the Emotion Engine

[0318] The server collects emotional data through the user's feedback process and UX interactions, and evaluates the user's emotional state using a sentiment analysis model (e.g., Sentiment Analysis API or a self-made sentiment analysis model).

[0319] Input: User feedback, interaction data

[0320] Output: User's emotional state rating

[0321] The server adapts the system's response based on the user's emotional state: if negative emotions are detected, the system automatically takes countermeasures.

[0322] Specific action: If the emotional state is evaluated as "stressed," the system will strengthen the user support function.

[0323] Input: User's emotional state rating

[0324] Output: Result of countermeasure implementation

[0325] (Application example 2)

[0326] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0327] In recent years, fraudulent activities have become increasingly sophisticated, with an increase in fraudulent activities using email and other communication methods. Conventional methods are inadequate to deal with such fraudulent activities, resulting in a constant stream of user damage. Furthermore, in detecting and combating fraudulent activities, automated methods for early detection and responses that take into account the user's emotional state are required. The present invention aims to solve these problems and provide a system for efficiently detecting and responding to fraudulent communications.

[0328] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 2 is realized by the following means.

[0329] In this invention, the server includes means for filtering communications received by the communication device from outside, means for identifying potentially fraudulent communications and storing the communications in an analysis queue, means for analyzing the communications stored in the analysis queue using natural language processing technology to identify fraudulent communications, means for generating false information based on communications identified as fraudulent communications and inputting it to a fraudulent website, means incorporating an emotion engine that evaluates the emotional state of the user from input and adapts the system's response based on that evaluation, and means for receiving feedback from the user and retraining the generation AI model, thereby enabling early detection of fraudulent communications and effective countermeasures.

[0330] A "communications device" is an electronic device or system for receiving and processing electronic mail or other forms of communication.

[0331] "Filtering means" is a function that analyzes the content of received communications and determines and classifies their importance and risk based on specific conditions.

[0332] "Potentially fraudulent communications" are communications that are deemed to contain an intention to deceive users and steal their money or personal information.

[0333] An "analysis queue" is a temporary storage location or list of filtered communications for further detailed analysis.

[0334] "Natural language processing technology" is a technology for analyzing human language using machines, and specifically, it is a method for understanding sentences, analyzing their meaning, and classifying them.

[0335] The "means for identifying fraudulent communications" is a function that uses natural language processing technology to determine whether a received communication contains fraudulent intent.

[0336] "Fake information" refers to fictitious personal information or credit card information that is entered into a fraudulent website.

[0337] A "fraudulent website" is a fraudulent website that aims to fraudulently obtain money or personal information from users.

[0338] The "emotion engine" is a function that evaluates the user's emotional state based on their input and actions and adjusts the system's response.

[0339] A "generative AI model" is a predictive model that is automatically generated by AI and is retrained based on user feedback.

[0340] The present invention relates to a system for effectively detecting and combating fraudulent communications, which includes a communication device, a filtering means, an analytical queue, a fraudulent communications identification means using natural language processing techniques, a false information generation means, an emotion engine, and a retraining means using a generative AI model.

[0341] System Configuration

[0342] The system mainly consists of the following components:

[0343] 1. Communications equipment

[0344] Receives external communications and processes them on the system.

[0345] Specifically, electronic devices such as servers and smartphones are used to receive email and other communications.

[0346] 2. Filtering Methods

[0347] Scans header information and the body of communications to identify potentially fraudulent communications.

[0348] Filtering criteria include the sender address, email content, and whether or not the email contains links.

[0349] 3. Analysis Queue

[0350] Temporarily store filtered communications and prepare them for further analysis.

[0351] This storage location is often a portion of a server or a dedicated database.

[0352] 4. Methods for identifying fraudulent communications using natural language processing (NLP)

[0353] It uses NLP technology to analyze the content of communications and identify fraudulent activity.

[0354] For example, we use the Transformers library to determine the likelihood of fraud based on the overall context or specific keywords.

[0355] 5. Methods for generating false information

[0356] If the communication is identified as fraudulent, false personal information, credit card information, etc. is generated and entered into the fraudulent website.

[0357] The deceptive information is randomly generated to ensure that attackers only obtain meaningless data.

[0358] 6. Emotion Engine

[0359] It assesses the user's emotional state from their input and behavior and adapts the system's response accordingly.

[0360] For example, if the user is feeling stressed, the system will take measures such as displaying a supportive message.

[0361] 7. Retraining Methods (Generative AI Models)

[0362] Receive user feedback and retrain the generative AI model.

[0363] This will continually improve the system's ability to identify fraudulent communications.

[0364] Specific examples

[0365] As a concrete example of how this system can be used, consider the case where a user receives email using a smartphone. The system automatically filters the emails received by the user and stores potentially fraudulent emails in an analysis queue. Next, the emails stored in the analysis queue are analyzed in detail using natural language processing technology, and may be identified as fraudulent emails. At this time, false information is generated and entered into the fraudulent website specified in the fraudulent email. At the same time, feedback from the user is received, allowing the generative AI model to be retrained and the system's performance to improve.

[0366] Examples of specific prompts include the following:

[0367] "I've been receiving a lot of phishing emails lately, but since I started using this app, I've hardly fallen for them. I would like you to strengthen the email filtering function to further improve the accuracy of the system."

[0368] This system enables early detection of fraudulent communications and effective countermeasures, thereby increasing users' sense of security.

[0369] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0370] Step 1:

[0371] The server receives emails from the outside via communication devices. The received emails are first scanned on the server for header information and body content. The header information and body content of the email are passed to the server as input, and the risk of the email is determined based on this, after which filtering is performed. As an output, potentially fraudulent emails are identified and stored in an analysis queue.

[0372] Step 2:

[0373] The server queues identified potentially fraudulent emails for analysis. In this step, filtered emails are stored in a dedicated database or temporary storage area for further analysis. The input is the filtered emails, and the output is the emails stored in the analysis queue.

[0374] Step 3:

[0375] The device analyzes the emails stored in the analysis queue using natural language processing (NLP) technology. Here, the text data of the input email body is analyzed in detail using the Transformers library, etc. Keywords and phrases that determine fraudulence are detected, and emails identified as fraudulent are generated as output.

[0376] Step 4:

[0377] The server generates fake information based on emails identified as fraudulent and inputs that information into the fraudulent website. The input is the fraudulent email and the fake information template used to generate it, and the output is the fake information sent to the fraudulent website. Specifically, randomly generated fake personal information and credit card information is used. This fake information is sent from the server to the fraudulent website as an HTTP request.

[0378] Step 5:

[0379] The user monitors the system's operation and provides feedback. The user's feedback is analyzed by the emotion engine. The user provides a feedback statement as input, which is then analyzed by the emotion engine. The analysis results in an evaluation of the user's emotional state (e.g., satisfied, dissatisfied) and is output.

[0380] Step 6:

[0381] The server retrains the generative AI model based on user feedback. The input is the user feedback data and the analysis results of the emotion engine, and the output is updated parameters of the AI ​​model. By retraining the model, the accuracy of identifying fraudulent emails next time will improve.

[0382] This will enable early detection of fraudulent communications and effective countermeasures.

[0383] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0384] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0385] In the above embodiment, an example in which the specific process is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific process may be performed by the smart device 14.

[0386] [Second embodiment]

[0387] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0388] 3, the data processing system 210 includes the data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0389] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0390] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0391] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0392] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0393] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0394] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0395] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0396] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0397] In the smart glasses 214, the reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0398] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal."

[0399] The present invention relates to a fraudulent email prevention system, and provides an efficient method for preventing fraudulent emails in particular. The system of the present invention consists of three main components: a communication device (server), an analysis terminal (terminal), and a user.

[0400] 1. Receiving and filtering emails

[0401] The server receives email from outside. The server connects to the mail server and receives emails sent to users. It then filters out potentially fraudulent emails based on the header information and body content of the received emails.

[0402] Examples:

[0403] Let's say you receive two emails, one from "example@trusted.com" and one from "unknown@example.com." If your server filters the email from "unknown@example.com" and determines it is likely to be fraudulent, it places the email in a queue for analysis.

[0404] 2. AI-based fraudulent email identification

[0405] Emails stored in the analysis queue are processed on the terminal. The terminal is equipped with an AI module that uses natural language processing technology to perform detailed analysis of the email body. If the email is identified as fraudulent, the results are fed back to the server.

[0406] Examples:

[0407] The device detects if the email body contains phrases asking you to "update your bank account information" or suspicious link URLs, and identifies it as a fraudulent email.

[0408] 3. Visiting phishing sites and sending false information

[0409] If the email is identified as fraudulent, the server prepares fake data such as an unused email address or phone number, accesses the phishing site URL listed in the fraudulent email, enters the fake information into a form, and submits it.

[0410] Examples:

[0411] The server uses the email address "fakeuser@example.com" to access the phishing site, then enters a false name, address, credit card information, etc., and submits the form. This operation allows the attacker to obtain only false information, reducing the effectiveness of the fraud.

[0412] 4. Feedback and Retraining

[0413] Users monitor the system's operation, check the AI's verdicts, and if they're incorrect, provide feedback to retrain the model, improving the system's accuracy and its ability to detect future fraudulent emails.

[0414] Examples:

[0415] The user accesses the system's management console and checks the details of the information sent to the phishing site. If there is a false positive, that information is fed back to the AI ​​model. This information is used to retrain the AI ​​and improve its accuracy the next time.

[0416] conclusion

[0417] The system of the present invention can intentionally fall for fraudulent emails, providing false information to attackers and reducing the success rate of fraudulent activities. Furthermore, the AI ​​model is retrained based on user feedback, allowing the system's accuracy to be continuously improved. This configuration makes it possible to effectively deter fraudulent activities.

[0418] The processing flow will be explained below.

[0419] Step 1:

[0420] The server receives email from the outside. It connects to the mail server and receives emails sent to users.

[0421] Step 2:

[0422] The server filters the header information and body content of emails received based on specific criteria, such as the sender's domain, keywords in the subject line, and specific phrases in the body of the email.

[0423] Step 3:

[0424] The server identifies potentially fraudulent emails and places them in a queue for analysis. For example, if an email from "unknown@example.com" is determined to be highly likely to be fraudulent, it will be moved to the analysis queue.

[0425] Step 4:

[0426] The device retrieves the emails stored in the analysis queue.

[0427] Step 5:

[0428] The device's AI module analyzes the email using natural language processing technology, extracting features from the email body such as phishing links, phrases indicating urgency, and requests for personal information.

[0429] Step 6:

[0430] The device will score whether the email is fraudulent or not based on the extracted features. If the score exceeds a certain level, it will be determined to be fraudulent.

[0431] Step 7:

[0432] The device determines whether the email is fraudulent and sends the results back to the server.

[0433] Step 8:

[0434] The server prepares fake information such as unused email addresses and phone numbers based on emails that are determined to be fraudulent.

[0435] Step 9:

[0436] The server accesses the phishing site URL included in the fraudulent email.

[0437] Step 10:

[0438] The server analyzes the phishing site's form and fills in the fields with prepared fake information, such as a fake name, address, and credit card information.

[0439] Step 11:

[0440] The server submits the form on the phishing site, sending false information to the attacker, which prevents the attacker from obtaining the correct information, reducing the success rate of the fraud.

[0441] Step 12:

[0442] Users monitor the system's operations and judgment results. Users access the system's management console to check details.

[0443] Step 13:

[0444] If a user makes a false positive, they can provide that information back to the system, which will then use it to retrain the AI ​​model.

[0445] Step 14:

[0446] The device's AI module retrains based on feedback provided by the user, improving the accuracy of the model.

[0447] Through this series of processing steps, the system of the present invention effectively identifies fraudulent emails and neutralizes the fraudulent activity, and the accuracy and efficiency of the system improves through continuous learning based on user feedback.

[0448] Example 1

[0449] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0450] Fraudulent emails are increasing year by year, and the methods are becoming more sophisticated. Conventional filtering systems are incomplete in identifying fraudulent emails, increasing the risk of users falling prey to fraudulent schemes. Furthermore, effective countermeasures against attackers are lacking after identifying fraudulent emails. Furthermore, continuous re-learning is necessary to improve the accuracy of the system, and a method for efficiently incorporating user feedback is needed.

[0451] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0452] In this invention, the server includes means for filtering emails received by the communication device from outside, means for identifying potentially fraudulent emails and storing the emails in an analysis queue, means for analyzing the emails stored in the analysis queue using natural language processing technology to identify fraudulent emails, means for generating unused identification information based on emails identified as fraudulent emails and inputting it into a fraudulent website, means for receiving feedback from users and retraining the AI ​​model, means for automating access to the fraudulent website, and means for feeding back the analyzed information to the server. This enables early identification of fraudulent emails and effective countermeasures against attackers, and allows the accuracy of the system to be continuously improved.

[0453] "Communication equipment" refers to hardware or software that receives email from outside and provides that information to an internal system.

[0454] "Filtering" refers to the process of scanning incoming emails based on specific criteria to screen out potentially fraudulent emails.

[0455] An "analysis queue" is a queue where emails that have been filtered as potentially fraudulent are temporarily stored for further analysis at a later date.

[0456] "Natural language processing technology" refers to technology that uses computers to analyze and understand human language.

[0457] "Fraudulent email" refers to emails that are intended to deceive users and illegally obtain personal or financial information.

[0458] "Fake information" refers to false information provided to fraudulent sites that imitates real user information.

[0459] "Fraudulent Site" refers to a website designed for the purpose of committing fraud.

[0460] "Feedback" refers to the process of providing users with opinions and corrections regarding the system's judgment results, which are used to help the AI ​​model learn.

[0461] "Relearning" refers to the process by which an AI model improves its performance by retraining it based on new data and feedback.

[0462] "Automation" refers to the process where a system performs a series of operations independently without human intervention.

[0463] "Identification information" refers to information that uniquely identifies a specific individual or device.

[0464] The present invention relates to a fraudulent email prevention system, and provides an efficient method for preventing fraudulent emails in particular. The system of the present invention consists of three main components: a communication device (server), an analysis terminal (terminal), and a user.

[0465] First, the server receives email from an external mail server. The server retrieves new email using the IMAP or POP3 protocol and filters the received email. The filtering is done using the Python email package or other analysis tools. For example, the server periodically checks incoming email from "mail.example.com" and analyzes header information such as the sender address and subject line, as well as the body of the email.

[0466] The server then compares the email with blacklists and rule-based filtering systems and places potentially fraudulent emails in a queue for analysis. For example, if the sender address is "unknown@example.com," the email is added to the analysis queue as a fraudulent email.

[0467] Emails stored in the analysis queue are processed on the terminal. AI frameworks such as TensorFlow and PyTorch are installed on the terminal, and these are used to perform detailed analysis of the email body using natural language processing (NLP). For example, if the terminal detects a phrase in the email body that suggests fraud, such as "Please update your bank account information," it will identify the email as fraudulent and feed the result back to the server.

[0468] If the email is identified as fraudulent, the server generates fake information such as an unused email address and phone number using the Faker library. For example, it generates a random email address such as "fakeuser@example.com" and fake names, addresses, and credit card information.

[0469] The server then uses a browser automation tool such as Selenium to access the phishing site URL listed in the fraudulent email, enter the generated fake information into a form, and submit it. This reduces the effectiveness of the fraudulent activity because the attacker can only obtain false information. For example, the server accesses "http: / / phishingsite.com," enters fake names and credit card information, and submits it.

[0470] Users access the system's management console to monitor the AI's judgment of fraudulent emails. If the judgment is incorrect, the user can provide feedback to retrain the model. For example, if a user checks the details of the information sent to a phishing site and finds an incorrect judgment, they can feed that information back into the AI ​​model and use it for retraining.

[0471] This enables early identification of fraudulent emails and effective countermeasures against attackers, allowing the accuracy of the system to be continuously improved.

[0472] Prompt Sentence Examples

[0473] text

[0474] Please generate a program that analyzes emails received by the system and determines whether they are fraudulent. Furthermore, if an email is identified as fraudulent, please add a process to access a phishing site using false information and send false information on the front end. Also, please include a procedure to retrain the AI ​​model based on user feedback.

[0475] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0476] Step 1:

[0477] The server receives email from an external mail server. The server retrieves new mail using the IMAP or POP3 protocol.

[0478] Enter your mail server connection information (e.g., mail.example.com)

[0479] Output: Received email data

[0480] What it does: The server periodically connects to the mail server and checks for new email using the IMAP protocol. If there is new email, it downloads it and stores it locally.

[0481] Step 2:

[0482] The server analyzes the header information and body content of the email received using the Python email package.

[0483] Input: Received email data

[0484] Output: Email header information and body content

[0485] Specific operation: The server parses the email data and extracts the sender address, subject, and email body. For example, it extracts the sender address "unknown@example.com" and the subject "Important: Update your account information."

[0486] Step 3:

[0487] The server uses a filtering system to identify potentially fraudulent emails and place them in a queue for analysis.

[0488] Input: Email header information and body content

[0489] Output: List of potentially fraudulent emails

[0490] What happens: The server uses filtering rules to identify potentially fraudulent emails by comparing them with blacklists. If there is a high probability of fraud, the email is queued for analysis. For example, if the sender address is on a blacklist, the email is added to the analysis queue.

[0491] Step 4:

[0492] The terminal retrieves emails stored in the analysis queue and performs detailed analysis using a natural language processing (NLP) module.

[0493] Input: Potentially fraudulent email data

[0494] Output: Fraudulent email identification results

[0495] How it works: The device retrieves an email from the analysis queue and passes the email body to the NLP module. The NLP module analyzes the email body for phrases that suggest fraud, detecting phrases such as "update your bank account information." If the email is identified as fraudulent, the result is fed back to the server.

[0496] Step 5:

[0497] The server generates an unused identity, for example using the Faker library.

[0498] Input: Fraudulent email identification results

[0499] Output: Fake information (e.g. random email address, name, address, credit card information)

[0500] What it does: The server uses the Faker library to generate random email addresses, such as "fakeuser@example.com", and create fake names, addresses, and credit card information.

[0501] Step 6:

[0502] The server accesses the phishing site, enters the generated fake information, and submits it. This is done using a browser automation tool such as Selenium.

[0503] Input: Fake information and the URL of the phishing site included in the fraudulent email

[0504] Output: Status of completion of sending fake information to phishing site

[0505] What happens: The server uses Selenium to launch a browser, access the URL in the fraudulent email, enter the generated fake information into the form on the phishing site, and click the submit button to send the false information to the attacker.

[0506] Step 7:

[0507] Users access the system's management console and monitor the AI's results in identifying fraudulent emails.

[0508] Input: System result

[0509] Output: Feedback on the judgment result

[0510] What happens: A user logs in to the admin console and checks the list of emails that have been identified as fraudulent. The system checks whether the emails in question have been correctly identified and provides information about any false positives.

[0511] Step 8:

[0512] The server receives feedback from users and retrains the AI ​​model using TensorFlow's retraining function.

[0513] Input: User feedback

[0514] Output: Retrained AI model

[0515] What it does: The server creates a new dataset and retrains the AI ​​model using TensorFlow's retraining function. The retrained AI model is then applied to the system to improve the accuracy of the next judgment.

[0516] This enables early identification of fraudulent emails and effective countermeasures against attackers, allowing the accuracy of the system to be continuously improved.

[0517] (Application example 1)

[0518] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0519] In today's communications environment, fraudulent emails and phishing attacks are on the rise, putting users' personal information and assets at risk. Conventional email filtering systems have limited accuracy in detecting fraudulent emails and often require manual management by users. Furthermore, they lack the means to not only identify fraudulent emails but also deceive attackers. In addition, there is a lack of systems with re-learning capabilities that effectively utilize user feedback. To address these issues, a more advanced and efficient fraudulent email prevention system is needed.

[0520] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0521] In this invention, the server includes: means for filtering emails received by the communication device from outside; means for identifying potentially fraudulent emails and storing the emails in an analysis queue; means for analyzing the emails stored in the analysis queue using natural language processing technology to identify fraudulent emails; means for generating false information based on emails identified as fraudulent emails and inputting the false information into a fraudulent website; means for receiving feedback from users and retraining the AI ​​model; means for monitoring emails in real time on a smart device and automatically identifying and processing fraudulent emails; and means for determining whether an email is fraudulent using prompt sentences generated by the AI ​​model. This enables advanced identification of fraudulent emails and immediate response, as well as continuous improvement of the system's accuracy using user feedback.

[0522] A "communications device" is a device for sending and receiving data, including e-mail.

[0523] "Filtering" is the process of examining emails received from outside and selecting those that meet certain conditions.

[0524] An "analysis queue" is a collection of emails that have been filtered and are temporarily stored for further analysis and inspection.

[0525] "Natural language processing technology" is a technology that allows computers to understand human language, and is used when analyzing the content of email text.

[0526] "Fraudulent email" refers to email created and sent with the intent to deceive the recipient and illegally obtain personal information or money.

[0527] "Fake information" is false data prepared to deceive attackers and is information entered into fraudulent websites.

[0528] "Feedback" refers to evaluations and opinions provided by users regarding the system's operational results and judgments.

[0529] "Retraining" is the process of updating and improving an existing AI model based on user feedback.

[0530] A "smart device" is a portable electronic device that can connect to the Internet, such as a smartphone or tablet.

[0531] A "prompt sentence" is an input sentence used in natural language analysis by an AI model.

[0532] The system for implementing this invention mainly consists of three main components: a communication device (server), an analysis terminal (terminal), and a user. This system uses smart devices to monitor emails in real time and automatically detects, identifies, and removes fraudulent emails. The specific operation of each component is shown below.

[0533] First, the server filters emails received from outside and identifies potentially fraudulent emails. Identified emails are stored in an analysis queue and passed on to subsequent processing steps. Next, emails stored in the analysis queue are processed on the device and analyzed in detail using natural language processing technology installed on the device. The natural language processing technology used here utilizes OpenAI's API.

[0534] If a fraudulent email is identified, the server generates fake information and uses it to fill in and submit forms on the fraudulent website. This fake information includes unused email addresses, false names, addresses, and credit card information. This reduces the effectiveness of fraudulent activities by limiting the attacker to false information.

[0535] Furthermore, users can monitor the system's operation and check the AI's judgments. By receiving user feedback and retraining the AI ​​model on the device, the system's accuracy is continuously improved.

[0536] The specific hardware used is a smartphone or tablet, and the software uses Python, the IMAP library (imaplib), the SMTP library (smtplib), and the OpenAI API. The combination of these elements creates an efficient and effective fraud email prevention system.

[0537] For example, if an email is received from the address "unknown@example.com" asking the user to "update their bank account information," the system will identify the email as fraudulent. The user will then click on the phishing link provided and enter false information. Examples of prompts used in this process include:

[0538] Prompt statement:

[0539] "Please check if this email is fraudulent: This email is asking you to update your bank account information. Click the link below to complete the process: http: / / phishing-link.example.com"

[0540] In this way, the system can detect fraudulent emails in real time and keep users safe by deceiving attackers.

[0541] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0542] Step 1:

[0543] The server receives emails from the outside world. As input, it has unread emails stored in the inbox. The server connects to the mail server using the IMAP protocol and pulls the emails from the inbox. The output of this step is all the retrieved email data.

[0544] Step 2:

[0545] The server filters incoming emails. The input is the email data obtained in step 1. It analyzes the header information and body of the incoming emails to identify emails that match certain criteria (e.g., unknown senders, suspicious content). In this step, it stores emails that are likely to be fraudulent in an analysis queue. The output is the emails stored in the analysis queue.

[0546] Step 3:

[0547] The device receives emails stored in the analysis queue and analyzes them using natural language processing technology. The input is the email data in the analysis queue. The device uses the OpenAI API to analyze the email body and identify whether it is a fraudulent email. During this process, it sends a prompt to the generative AI model. For example, "Please diagnose whether this email is a fraudulent email: [email content]." The output is the determination result of whether the email is a fraudulent email.

[0548] Step 4:

[0549] The server generates fake information based on emails identified as fraudulent. The inputs are the results of the judgment in step 3 and the contents of the fraudulent email. The server prepares unused email addresses, false names, addresses, credit card information, etc., and enters them into a form on the fraudulent website and submits it. The output of this step is the fake information sent to the fraudulent website.

[0550] Step 5:

[0551] The user monitors the system's operation and checks the AI's judgment results. The inputs include the system's judgment results and records of false information transmissions. The user accesses this information through a browser or a dedicated application. The output is user feedback, which is used to retrain the AI ​​model.

[0552] Step 6:

[0553] The device receives feedback from the user and retrains the AI ​​model. The input is the feedback data provided by the user. The device sends this feedback data to the OpenAI API and retrains the AI ​​model. This improves the accuracy of fraudulent email detection from the next time onwards. The output of this step is an updated AI model.

[0554] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[0555] This invention relates to a fraudulent email prevention system, and provides an efficient method for preventing fraudulent emails in particular. The system of this invention consists of four main components: a communication device (server), an analysis terminal (terminal), a user, and an emotion engine.

[0556] 1. Receiving and filtering emails

[0557] The server receives email from outside. The server connects to the mail server and receives emails sent to users. It then filters out potentially fraudulent emails based on the header information and body content of the received emails.

[0558] Examples:

[0559] Let's say you receive two emails, one from "example@trusted.com" and one from "unknown@example.com." If your server filters the email from "unknown@example.com" and determines it is likely to be fraudulent, it places the email in a queue for analysis.

[0560] 2. AI-based fraudulent email identification

[0561] Emails stored in the analysis queue are processed on the terminal. The terminal is equipped with an AI module that uses natural language processing technology to perform detailed analysis of the email body. If the email is identified as fraudulent, the results are fed back to the server.

[0562] Examples:

[0563] The device detects if the email body contains phrases asking you to "update your bank account information" or suspicious link URLs, and identifies it as a fraudulent email.

[0564] 3. Visiting phishing sites and sending false information

[0565] If the email is identified as fraudulent, the server prepares fake data such as an unused email address or phone number, accesses the phishing site URL listed in the fraudulent email, enters the fake information into a form, and submits it.

[0566] Examples:

[0567] The server uses the email address "fakeuser@example.com" to access the phishing site, then enters a false name, address, credit card information, etc., and submits the form. This operation allows the attacker to obtain only false information, reducing the effectiveness of the fraud.

[0568] 4. Feedback and Retraining

[0569] Users monitor the system's operation, check the AI's verdicts, and if they're incorrect, provide feedback to retrain the model, improving the system's accuracy and its ability to detect future fraudulent emails.

[0570] Examples:

[0571] The user accesses the system's management console and checks the details of the information sent to the phishing site. If there is a false positive, that information is fed back to the AI ​​model. This information is used to retrain the AI ​​and improve its accuracy the next time.

[0572] 5. Incorporating an Emotional Engine

[0573] The system of the present invention incorporates an emotion engine for recognizing the user's emotions, assessing the user's emotional state from their inputs and actions, and adapting the system's response.

[0574] Examples:

[0575] When a user provides feedback, the emotion engine analyzes the user's emotional state (e.g., stress, satisfaction). For example, if the user is dissatisfied, the system immediately takes measures to improve the problem. The user's emotion data is also used to retrain the AI ​​model, improving the analysis accuracy by taking emotion data into account.

[0576] conclusion

[0577] The system of the present invention can intentionally fall for fraudulent emails, providing false information to attackers and reducing the success rate of fraudulent activities. Furthermore, by incorporating an emotion engine, it is possible to recognize the user's emotional state and adapt the system's response. Continuous learning through user feedback improves the system's accuracy and efficiency. This configuration makes it possible to effectively deter fraudulent activities.

[0578] The processing flow will be explained below.

[0579] Step 1:

[0580] The server receives email from the outside. The server connects to the mail server and receives emails sent to users.

[0581] Step 2:

[0582] The server filters the header information and body content of received emails based on specific criteria, such as the sender's domain, keywords in the subject line, and specific phrases in the body of the email.

[0583] Step 3:

[0584] The server identifies potentially fraudulent emails and places them in a queue for analysis. For example, if an email from "unknown@example.com" is determined to be likely fraudulent, it will be moved to the analysis queue.

[0585] Step 4:

[0586] The terminal retrieves the emails stored in the analysis queue. The terminal checks the analysis queue at regular intervals and retrieves newly stored emails.

[0587] Step 5:

[0588] The device's AI module analyzes the email using natural language processing technology, extracting features from the email body such as phishing links, phrases indicating urgency, and requests for personal information.

[0589] Step 6:

[0590] The device will score whether the email is fraudulent or not based on the extracted features. If the score exceeds a certain level, it will be determined to be fraudulent.

[0591] Step 7:

[0592] The device determines whether the email is fraudulent and sends the results back to the server.

[0593] Step 8:

[0594] The server prepares fake information such as unused email addresses and phone numbers based on emails that are determined to be fraudulent.

[0595] Step 9:

[0596] The server accesses the phishing site URL included in the fraudulent email.

[0597] Step 10:

[0598] The server analyzes the phishing site's form and fills in the fields with prepared fake information, such as a fake name, address, and credit card information.

[0599] Step 11:

[0600] The server submits the form on the phishing site, sending false information to the attacker, which prevents the attacker from obtaining the correct information, reducing the success rate of the fraud.

[0601] Step 12:

[0602] Users monitor the system's operations and judgment results. Users access the system's management console to check details.

[0603] Step 13:

[0604] If a user makes a false positive, they can provide that information back to the system, which will then use it to retrain the AI ​​model.

[0605] Step 14:

[0606] The device's AI module retrains based on feedback provided by the user, improving the accuracy of the model.

[0607] Step 15:

[0608] To recognize emotions from user input and behavior, the device uses an emotion engine that analyzes the content, speed, and behavioral patterns of the user's input.

[0609] Step 16:

[0610] The device's emotion engine classifies the user's emotional state into multiple categories (e.g., joy, anger, sadness, happiness).

[0611] Step 17:

[0612] The device's emotion engine adapts how and when feedback is provided based on the user's emotional state, for example, providing feedback in a simpler way if the user is feeling stressed.

[0613] Step 18:

[0614] The device's emotion engine also uses the user's emotion data to retrain the AI ​​model, improving the accuracy of future analysis.

[0615] Through this series of processing steps, the system of the present invention effectively identifies fraudulent emails and neutralizes the fraudulent activities. Also, by taking into account the user's emotions, a more intuitive and adaptive feedback process is realized, improving the accuracy and efficiency of the system.

[0616] Example 2

[0617] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0618] In modern society, fraudulent emails are becoming more prevalent, causing many people to suffer financial losses and the leakage of personal information. Conventional methods have limited detection accuracy and countermeasures against fraudulent emails, making it difficult to effectively prevent them. Furthermore, systems often respond in a fixed manner without taking the user's emotional state into account, resulting in a poor user experience. Given these circumstances, there is a need for a system that can accurately detect fraudulent emails and respond to the user's emotional state.

[0619] The identification process by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means. In this invention, the server includes means for filtering electronic information received from an external device by a communication device, means for identifying potentially fraudulent electronic information and storing the electronic information in an analysis queue, means for analyzing the electronic information stored in the analysis queue using natural language processing technology and identifying fraudulent information, means for generating false information based on the electronic information identified as fraudulent information and inputting it to a fraudulent website, means for receiving feedback from a user and retraining the generation AI model, and means for evaluating the user's emotional state using an emotion engine and adapting the system's response. This enables highly accurate detection of fraudulent emails, improves the user experience, and enables effective and flexible deterrence of fraudulent activities.

[0620] "Communications equipment" refers to any device that receives electronic information from the outside and processes the data internally.

[0621] "Electronic Information" refers to data transmitted in electronic form, such as by email.

[0622] "Filtering" refers to the process of sorting received electronic information based on specific criteria to remove inappropriate data.

[0623] "Analysis queue" refers to a data structure for temporarily storing electronic information that requires analysis.

[0624] "Natural language processing technology" refers to a method by which computers understand and analyze human language.

[0625] "Fraudulent Information" means electronic information created with the intent to commit fraud.

[0626] "False information" refers to false data intentionally generated to prevent fraud.

[0627] A "phishing site" is a website designed to defraud users of their personal information.

[0628] "Feedback" refers to the evaluations and opinions provided by users regarding the system's judgment results.

[0629] A "generative AI model" refers to an artificial intelligence algorithm that learns patterns from large amounts of data and is trained to perform specific tasks.

[0630] "Emotion engine" refers to the algorithms and software used to assess a user's emotional state and adapt the system's response.

[0631] "Header information" refers to metadata such as the sender, recipient, date and time included at the beginning of electronic information.

[0632] "Scoring" refers to the process of numerically assessing the importance and risk of electronic information based on specific criteria.

[0633] The present invention is a fraudulent email prevention system that consists of four main components: a communication device, an analysis terminal, a user, and an emotion engine. A specific embodiment of this system will be described in detail below.

[0634] Receiving and filtering emails

[0635] The server connects to the mail server using IMAP or POP3 protocols to receive emails sent to users. The received emails are analyzed for header information and body content, and then filtered based on specific spam filter rules and blacklists. For example, emails from "unknown@example.com" are filtered and stored in a queue for analysis.

[0636] AI-based fraudulent email identification

[0637] The terminal takes emails stored in the analysis queue and analyzes them using natural language processing techniques. This analysis uses Python natural language processing libraries (e.g., NLTK and SpaCy). Specifically, the email body is tokenized and keywords and phrases characteristic of fraud are extracted. A machine learning model (e.g., a model using Scikit-learn or TensorFlow) is then applied to determine whether the email is fraudulent. For example, the terminal may detect phrases such as "update your bank account information" or suspicious links and identify the email as fraudulent.

[0638] Visiting phishing sites and sending false information

[0639] If the email is identified as fraudulent, the server generates fake information. Specifically, it prepares an unused email address and randomly generated personal information (such as name, address, phone number, and credit card information). It then sends an HTTP request to access the phishing site URL listed in the fraudulent email, enters the fake information into the form, and submits it. For example, the server accesses the phishing site using the email address "fakeuser@example.com" and submits the fake information.

[0640] Feedback and Retraining

[0641] Users access the system administration console to check the AI's judgment results and information sent to phishing sites. If an incorrect judgment is made, the user provides feedback. For example, they can input information such as "this email is legitimate" into the system. The feedback information is used to retrain the AI ​​model, and the accuracy of the system is improved by retraining the generative AI model (for example, a model implemented in TensorFlow or PyTorch).

[0642] Incorporating an emotion engine

[0643] The system incorporates an emotion engine to evaluate the user's emotional state. The emotion engine collects emotion data through the user's feedback process and UX interactions, and uses an emotion analysis model (e.g., Sentiment Analysis API or a custom emotion analysis model) to evaluate the user's emotional state (e.g., stress, satisfaction). If the user is dissatisfied, the system automatically takes appropriate measures. The emotion data is also incorporated into the AI ​​model's retraining process, further improving the accuracy of the analysis.

[0644] Example prompt: If two emails are received, one from "example@trusted.com" and one from "unknown@example.com", and the email from "unknown@example.com" is filtered and identified as a fraudulent email, place it in the analysis queue.

[0645] According to this embodiment, the accuracy of detecting fraudulent emails is improved, and the user experience is also improved at the same time. A system for maximizing the deterrent effect of fraudulent acts is provided.

[0646] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0647] Step 1: Receiving email and initial filtering

[0648] The server connects to an external mail server using the IMAP or POP3 protocol to receive new, unread emails, which are then temporarily stored before being analyzed.

[0649] Input: Unread emails received from external mail servers

[0650] Output: Archived unread emails

[0651] The server scans the header information (sender, subject, date and time of receipt, etc.) and part of the body of the email received, and filters out suspicious emails based on spam filtering rules and blacklists.

[0652] What happens: The server filters email from "unknown@example.com" to identify potentially fraudulent emails.

[0653] Input: Archived unread emails

[0654] Output: Filtered emails

[0655] Step 2: Queueing the analysis

[0656] The server stores filtered suspicious emails in an analysis queue, which serves as a temporary repository for subsequent detailed analysis.

[0657] Input: filtered email

[0658] Output: Emails queued for analysis

[0659] Step 3: Identifying fraudulent emails with AI

[0660] The device retrieves emails from the analysis queue, tokenizes and analyzes the email body using natural language processing techniques (e.g., NLTK or SpaCy), extracts keywords and phrases characteristic of fraud, and applies machine learning models (e.g., Scikit-learn or TensorFlow) to determine whether the email is fraudulent.

[0661] What it does: The device will detect phrases like "update your bank account information" and suspicious links and identify the email as fraudulent.

[0662] Input: Emails stored in the analysis queue

[0663] Output: Fraudulent email detection result

[0664] Step 4: Generate and send fake information

[0665] If the email is identified as fraudulent, the server generates an unused email address and randomly generated personal information (such as name, address, phone number, credit card information, etc.).

[0666] Input: Fraudulent email detection result

[0667] Output: Fake information

[0668] The server sends an HTTP request to access the phishing site URL listed in the fraudulent email, enters false information into the form, and submits it.

[0669] Specific actions: Access a phishing site using the email address "fakeuser@example.com" and send fake information.

[0670] Input: Fake information

[0671] Output: Result of sending to phishing site

[0672] Step 5: Feedback and Retraining

[0673] The user accesses the system management console to check the AI's judgment results and information sent to phishing sites. If there are any incorrect judgments, the user provides feedback. This feedback information is used to retrain the AI ​​model.

[0674] Specific action: The user enters information into the system, such as "this email is legitimate."

[0675] Input: AI judgment results, user evaluation

[0676] Output: AI model reflecting the correction results

[0677] Step 6: Incorporating the Emotion Engine

[0678] The server collects emotional data through the user's feedback process and UX interactions, and evaluates the user's emotional state using a sentiment analysis model (e.g., Sentiment Analysis API or a self-made sentiment analysis model).

[0679] Input: User feedback, interaction data

[0680] Output: User's emotional state rating

[0681] The server adapts the system's response based on the user's emotional state: if negative emotions are detected, the system automatically takes countermeasures.

[0682] Specific action: If the emotional state is evaluated as "stressed," the system will strengthen the user support function.

[0683] Input: User's emotional state rating

[0684] Output: Result of countermeasure implementation

[0685] (Application example 2)

[0686] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0687] In recent years, fraudulent activities have become increasingly sophisticated, with an increase in fraudulent activities using email and other communication methods. Conventional methods are inadequate to deal with such fraudulent activities, resulting in a constant stream of user damage. Furthermore, in detecting and combating fraudulent activities, automated methods for early detection and responses that take into account the user's emotional state are required. The present invention aims to solve these problems and provide a system for efficiently detecting and responding to fraudulent communications.

[0688] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 2 is realized by the following means.

[0689] In this invention, the server includes means for filtering communications received by the communication device from outside, means for identifying potentially fraudulent communications and storing the communications in an analysis queue, means for analyzing the communications stored in the analysis queue using natural language processing technology to identify fraudulent communications, means for generating false information based on communications identified as fraudulent communications and inputting it to a fraudulent website, means incorporating an emotion engine that evaluates the emotional state of the user from input and adapts the system's response based on that evaluation, and means for receiving feedback from the user and retraining the generation AI model, thereby enabling early detection of fraudulent communications and effective countermeasures.

[0690] A "communications device" is an electronic device or system for receiving and processing electronic mail or other forms of communication.

[0691] "Filtering means" is a function that analyzes the content of received communications and determines and classifies their importance and risk based on specific conditions.

[0692] "Potentially fraudulent communications" are communications that are deemed to contain an intention to deceive users and steal their money or personal information.

[0693] An "analysis queue" is a temporary storage location or list of filtered communications for further detailed analysis.

[0694] "Natural language processing technology" is a technology for analyzing human language using machines, and specifically, it is a method for understanding sentences, analyzing their meaning, and classifying them.

[0695] The "means for identifying fraudulent communications" is a function that uses natural language processing technology to determine whether a received communication contains fraudulent intent.

[0696] "Fake information" refers to fictitious personal information or credit card information that is entered into a fraudulent website.

[0697] A "fraudulent website" is a fraudulent website that aims to fraudulently obtain money or personal information from users.

[0698] The "emotion engine" is a function that evaluates the user's emotional state based on their input and actions and adjusts the system's response.

[0699] A "generative AI model" is a predictive model that is automatically generated by AI and is retrained based on user feedback.

[0700] The present invention relates to a system for effectively detecting and combating fraudulent communications, which includes a communication device, a filtering means, an analytical queue, a fraudulent communications identification means using natural language processing techniques, a false information generation means, an emotion engine, and a retraining means using a generative AI model.

[0701] System Configuration

[0702] The system mainly consists of the following components:

[0703] 1. Communications equipment

[0704] Receives external communications and processes them on the system.

[0705] Specifically, electronic devices such as servers and smartphones are used to receive email and other communications.

[0706] 2. Filtering Methods

[0707] Scans header information and the body of communications to identify potentially fraudulent communications.

[0708] Filtering criteria include the sender address, email content, and whether or not the email contains links.

[0709] 3. Analysis Queue

[0710] Temporarily store filtered communications and prepare them for further analysis.

[0711] This storage location is often a portion of a server or a dedicated database.

[0712] 4. Methods for identifying fraudulent communications using natural language processing (NLP)

[0713] It uses NLP technology to analyze the content of communications and identify fraudulent activity.

[0714] For example, we use the Transformers library to determine the likelihood of fraud based on the overall context or specific keywords.

[0715] 5. Methods for generating false information

[0716] If the communication is identified as fraudulent, false personal information, credit card information, etc. is generated and entered into the fraudulent website.

[0717] The deceptive information is randomly generated to ensure that attackers only obtain meaningless data.

[0718] 6. Emotion Engine

[0719] It assesses the user's emotional state from their input and behavior and adapts the system's response accordingly.

[0720] For example, if the user is feeling stressed, the system will take measures such as displaying a supportive message.

[0721] 7. Retraining Methods (Generative AI Models)

[0722] Receive user feedback and retrain the generative AI model.

[0723] This will continually improve the system's ability to identify fraudulent communications.

[0724] Specific examples

[0725] As a concrete example of how this system can be used, consider the case where a user receives email using a smartphone. The system automatically filters the emails received by the user and stores potentially fraudulent emails in an analysis queue. Next, the emails stored in the analysis queue are analyzed in detail using natural language processing technology, and may be identified as fraudulent emails. At this time, false information is generated and entered into the fraudulent website specified in the fraudulent email. At the same time, feedback from the user is received, allowing the generative AI model to be retrained and the system's performance to improve.

[0726] Examples of specific prompts include the following:

[0727] "I've been receiving a lot of phishing emails lately, but since I started using this app, I've hardly fallen for them. I would like you to strengthen the email filtering function to further improve the accuracy of the system."

[0728] This system enables early detection of fraudulent communications and effective countermeasures, thereby increasing users' sense of security.

[0729] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0730] Step 1:

[0731] The server receives emails from the outside via communication devices. The received emails are first scanned on the server for header information and body content. The header information and body content of the email are passed to the server as input, and the risk of the email is determined based on this, after which filtering is performed. As an output, potentially fraudulent emails are identified and stored in an analysis queue.

[0732] Step 2:

[0733] The server queues identified potentially fraudulent emails for analysis. In this step, filtered emails are stored in a dedicated database or temporary storage area for further analysis. The input is the filtered emails, and the output is the emails stored in the analysis queue.

[0734] Step 3:

[0735] The device analyzes the emails stored in the analysis queue using natural language processing (NLP) technology. Here, the text data of the input email body is analyzed in detail using the Transformers library, etc. Keywords and phrases that determine fraudulence are detected, and emails identified as fraudulent are generated as output.

[0736] Step 4:

[0737] The server generates fake information based on emails identified as fraudulent and inputs that information into the fraudulent website. The input is the fraudulent email and the fake information template used to generate it, and the output is the fake information sent to the fraudulent website. Specifically, randomly generated fake personal information and credit card information is used. This fake information is sent from the server to the fraudulent website as an HTTP request.

[0738] Step 5:

[0739] The user monitors the system's operation and provides feedback. The user's feedback is analyzed by the emotion engine. The user provides a feedback statement as input, which is then analyzed by the emotion engine. The analysis results in an evaluation of the user's emotional state (e.g., satisfied, dissatisfied) and is output.

[0740] Step 6:

[0741] The server retrains the generative AI model based on user feedback. The input is the user feedback data and the analysis results of the emotion engine, and the output is updated parameters of the AI ​​model. By retraining the model, the accuracy of identifying fraudulent emails next time will improve.

[0742] This will enable early detection of fraudulent communications and effective countermeasures.

[0743] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0744] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0745] In the above embodiment, an example in which the specific processing is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the smart glasses 214.

[0746] [Third embodiment]

[0747] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[0748] 5, the data processing system 310 includes the data processing device 12 and a headset terminal 314. An example of the data processing device 12 is a server.

[0749] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0750] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[0751] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0752] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0753] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0754] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0755] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0756] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0757] In the headset type terminal 314, a reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0758] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the headset type terminal 314 will be referred to as the "terminal."

[0759] The present invention relates to a fraudulent email prevention system, and provides an efficient method for preventing fraudulent emails in particular. The system of the present invention consists of three main components: a communication device (server), an analysis terminal (terminal), and a user.

[0760] 1. Receiving and filtering emails

[0761] The server receives email from outside. The server connects to the mail server and receives emails sent to users. It then filters out potentially fraudulent emails based on the header information and body content of the received emails.

[0762] Examples:

[0763] Let's say you receive two emails, one from "example@trusted.com" and one from "unknown@example.com." If your server filters the email from "unknown@example.com" and determines it is likely to be fraudulent, it places the email in a queue for analysis.

[0764] 2. AI-based fraudulent email identification

[0765] Emails stored in the analysis queue are processed on the terminal. The terminal is equipped with an AI module that uses natural language processing technology to perform detailed analysis of the email body. If the email is identified as fraudulent, the results are fed back to the server.

[0766] Examples:

[0767] The device detects if the email body contains phrases asking you to "update your bank account information" or suspicious link URLs, and identifies it as a fraudulent email.

[0768] 3. Visiting phishing sites and sending false information

[0769] If the email is identified as fraudulent, the server prepares fake data such as an unused email address or phone number, accesses the phishing site URL listed in the fraudulent email, enters the fake information into a form, and submits it.

[0770] Examples:

[0771] The server uses the email address "fakeuser@example.com" to access the phishing site, then enters a false name, address, credit card information, etc., and submits the form. This operation allows the attacker to obtain only false information, reducing the effectiveness of the fraud.

[0772] 4. Feedback and Retraining

[0773] Users monitor the system's operation, check the AI's verdicts, and if they're incorrect, provide feedback to retrain the model, improving the system's accuracy and its ability to detect future fraudulent emails.

[0774] Examples:

[0775] The user accesses the system's management console and checks the details of the information sent to the phishing site. If there is a false positive, that information is fed back to the AI ​​model. This information is used to retrain the AI ​​and improve its accuracy the next time.

[0776] conclusion

[0777] The system of the present invention can intentionally fall for fraudulent emails, providing false information to attackers and reducing the success rate of fraudulent activities. Furthermore, the AI ​​model is retrained based on user feedback, allowing the system's accuracy to be continuously improved. This configuration makes it possible to effectively deter fraudulent activities.

[0778] The processing flow will be explained below.

[0779] Step 1:

[0780] The server receives email from the outside. It connects to the mail server and receives emails sent to users.

[0781] Step 2:

[0782] The server filters the header information and body content of emails received based on specific criteria, such as the sender's domain, keywords in the subject line, and specific phrases in the body of the email.

[0783] Step 3:

[0784] The server identifies potentially fraudulent emails and places them in a queue for analysis. For example, if an email from "unknown@example.com" is determined to be highly likely to be fraudulent, it will be moved to the analysis queue.

[0785] Step 4:

[0786] The device retrieves the emails stored in the analysis queue.

[0787] Step 5:

[0788] The device's AI module analyzes the email using natural language processing technology, extracting features from the email body such as phishing links, phrases indicating urgency, and requests for personal information.

[0789] Step 6:

[0790] The device will score whether the email is fraudulent or not based on the extracted features. If the score exceeds a certain level, it will be determined to be fraudulent.

[0791] Step 7:

[0792] The device determines whether the email is fraudulent and sends the results back to the server.

[0793] Step 8:

[0794] The server prepares fake information such as unused email addresses and phone numbers based on emails that are determined to be fraudulent.

[0795] Step 9:

[0796] The server accesses the phishing site URL included in the fraudulent email.

[0797] Step 10:

[0798] The server analyzes the phishing site's form and fills in the fields with prepared fake information, such as a fake name, address, and credit card information.

[0799] Step 11:

[0800] The server submits the form on the phishing site, sending false information to the attacker, which prevents the attacker from obtaining the correct information, reducing the success rate of the fraud.

[0801] Step 12:

[0802] Users monitor the system's operations and judgment results. Users access the system's management console to check details.

[0803] Step 13:

[0804] If a user makes a false positive, they can provide that information back to the system, which will then use it to retrain the AI ​​model.

[0805] Step 14:

[0806] The device's AI module retrains based on feedback provided by the user, improving the accuracy of the model.

[0807] Through this series of processing steps, the system of the present invention effectively identifies fraudulent emails and neutralizes the fraudulent activity, and the accuracy and efficiency of the system improves through continuous learning based on user feedback.

[0808] Example 1

[0809] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0810] Fraudulent emails are increasing year by year, and the methods are becoming more sophisticated. Conventional filtering systems are incomplete in identifying fraudulent emails, increasing the risk of users falling prey to fraudulent schemes. Furthermore, effective countermeasures against attackers are lacking after identifying fraudulent emails. Furthermore, continuous re-learning is necessary to improve the accuracy of the system, and a method for efficiently incorporating user feedback is needed.

[0811] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0812] In this invention, the server includes means for filtering emails received by the communication device from outside, means for identifying potentially fraudulent emails and storing the emails in an analysis queue, means for analyzing the emails stored in the analysis queue using natural language processing technology to identify fraudulent emails, means for generating unused identification information based on emails identified as fraudulent emails and inputting it into a fraudulent website, means for receiving feedback from users and retraining the AI ​​model, means for automating access to the fraudulent website, and means for feeding back the analyzed information to the server. This enables early identification of fraudulent emails and effective countermeasures against attackers, and allows the accuracy of the system to be continuously improved.

[0813] "Communication equipment" refers to hardware or software that receives email from outside and provides that information to an internal system.

[0814] "Filtering" refers to the process of scanning incoming emails based on specific criteria to screen out potentially fraudulent emails.

[0815] An "analysis queue" is a queue where emails that have been filtered as potentially fraudulent are temporarily stored for further analysis at a later date.

[0816] "Natural language processing technology" refers to technology that uses computers to analyze and understand human language.

[0817] "Fraudulent email" refers to emails that are intended to deceive users and illegally obtain personal or financial information.

[0818] "Fake information" refers to false information provided to fraudulent sites that imitates real user information.

[0819] "Fraudulent Site" refers to a website designed for the purpose of committing fraud.

[0820] "Feedback" refers to the process of providing users with opinions and corrections regarding the system's judgment results, which are used to help the AI ​​model learn.

[0821] "Relearning" refers to the process by which an AI model improves its performance by retraining it based on new data and feedback.

[0822] "Automation" refers to the process where a system performs a series of operations independently without human intervention.

[0823] "Identification information" refers to information that uniquely identifies a specific individual or device.

[0824] The present invention relates to a fraudulent email prevention system, and provides an efficient method for preventing fraudulent emails in particular. The system of the present invention consists of three main components: a communication device (server), an analysis terminal (terminal), and a user.

[0825] First, the server receives email from an external mail server. The server retrieves new email using the IMAP or POP3 protocol and filters the received email. The filtering is done using the Python email package or other analysis tools. For example, the server periodically checks incoming email from "mail.example.com" and analyzes header information such as the sender address and subject line, as well as the body of the email.

[0826] The server then compares the email with blacklists and rule-based filtering systems and places potentially fraudulent emails in a queue for analysis. For example, if the sender address is "unknown@example.com," the email is added to the analysis queue as a fraudulent email.

[0827] Emails stored in the analysis queue are processed on the terminal. AI frameworks such as TensorFlow and PyTorch are installed on the terminal, and these are used to perform detailed analysis of the email body using natural language processing (NLP). For example, if the terminal detects a phrase in the email body that suggests fraud, such as "Please update your bank account information," it will identify the email as fraudulent and feed the result back to the server.

[0828] If the email is identified as fraudulent, the server generates fake information such as an unused email address and phone number using the Faker library. For example, it generates a random email address such as "fakeuser@example.com" and fake names, addresses, and credit card information.

[0829] The server then uses a browser automation tool such as Selenium to access the phishing site URL listed in the fraudulent email, enter the generated fake information into a form, and submit it. This reduces the effectiveness of the fraudulent activity because the attacker can only obtain false information. For example, the server accesses "http: / / phishingsite.com," enters fake names and credit card information, and submits it.

[0830] Users access the system's management console to monitor the AI's judgment of fraudulent emails. If the judgment is incorrect, the user can provide feedback to retrain the model. For example, if a user checks the details of the information sent to a phishing site and finds an incorrect judgment, they can feed that information back into the AI ​​model and use it for retraining.

[0831] This enables early identification of fraudulent emails and effective countermeasures against attackers, allowing the accuracy of the system to be continuously improved.

[0832] Prompt Sentence Examples

[0833] text

[0834] Please generate a program that analyzes emails received by the system and determines whether they are fraudulent. Furthermore, if an email is identified as fraudulent, please add a process to access a phishing site using false information and send false information on the front end. Also, please include a procedure to retrain the AI ​​model based on user feedback.

[0835] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0836] Step 1:

[0837] The server receives email from an external mail server. The server retrieves new mail using the IMAP or POP3 protocol.

[0838] Enter your mail server connection information (e.g., mail.example.com)

[0839] Output: Received email data

[0840] What it does: The server periodically connects to the mail server and checks for new email using the IMAP protocol. If there is new email, it downloads it and stores it locally.

[0841] Step 2:

[0842] The server analyzes the header information and body content of the email received using the Python email package.

[0843] Input: Received email data

[0844] Output: Email header information and body content

[0845] Specific operation: The server parses the email data and extracts the sender address, subject, and email body. For example, it extracts the sender address "unknown@example.com" and the subject "Important: Update your account information."

[0846] Step 3:

[0847] The server uses a filtering system to identify potentially fraudulent emails and place them in a queue for analysis.

[0848] Input: Email header information and body content

[0849] Output: List of potentially fraudulent emails

[0850] What happens: The server uses filtering rules to identify potentially fraudulent emails by comparing them with blacklists. If there is a high probability of fraud, the email is queued for analysis. For example, if the sender address is on a blacklist, the email is added to the analysis queue.

[0851] Step 4:

[0852] The terminal retrieves emails stored in the analysis queue and performs detailed analysis using a natural language processing (NLP) module.

[0853] Input: Potentially fraudulent email data

[0854] Output: Fraudulent email identification results

[0855] How it works: The device retrieves an email from the analysis queue and passes the email body to the NLP module. The NLP module analyzes the email body for phrases that suggest fraud, detecting phrases such as "update your bank account information." If the email is identified as fraudulent, the result is fed back to the server.

[0856] Step 5:

[0857] The server generates an unused identity, for example using the Faker library.

[0858] Input: Fraudulent email identification results

[0859] Output: Fake information (e.g. random email address, name, address, credit card information)

[0860] What it does: The server uses the Faker library to generate random email addresses, such as "fakeuser@example.com", and create fake names, addresses, and credit card information.

[0861] Step 6:

[0862] The server accesses the phishing site, enters the generated fake information, and submits it. This is done using a browser automation tool such as Selenium.

[0863] Input: Fake information and the URL of the phishing site included in the fraudulent email

[0864] Output: Status of completion of sending fake information to phishing site

[0865] What happens: The server uses Selenium to launch a browser, access the URL in the fraudulent email, enter the generated fake information into the form on the phishing site, and click the submit button to send the false information to the attacker.

[0866] Step 7:

[0867] Users access the system's management console and monitor the AI's results in identifying fraudulent emails.

[0868] Input: System result

[0869] Output: Feedback on the judgment result

[0870] What happens: A user logs in to the admin console and checks the list of emails that have been identified as fraudulent. The system checks whether the emails in question have been correctly identified and provides information about any false positives.

[0871] Step 8:

[0872] The server receives feedback from users and retrains the AI ​​model using TensorFlow's retraining function.

[0873] Input: User feedback

[0874] Output: Retrained AI model

[0875] What it does: The server creates a new dataset and retrains the AI ​​model using TensorFlow's retraining function. The retrained AI model is then applied to the system to improve the accuracy of the next judgment.

[0876] This enables early identification of fraudulent emails and effective countermeasures against attackers, allowing the accuracy of the system to be continuously improved.

[0877] (Application example 1)

[0878] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0879] In today's communications environment, fraudulent emails and phishing attacks are on the rise, putting users' personal information and assets at risk. Conventional email filtering systems have limited accuracy in detecting fraudulent emails and often require manual management by users. Furthermore, they lack the means to not only identify fraudulent emails but also deceive attackers. In addition, there is a lack of systems with re-learning capabilities that effectively utilize user feedback. To address these issues, a more advanced and efficient fraudulent email prevention system is needed.

[0880] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0881] In this invention, the server includes: means for filtering emails received by the communication device from outside; means for identifying potentially fraudulent emails and storing the emails in an analysis queue; means for analyzing the emails stored in the analysis queue using natural language processing technology to identify fraudulent emails; means for generating false information based on emails identified as fraudulent emails and inputting the false information into a fraudulent website; means for receiving feedback from users and retraining the AI ​​model; means for monitoring emails in real time on a smart device and automatically identifying and processing fraudulent emails; and means for determining whether an email is fraudulent using prompt sentences generated by the AI ​​model. This enables advanced identification of fraudulent emails and immediate response, as well as continuous improvement of the system's accuracy using user feedback.

[0882] A "communications device" is a device for sending and receiving data, including e-mail.

[0883] "Filtering" is the process of examining emails received from outside and selecting those that meet certain conditions.

[0884] An "analysis queue" is a collection of emails that have been filtered and are temporarily stored for further analysis and inspection.

[0885] "Natural language processing technology" is a technology that allows computers to understand human language, and is used when analyzing the content of email text.

[0886] "Fraudulent email" refers to email created and sent with the intent to deceive the recipient and illegally obtain personal information or money.

[0887] "Fake information" is false data prepared to deceive attackers and is information entered into fraudulent websites.

[0888] "Feedback" refers to evaluations and opinions provided by users regarding the system's operational results and judgments.

[0889] "Retraining" is the process of updating and improving an existing AI model based on user feedback.

[0890] A "smart device" is a portable electronic device that can connect to the Internet, such as a smartphone or tablet.

[0891] A "prompt sentence" is an input sentence used in natural language analysis by an AI model.

[0892] The system for implementing this invention mainly consists of three main components: a communication device (server), an analysis terminal (terminal), and a user. This system uses smart devices to monitor emails in real time and automatically detects, identifies, and removes fraudulent emails. The specific operation of each component is shown below.

[0893] First, the server filters emails received from outside and identifies potentially fraudulent emails. Identified emails are stored in an analysis queue and passed on to subsequent processing steps. Next, emails stored in the analysis queue are processed on the device and analyzed in detail using natural language processing technology installed on the device. The natural language processing technology used here utilizes OpenAI's API.

[0894] If a fraudulent email is identified, the server generates fake information and uses it to fill in and submit forms on the fraudulent website. This fake information includes unused email addresses, false names, addresses, and credit card information. This reduces the effectiveness of fraudulent activities by limiting the attacker to false information.

[0895] Furthermore, users can monitor the system's operation and check the AI's judgments. By receiving user feedback and retraining the AI ​​model on the device, the system's accuracy is continuously improved.

[0896] The specific hardware used is a smartphone or tablet, and the software uses Python, the IMAP library (imaplib), the SMTP library (smtplib), and the OpenAI API. The combination of these elements creates an efficient and effective fraud email prevention system.

[0897] For example, if an email is received from the address "unknown@example.com" asking the user to "update their bank account information," the system will identify the email as fraudulent. The user will then click on the phishing link provided and enter false information. Examples of prompts used in this process include:

[0898] Prompt statement:

[0899] "Please check if this email is fraudulent: This email is asking you to update your bank account information. Click the link below to complete the process: http: / / phishing-link.example.com"

[0900] In this way, the system can detect fraudulent emails in real time and keep users safe by deceiving attackers.

[0901] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0902] Step 1:

[0903] The server receives emails from the outside world. As input, it has unread emails stored in the inbox. The server connects to the mail server using the IMAP protocol and pulls the emails from the inbox. The output of this step is all the retrieved email data.

[0904] Step 2:

[0905] The server filters incoming emails. The input is the email data obtained in step 1. It analyzes the header information and body of the incoming emails to identify emails that match certain criteria (e.g., unknown senders, suspicious content). In this step, it stores emails that are likely to be fraudulent in an analysis queue. The output is the emails stored in the analysis queue.

[0906] Step 3:

[0907] The device receives emails stored in the analysis queue and analyzes them using natural language processing technology. The input is the email data in the analysis queue. The device uses the OpenAI API to analyze the email body and identify whether it is a fraudulent email. During this process, it sends a prompt to the generative AI model. For example, "Please diagnose whether this email is a fraudulent email: [email content]." The output is the determination result of whether the email is a fraudulent email.

[0908] Step 4:

[0909] The server generates fake information based on emails identified as fraudulent. The inputs are the results of the judgment in step 3 and the contents of the fraudulent email. The server prepares unused email addresses, false names, addresses, credit card information, etc., and enters them into a form on the fraudulent website and submits it. The output of this step is the fake information sent to the fraudulent website.

[0910] Step 5:

[0911] The user monitors the system's operation and checks the AI's judgment results. The inputs include the system's judgment results and records of false information transmissions. The user accesses this information through a browser or a dedicated application. The output is user feedback, which is used to retrain the AI ​​model.

[0912] Step 6:

[0913] The device receives feedback from the user and retrains the AI ​​model. The input is the feedback data provided by the user. The device sends this feedback data to the OpenAI API and retrains the AI ​​model. This improves the accuracy of fraudulent email detection from the next time onwards. The output of this step is an updated AI model.

[0914] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[0915] This invention relates to a fraudulent email prevention system, and provides an efficient method for preventing fraudulent emails in particular. The system of this invention consists of four main components: a communication device (server), an analysis terminal (terminal), a user, and an emotion engine.

[0916] 1. Receiving and filtering emails

[0917] The server receives email from outside. The server connects to the mail server and receives emails sent to users. It then filters out potentially fraudulent emails based on the header information and body content of the received emails.

[0918] Examples:

[0919] Let's say you receive two emails, one from "example@trusted.com" and one from "unknown@example.com." If your server filters the email from "unknown@example.com" and determines it is likely to be fraudulent, it places the email in a queue for analysis.

[0920] 2. AI-based fraudulent email identification

[0921] Emails stored in the analysis queue are processed on the terminal. The terminal is equipped with an AI module that uses natural language processing technology to perform detailed analysis of the email body. If the email is identified as fraudulent, the results are fed back to the server.

[0922] Examples:

[0923] The device detects if the email body contains phrases asking you to "update your bank account information" or suspicious link URLs, and identifies it as a fraudulent email.

[0924] 3. Visiting phishing sites and sending false information

[0925] If the email is identified as fraudulent, the server prepares fake data such as an unused email address or phone number, accesses the phishing site URL listed in the fraudulent email, enters the fake information into a form, and submits it.

[0926] Examples:

[0927] The server uses the email address "fakeuser@example.com" to access the phishing site, then enters a false name, address, credit card information, etc., and submits the form. This operation allows the attacker to obtain only false information, reducing the effectiveness of the fraud.

[0928] 4. Feedback and Retraining

[0929] Users monitor the system's operation, check the AI's verdicts, and if they're incorrect, provide feedback to retrain the model, improving the system's accuracy and its ability to detect future fraudulent emails.

[0930] Examples:

[0931] The user accesses the system's management console and checks the details of the information sent to the phishing site. If there is a false positive, that information is fed back to the AI ​​model. This information is used to retrain the AI ​​and improve its accuracy the next time.

[0932] 5. Incorporating an Emotional Engine

[0933] The system of the present invention incorporates an emotion engine for recognizing the user's emotions, assessing the user's emotional state from their inputs and actions, and adapting the system's response.

[0934] Examples:

[0935] When a user provides feedback, the emotion engine analyzes the user's emotional state (e.g., stress, satisfaction). For example, if the user is dissatisfied, the system immediately takes measures to improve the problem. The user's emotion data is also used to retrain the AI ​​model, improving the analysis accuracy by taking emotion data into account.

[0936] conclusion

[0937] The system of the present invention can intentionally fall for fraudulent emails, providing false information to attackers and reducing the success rate of fraudulent activities. Furthermore, by incorporating an emotion engine, it is possible to recognize the user's emotional state and adapt the system's response. Continuous learning through user feedback improves the system's accuracy and efficiency. This configuration makes it possible to effectively deter fraudulent activities.

[0938] The processing flow will be explained below.

[0939] Step 1:

[0940] The server receives email from the outside. The server connects to the mail server and receives emails sent to users.

[0941] Step 2:

[0942] The server filters the header information and body content of received emails based on specific criteria, such as the sender's domain, keywords in the subject line, and specific phrases in the body of the email.

[0943] Step 3:

[0944] The server identifies potentially fraudulent emails and places them in a queue for analysis. For example, if an email from "unknown@example.com" is determined to be likely fraudulent, it will be moved to the analysis queue.

[0945] Step 4:

[0946] The terminal retrieves the emails stored in the analysis queue. The terminal checks the analysis queue at regular intervals and retrieves newly stored emails.

[0947] Step 5:

[0948] The device's AI module analyzes the email using natural language processing technology, extracting features from the email body such as phishing links, phrases indicating urgency, and requests for personal information.

[0949] Step 6:

[0950] The device will score whether the email is fraudulent or not based on the extracted features. If the score exceeds a certain level, it will be determined to be fraudulent.

[0951] Step 7:

[0952] The device determines whether the email is fraudulent and sends the results back to the server.

[0953] Step 8:

[0954] The server prepares fake information such as unused email addresses and phone numbers based on emails that are determined to be fraudulent.

[0955] Step 9:

[0956] The server accesses the phishing site URL included in the fraudulent email.

[0957] Step 10:

[0958] The server analyzes the phishing site's form and fills in the fields with prepared fake information, such as a fake name, address, and credit card information.

[0959] Step 11:

[0960] The server submits the form on the phishing site, sending false information to the attacker, which prevents the attacker from obtaining the correct information, reducing the success rate of the fraud.

[0961] Step 12:

[0962] Users monitor the system's operations and judgment results. Users access the system's management console to check details.

[0963] Step 13:

[0964] If a user makes a false positive, they can provide that information back to the system, which will then use it to retrain the AI ​​model.

[0965] Step 14:

[0966] The device's AI module retrains based on feedback provided by the user, improving the accuracy of the model.

[0967] Step 15:

[0968] To recognize emotions from user input and behavior, the device uses an emotion engine that analyzes the content, speed, and behavioral patterns of the user's input.

[0969] Step 16:

[0970] The device's emotion engine classifies the user's emotional state into multiple categories (e.g., joy, anger, sadness, happiness).

[0971] Step 17:

[0972] The device's emotion engine adapts how and when feedback is provided based on the user's emotional state, for example, providing feedback in a simpler way if the user is feeling stressed.

[0973] Step 18:

[0974] The device's emotion engine also uses the user's emotion data to retrain the AI ​​model, improving the accuracy of future analysis.

[0975] Through this series of processing steps, the system of the present invention effectively identifies fraudulent emails and neutralizes the fraudulent activities. Also, by taking into account the user's emotions, a more intuitive and adaptive feedback process is realized, improving the accuracy and efficiency of the system.

[0976] Example 2

[0977] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0978] In modern society, fraudulent emails are becoming more prevalent, causing many people to suffer financial losses and the leakage of personal information. Conventional methods have limited detection accuracy and countermeasures against fraudulent emails, making it difficult to effectively prevent them. Furthermore, systems often respond in a fixed manner without taking the user's emotional state into account, resulting in a poor user experience. Given these circumstances, there is a need for a system that can accurately detect fraudulent emails and respond to the user's emotional state.

[0979] The identification process by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means. In this invention, the server includes means for filtering electronic information received from an external device by a communication device, means for identifying potentially fraudulent electronic information and storing the electronic information in an analysis queue, means for analyzing the electronic information stored in the analysis queue using natural language processing technology and identifying fraudulent information, means for generating false information based on the electronic information identified as fraudulent information and inputting it to a fraudulent website, means for receiving feedback from a user and retraining the generation AI model, and means for evaluating the user's emotional state using an emotion engine and adapting the system's response. This enables highly accurate detection of fraudulent emails, improves the user experience, and enables effective and flexible deterrence of fraudulent activities.

[0980] "Communications equipment" refers to any device that receives electronic information from the outside and processes the data internally.

[0981] "Electronic Information" refers to data transmitted in electronic form, such as by email.

[0982] "Filtering" refers to the process of sorting received electronic information based on specific criteria to remove inappropriate data.

[0983] "Analysis queue" refers to a data structure for temporarily storing electronic information that requires analysis.

[0984] "Natural language processing technology" refers to a method by which computers understand and analyze human language.

[0985] "Fraudulent Information" means electronic information created with the intent to commit fraud.

[0986] "False information" refers to false data intentionally generated to prevent fraud.

[0987] A "phishing site" is a website designed to defraud users of their personal information.

[0988] "Feedback" refers to the evaluations and opinions provided by users regarding the system's judgment results.

[0989] A "generative AI model" refers to an artificial intelligence algorithm that learns patterns from large amounts of data and is trained to perform specific tasks.

[0990] "Emotion engine" refers to the algorithms and software used to assess a user's emotional state and adapt the system's response.

[0991] "Header information" refers to metadata such as the sender, recipient, date and time included at the beginning of electronic information.

[0992] "Scoring" refers to the process of numerically assessing the importance and risk of electronic information based on specific criteria.

[0993] The present invention is a fraudulent email prevention system that consists of four main components: a communication device, an analysis terminal, a user, and an emotion engine. A specific embodiment of this system will be described in detail below.

[0994] Receiving and filtering emails

[0995] The server connects to the mail server using IMAP or POP3 protocols to receive emails sent to users. The received emails are analyzed for header information and body content, and then filtered based on specific spam filter rules and blacklists. For example, emails from "unknown@example.com" are filtered and stored in a queue for analysis.

[0996] AI-based fraudulent email identification

[0997] The terminal takes emails stored in the analysis queue and analyzes them using natural language processing techniques. This analysis uses Python natural language processing libraries (e.g., NLTK and SpaCy). Specifically, the email body is tokenized and keywords and phrases characteristic of fraud are extracted. A machine learning model (e.g., a model using Scikit-learn or TensorFlow) is then applied to determine whether the email is fraudulent. For example, the terminal may detect phrases such as "update your bank account information" or suspicious links and identify the email as fraudulent.

[0998] Visiting phishing sites and sending false information

[0999] If the email is identified as fraudulent, the server generates fake information. Specifically, it prepares an unused email address and randomly generated personal information (such as name, address, phone number, and credit card information). It then sends an HTTP request to access the phishing site URL listed in the fraudulent email, enters the fake information into the form, and submits it. For example, the server accesses the phishing site using the email address "fakeuser@example.com" and submits the fake information.

[1000] Feedback and Retraining

[1001] Users access the system administration console to check the AI's judgment results and information sent to phishing sites. If an incorrect judgment is made, the user provides feedback. For example, they can input information such as "this email is legitimate" into the system. The feedback information is used to retrain the AI ​​model, and the accuracy of the system is improved by retraining the generative AI model (for example, a model implemented in TensorFlow or PyTorch).

[1002] Incorporating an emotion engine

[1003] The system incorporates an emotion engine to evaluate the user's emotional state. The emotion engine collects emotion data through the user's feedback process and UX interactions, and uses an emotion analysis model (e.g., Sentiment Analysis API or a custom emotion analysis model) to evaluate the user's emotional state (e.g., stress, satisfaction). If the user is dissatisfied, the system automatically takes appropriate measures. The emotion data is also incorporated into the AI ​​model's retraining process, further improving the accuracy of the analysis.

[1004] Example prompt: If two emails are received, one from "example@trusted.com" and one from "unknown@example.com", and the email from "unknown@example.com" is filtered and identified as a fraudulent email, place it in the analysis queue.

[1005] According to this embodiment, the accuracy of detecting fraudulent emails is improved, and the user experience is also improved at the same time. A system for maximizing the deterrent effect of fraudulent acts is provided.

[1006] The flow of the identification process in the second embodiment will be described with reference to FIG.

[1007] Step 1: Receiving email and initial filtering

[1008] The server connects to an external mail server using the IMAP or POP3 protocol to receive new, unread emails, which are then temporarily stored before being analyzed.

[1009] Input: Unread emails received from external mail servers

[1010] Output: Archived unread emails

[1011] The server scans the header information (sender, subject, date and time of receipt, etc.) and part of the body of the email received, and filters out suspicious emails based on spam filtering rules and blacklists.

[1012] What happens: The server filters email from "unknown@example.com" to identify potentially fraudulent emails.

[1013] Input: Archived unread emails

[1014] Output: Filtered emails

[1015] Step 2: Queueing the analysis

[1016] The server stores filtered suspicious emails in an analysis queue, which serves as a temporary repository for subsequent detailed analysis.

[1017] Input: filtered email

[1018] Output: Emails queued for analysis

[1019] Step 3: Identifying fraudulent emails with AI

[1020] The device retrieves emails from the analysis queue, tokenizes and analyzes the email body using natural language processing techniques (e.g., NLTK or SpaCy), extracts keywords and phrases characteristic of fraud, and applies machine learning models (e.g., Scikit-learn or TensorFlow) to determine whether the email is fraudulent.

[1021] What it does: The device will detect phrases like "update your bank account information" and suspicious links and identify the email as fraudulent.

[1022] Input: Emails stored in the analysis queue

[1023] Output: Fraudulent email detection result

[1024] Step 4: Generate and send fake information

[1025] If the email is identified as fraudulent, the server generates an unused email address and randomly generated personal information (such as name, address, phone number, credit card information, etc.).

[1026] Input: Fraudulent email detection result

[1027] Output: Fake information

[1028] The server sends an HTTP request to access the phishing site URL listed in the fraudulent email, enters false information into the form, and submits it.

[1029] Specific actions: Access a phishing site using the email address "fakeuser@example.com" and send fake information.

[1030] Input: Fake information

[1031] Output: Result of sending to phishing site

[1032] Step 5: Feedback and Retraining

[1033] The user accesses the system management console to check the AI's judgment results and information sent to phishing sites. If there are any incorrect judgments, the user provides feedback. This feedback information is used to retrain the AI ​​model.

[1034] Specific action: The user enters information into the system, such as "this email is legitimate."

[1035] Input: AI judgment results, user evaluation

[1036] Output: AI model reflecting the correction results

[1037] Step 6: Incorporating the Emotion Engine

[1038] The server collects emotional data through the user's feedback process and UX interactions, and evaluates the user's emotional state using a sentiment analysis model (e.g., Sentiment Analysis API or a self-made sentiment analysis model).

[1039] Input: User feedback, interaction data

[1040] Output: User's emotional state rating

[1041] The server adapts the system's response based on the user's emotional state: if negative emotions are detected, the system automatically takes countermeasures.

[1042] Specific action: If the emotional state is evaluated as "stressed," the system will strengthen the user support function.

[1043] Input: User's emotional state rating

[1044] Output: Result of countermeasure implementation

[1045] (Application example 2)

[1046] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1047] In recent years, fraudulent activities have become increasingly sophisticated, with an increase in fraudulent activities using email and other communication methods. Conventional methods are inadequate to deal with such fraudulent activities, resulting in a constant stream of user damage. Furthermore, in detecting and combating fraudulent activities, automated methods for early detection and responses that take into account the user's emotional state are required. The present invention aims to solve these problems and provide a system for efficiently detecting and responding to fraudulent communications.

[1048] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 2 is realized by the following means.

[1049] In this invention, the server includes means for filtering communications received by the communication device from outside, means for identifying potentially fraudulent communications and storing the communications in an analysis queue, means for analyzing the communications stored in the analysis queue using natural language processing technology to identify fraudulent communications, means for generating false information based on communications identified as fraudulent communications and inputting it to a fraudulent website, means incorporating an emotion engine that evaluates the emotional state of the user from input and adapts the system's response based on that evaluation, and means for receiving feedback from the user and retraining the generation AI model, thereby enabling early detection of fraudulent communications and effective countermeasures.

[1050] A "communications device" is an electronic device or system for receiving and processing electronic mail or other forms of communication.

[1051] "Filtering means" is a function that analyzes the content of received communications and determines and classifies their importance and risk based on specific conditions.

[1052] "Potentially fraudulent communications" are communications that are deemed to contain an intention to deceive users and steal their money or personal information.

[1053] An "analysis queue" is a temporary storage location or list of filtered communications for further detailed analysis.

[1054] "Natural language processing technology" is a technology for analyzing human language using machines, and specifically, it is a method for understanding sentences, analyzing their meaning, and classifying them.

[1055] The "means for identifying fraudulent communications" is a function that uses natural language processing technology to determine whether a received communication contains fraudulent intent.

[1056] "Fake information" refers to fictitious personal information or credit card information that is entered into a fraudulent website.

[1057] A "fraudulent website" is a fraudulent website that aims to fraudulently obtain money or personal information from users.

[1058] The "emotion engine" is a function that evaluates the user's emotional state based on their input and actions and adjusts the system's response.

[1059] A "generative AI model" is a predictive model that is automatically generated by AI and is retrained based on user feedback.

[1060] The present invention relates to a system for effectively detecting and combating fraudulent communications, which includes a communication device, a filtering means, an analytical queue, a fraudulent communications identification means using natural language processing techniques, a false information generation means, an emotion engine, and a retraining means using a generative AI model.

[1061] System Configuration

[1062] The system mainly consists of the following components:

[1063] 1. Communications equipment

[1064] Receives external communications and processes them on the system.

[1065] Specifically, electronic devices such as servers and smartphones are used to receive email and other communications.

[1066] 2. Filtering Methods

[1067] Scans header information and the body of communications to identify potentially fraudulent communications.

[1068] Filtering criteria include the sender address, email content, and whether or not the email contains links.

[1069] 3. Analysis Queue

[1070] Temporarily store filtered communications and prepare them for further analysis.

[1071] This storage location is often a portion of a server or a dedicated database.

[1072] 4. Methods for identifying fraudulent communications using natural language processing (NLP)

[1073] It uses NLP technology to analyze the content of communications and identify fraudulent activity.

[1074] For example, we use the Transformers library to determine the likelihood of fraud based on the overall context or specific keywords.

[1075] 5. Methods for generating false information

[1076] If the communication is identified as fraudulent, false personal information, credit card information, etc. is generated and entered into the fraudulent website.

[1077] The deceptive information is randomly generated to ensure that attackers only obtain meaningless data.

[1078] 6. Emotion Engine

[1079] It assesses the user's emotional state from their input and behavior and adapts the system's response accordingly.

[1080] For example, if the user is feeling stressed, the system will take measures such as displaying a supportive message.

[1081] 7. Retraining Methods (Generative AI Models)

[1082] Receive user feedback and retrain the generative AI model.

[1083] This will continually improve the system's ability to identify fraudulent communications.

[1084] Specific examples

[1085] As a concrete example of how this system can be used, consider the case where a user receives email using a smartphone. The system automatically filters the emails received by the user and stores potentially fraudulent emails in an analysis queue. Next, the emails stored in the analysis queue are analyzed in detail using natural language processing technology, and may be identified as fraudulent emails. At this time, false information is generated and entered into the fraudulent website specified in the fraudulent email. At the same time, feedback from the user is received, allowing the generative AI model to be retrained and the system's performance to improve.

[1086] Examples of specific prompts include the following:

[1087] "I've been receiving a lot of phishing emails lately, but since I started using this app, I've hardly fallen for them. I would like you to strengthen the email filtering function to further improve the accuracy of the system."

[1088] This system enables early detection of fraudulent communications and effective countermeasures, thereby increasing users' sense of security.

[1089] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[1090] Step 1:

[1091] The server receives emails from the outside via communication devices. The received emails are first scanned on the server for header information and body content. The header information and body content of the email are passed to the server as input, and the risk of the email is determined based on this, after which filtering is performed. As an output, potentially fraudulent emails are identified and stored in an analysis queue.

[1092] Step 2:

[1093] The server queues identified potentially fraudulent emails for analysis. In this step, filtered emails are stored in a dedicated database or temporary storage area for further analysis. The input is the filtered emails, and the output is the emails stored in the analysis queue.

[1094] Step 3:

[1095] The device analyzes the emails stored in the analysis queue using natural language processing (NLP) technology. Here, the text data of the input email body is analyzed in detail using the Transformers library, etc. Keywords and phrases that determine fraudulence are detected, and emails identified as fraudulent are generated as output.

[1096] Step 4:

[1097] The server generates fake information based on emails identified as fraudulent and inputs that information into the fraudulent website. The input is the fraudulent email and the fake information template used to generate it, and the output is the fake information sent to the fraudulent website. Specifically, randomly generated fake personal information and credit card information is used. This fake information is sent from the server to the fraudulent website as an HTTP request.

[1098] Step 5:

[1099] The user monitors the system's operation and provides feedback. The user's feedback is analyzed by the emotion engine. The user provides a feedback statement as input, which is then analyzed by the emotion engine. The analysis results in an evaluation of the user's emotional state (e.g., satisfied, dissatisfied) and is output.

[1100] Step 6:

[1101] The server retrains the generative AI model based on user feedback. The input is the user feedback data and the analysis results of the emotion engine, and the output is updated parameters of the AI ​​model. By retraining the model, the accuracy of identifying fraudulent emails next time will improve.

[1102] This will enable early detection of fraudulent communications and effective countermeasures.

[1103] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[1104] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1105] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the headset type terminal 314.

[1106] [Fourth embodiment]

[1107] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[1108] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[1109] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[1110] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[1111] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[1112] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[1113] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[1114] The control object 443 includes a display device, LEDs in the eyes, and motors for driving the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[1115] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[1116] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[1117] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[1118] In the robot 414, the processor 46 performs the reception output process. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[1119] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1120] The present invention relates to a fraudulent email prevention system, and provides an efficient method for preventing fraudulent emails in particular. The system of the present invention consists of three main components: a communication device (server), an analysis terminal (terminal), and a user.

[1121] 1. Receiving and filtering emails

[1122] The server receives email from outside. The server connects to the mail server and receives emails sent to users. It then filters out potentially fraudulent emails based on the header information and body content of the received emails.

[1123] Examples:

[1124] Let's say you receive two emails, one from "example@trusted.com" and one from "unknown@example.com." If your server filters the email from "unknown@example.com" and determines it is likely to be fraudulent, it places the email in a queue for analysis.

[1125] 2. AI-based fraudulent email identification

[1126] Emails stored in the analysis queue are processed on the terminal. The terminal is equipped with an AI module that uses natural language processing technology to perform detailed analysis of the email body. If the email is identified as fraudulent, the results are fed back to the server.

[1127] Examples:

[1128] The device detects if the email body contains phrases asking you to "update your bank account information" or suspicious link URLs, and identifies it as a fraudulent email.

[1129] 3. Visiting phishing sites and sending false information

[1130] If the email is identified as fraudulent, the server prepares fake data such as an unused email address or phone number, accesses the phishing site URL listed in the fraudulent email, enters the fake information into a form, and submits it.

[1131] Examples:

[1132] The server uses the email address "fakeuser@example.com" to access the phishing site, then enters a false name, address, credit card information, etc., and submits the form. This operation allows the attacker to obtain only false information, reducing the effectiveness of the fraud.

[1133] 4. Feedback and Retraining

[1134] Users monitor the system's operation, check the AI's verdicts, and if they're incorrect, provide feedback to retrain the model, improving the system's accuracy and its ability to detect future fraudulent emails.

[1135] Examples:

[1136] The user accesses the system's management console and checks the details of the information sent to the phishing site. If there is a false positive, that information is fed back to the AI ​​model. This information is used to retrain the AI ​​and improve its accuracy the next time.

[1137] conclusion

[1138] The system of the present invention can intentionally fall for fraudulent emails, providing false information to attackers and reducing the success rate of fraudulent activities. Furthermore, the AI ​​model is retrained based on user feedback, allowing the system's accuracy to be continuously improved. This configuration makes it possible to effectively deter fraudulent activities.

[1139] The processing flow will be explained below.

[1140] Step 1:

[1141] The server receives email from the outside. It connects to the mail server and receives emails sent to users.

[1142] Step 2:

[1143] The server filters the header information and body content of emails received based on specific criteria, such as the sender's domain, keywords in the subject line, and specific phrases in the body of the email.

[1144] Step 3:

[1145] The server identifies potentially fraudulent emails and places them in a queue for analysis. For example, if an email from "unknown@example.com" is determined to be highly likely to be fraudulent, it will be moved to the analysis queue.

[1146] Step 4:

[1147] The device retrieves the emails stored in the analysis queue.

[1148] Step 5:

[1149] The device's AI module analyzes the email using natural language processing technology, extracting features from the email body such as phishing links, phrases indicating urgency, and requests for personal information.

[1150] Step 6:

[1151] The device will score whether the email is fraudulent or not based on the extracted features. If the score exceeds a certain level, it will be determined to be fraudulent.

[1152] Step 7:

[1153] The device determines whether the email is fraudulent and sends the results back to the server.

[1154] Step 8:

[1155] The server prepares fake information such as unused email addresses and phone numbers based on emails that are determined to be fraudulent.

[1156] Step 9:

[1157] The server accesses the phishing site URL included in the fraudulent email.

[1158] Step 10:

[1159] The server analyzes the phishing site's form and fills in the fields with prepared fake information, such as a fake name, address, and credit card information.

[1160] Step 11:

[1161] The server submits the form on the phishing site, sending false information to the attacker, which prevents the attacker from obtaining the correct information, reducing the success rate of the fraud.

[1162] Step 12:

[1163] Users monitor the system's operations and judgment results. Users access the system's management console to check details.

[1164] Step 13:

[1165] If a user makes a false positive, they can provide that information back to the system, which will then use it to retrain the AI ​​model.

[1166] Step 14:

[1167] The device's AI module retrains based on feedback provided by the user, improving the accuracy of the model.

[1168] Through this series of processing steps, the system of the present invention effectively identifies fraudulent emails and neutralizes the fraudulent activity, and the accuracy and efficiency of the system improves through continuous learning based on user feedback.

[1169] Example 1

[1170] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1171] Fraudulent emails are increasing year by year, and the methods are becoming more sophisticated. Conventional filtering systems are incomplete in identifying fraudulent emails, increasing the risk of users falling prey to fraudulent schemes. Furthermore, effective countermeasures against attackers are lacking after identifying fraudulent emails. Furthermore, continuous re-learning is necessary to improve the accuracy of the system, and a method for efficiently incorporating user feedback is needed.

[1172] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[1173] In this invention, the server includes means for filtering emails received by the communication device from outside, means for identifying potentially fraudulent emails and storing the emails in an analysis queue, means for analyzing the emails stored in the analysis queue using natural language processing technology to identify fraudulent emails, means for generating unused identification information based on emails identified as fraudulent emails and inputting it into a fraudulent website, means for receiving feedback from users and retraining the AI ​​model, means for automating access to the fraudulent website, and means for feeding back the analyzed information to the server. This enables early identification of fraudulent emails and effective countermeasures against attackers, and allows the accuracy of the system to be continuously improved.

[1174] "Communication equipment" refers to hardware or software that receives email from outside and provides that information to an internal system.

[1175] "Filtering" refers to the process of scanning incoming emails based on specific criteria to screen out potentially fraudulent emails.

[1176] An "analysis queue" is a queue where emails that have been filtered as potentially fraudulent are temporarily stored for further analysis at a later date.

[1177] "Natural language processing technology" refers to technology that uses computers to analyze and understand human language.

[1178] "Fraudulent email" refers to emails that are intended to deceive users and illegally obtain personal or financial information.

[1179] "Fake information" refers to false information provided to fraudulent sites that imitates real user information.

[1180] "Fraudulent Site" refers to a website designed for the purpose of committing fraud.

[1181] "Feedback" refers to the process of providing users with opinions and corrections regarding the system's judgment results, which are used to help the AI ​​model learn.

[1182] "Relearning" refers to the process by which an AI model improves its performance by retraining it based on new data and feedback.

[1183] "Automation" refers to the process where a system performs a series of operations independently without human intervention.

[1184] "Identification information" refers to information that uniquely identifies a specific individual or device.

[1185] The present invention relates to a fraudulent email prevention system, and provides an efficient method for preventing fraudulent emails in particular. The system of the present invention consists of three main components: a communication device (server), an analysis terminal (terminal), and a user.

[1186] First, the server receives email from an external mail server. The server retrieves new email using the IMAP or POP3 protocol and filters the received email. The filtering is done using the Python email package or other analysis tools. For example, the server periodically checks incoming email from "mail.example.com" and analyzes header information such as the sender address and subject line, as well as the body of the email.

[1187] The server then compares the email with blacklists and rule-based filtering systems and places potentially fraudulent emails in a queue for analysis. For example, if the sender address is "unknown@example.com," the email is added to the analysis queue as a fraudulent email.

[1188] Emails stored in the analysis queue are processed on the terminal. AI frameworks such as TensorFlow and PyTorch are installed on the terminal, and these are used to perform detailed analysis of the email body using natural language processing (NLP). For example, if the terminal detects a phrase in the email body that suggests fraud, such as "Please update your bank account information," it will identify the email as fraudulent and feed the result back to the server.

[1189] If the email is identified as fraudulent, the server generates fake information such as an unused email address and phone number using the Faker library. For example, it generates a random email address such as "fakeuser@example.com" and fake names, addresses, and credit card information.

[1190] The server then uses a browser automation tool such as Selenium to access the phishing site URL listed in the fraudulent email, enter the generated fake information into a form, and submit it. This reduces the effectiveness of the fraudulent activity because the attacker can only obtain false information. For example, the server accesses "http: / / phishingsite.com," enters fake names and credit card information, and submits it.

[1191] Users access the system's management console to monitor the AI's judgment of fraudulent emails. If the judgment is incorrect, the user can provide feedback to retrain the model. For example, if a user checks the details of the information sent to a phishing site and finds an incorrect judgment, they can feed that information back into the AI ​​model and use it for retraining.

[1192] This enables early identification of fraudulent emails and effective countermeasures against attackers, allowing the accuracy of the system to be continuously improved.

[1193] Prompt Sentence Examples

[1194] text

[1195] Please generate a program that analyzes emails received by the system and determines whether they are fraudulent. Furthermore, if an email is identified as fraudulent, please add a process to access a phishing site using false information and send false information on the front end. Also, please include a procedure to retrain the AI ​​model based on user feedback.

[1196] The flow of the identification process in the first embodiment will be described with reference to FIG.

[1197] Step 1:

[1198] The server receives email from an external mail server. The server retrieves new mail using the IMAP or POP3 protocol.

[1199] Enter your mail server connection information (e.g., mail.example.com)

[1200] Output: Received email data

[1201] What it does: The server periodically connects to the mail server and checks for new email using the IMAP protocol. If there is new email, it downloads it and stores it locally.

[1202] Step 2:

[1203] The server analyzes the header information and body content of the email received using the Python email package.

[1204] Input: Received email data

[1205] Output: Email header information and body content

[1206] Specific operation: The server parses the email data and extracts the sender address, subject, and email body. For example, it extracts the sender address "unknown@example.com" and the subject "Important: Update your account information."

[1207] Step 3:

[1208] The server uses a filtering system to identify potentially fraudulent emails and place them in a queue for analysis.

[1209] Input: Email header information and body content

[1210] Output: List of potentially fraudulent emails

[1211] What happens: The server uses filtering rules to identify potentially fraudulent emails by comparing them with blacklists. If there is a high probability of fraud, the email is queued for analysis. For example, if the sender address is on a blacklist, the email is added to the analysis queue.

[1212] Step 4:

[1213] The terminal retrieves emails stored in the analysis queue and performs detailed analysis using a natural language processing (NLP) module.

[1214] Input: Potentially fraudulent email data

[1215] Output: Fraudulent email identification results

[1216] How it works: The device retrieves an email from the analysis queue and passes the email body to the NLP module. The NLP module analyzes the email body for phrases that suggest fraud, detecting phrases such as "update your bank account information." If the email is identified as fraudulent, the result is fed back to the server.

[1217] Step 5:

[1218] The server generates an unused identity, for example using the Faker library.

[1219] Input: Fraudulent email identification results

[1220] Output: Fake information (e.g. random email address, name, address, credit card information)

[1221] What it does: The server uses the Faker library to generate random email addresses, such as "fakeuser@example.com", and create fake names, addresses, and credit card information.

[1222] Step 6:

[1223] The server accesses the phishing site, enters the generated fake information, and submits it. This is done using a browser automation tool such as Selenium.

[1224] Input: Fake information and the URL of the phishing site included in the fraudulent email

[1225] Output: Status of completion of sending fake information to phishing site

[1226] What happens: The server uses Selenium to launch a browser, access the URL in the fraudulent email, enter the generated fake information into the form on the phishing site, and click the submit button to send the false information to the attacker.

[1227] Step 7:

[1228] Users access the system's management console and monitor the AI's results in identifying fraudulent emails.

[1229] Input: System result

[1230] Output: Feedback on the judgment result

[1231] What happens: A user logs in to the admin console and checks the list of emails that have been identified as fraudulent. The system checks whether the emails in question have been correctly identified and provides information about any false positives.

[1232] Step 8:

[1233] The server receives feedback from users and retrains the AI ​​model using TensorFlow's retraining function.

[1234] Input: User feedback

[1235] Output: Retrained AI model

[1236] What it does: The server creates a new dataset and retrains the AI ​​model using TensorFlow's retraining function. The retrained AI model is then applied to the system to improve the accuracy of the next judgment.

[1237] This enables early identification of fraudulent emails and effective countermeasures against attackers, allowing the accuracy of the system to be continuously improved.

[1238] (Application example 1)

[1239] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1240] In today's communications environment, fraudulent emails and phishing attacks are on the rise, putting users' personal information and assets at risk. Conventional email filtering systems have limited accuracy in detecting fraudulent emails and often require manual management by users. Furthermore, they lack the means to not only identify fraudulent emails but also deceive attackers. In addition, there is a lack of systems with re-learning capabilities that effectively utilize user feedback. To address these issues, a more advanced and efficient fraudulent email prevention system is needed.

[1241] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[1242] In this invention, the server includes: means for filtering emails received by the communication device from outside; means for identifying potentially fraudulent emails and storing the emails in an analysis queue; means for analyzing the emails stored in the analysis queue using natural language processing technology to identify fraudulent emails; means for generating false information based on emails identified as fraudulent emails and inputting the false information into a fraudulent website; means for receiving feedback from users and retraining the AI ​​model; means for monitoring emails in real time on a smart device and automatically identifying and processing fraudulent emails; and means for determining whether an email is fraudulent using prompt sentences generated by the AI ​​model. This enables advanced identification of fraudulent emails and immediate response, as well as continuous improvement of the system's accuracy using user feedback.

[1243] A "communications device" is a device for sending and receiving data, including e-mail.

[1244] "Filtering" is the process of examining emails received from outside and selecting those that meet certain conditions.

[1245] An "analysis queue" is a collection of emails that have been filtered and are temporarily stored for further analysis and inspection.

[1246] "Natural language processing technology" is a technology that allows computers to understand human language, and is used when analyzing the content of email text.

[1247] "Fraudulent email" refers to email created and sent with the intent to deceive the recipient and illegally obtain personal information or money.

[1248] "Fake information" is false data prepared to deceive attackers and is information entered into fraudulent websites.

[1249] "Feedback" refers to evaluations and opinions provided by users regarding the system's operational results and judgments.

[1250] "Retraining" is the process of updating and improving an existing AI model based on user feedback.

[1251] A "smart device" is a portable electronic device that can connect to the Internet, such as a smartphone or tablet.

[1252] A "prompt sentence" is an input sentence used in natural language analysis by an AI model.

[1253] The system for implementing this invention mainly consists of three main components: a communication device (server), an analysis terminal (terminal), and a user. This system uses smart devices to monitor emails in real time and automatically detects, identifies, and removes fraudulent emails. The specific operation of each component is shown below.

[1254] First, the server filters emails received from outside and identifies potentially fraudulent emails. Identified emails are stored in an analysis queue and passed on to subsequent processing steps. Next, emails stored in the analysis queue are processed on the device and analyzed in detail using natural language processing technology installed on the device. The natural language processing technology used here utilizes OpenAI's API.

[1255] If a fraudulent email is identified, the server generates fake information and uses it to fill in and submit forms on the fraudulent website. This fake information includes unused email addresses, false names, addresses, and credit card information. This reduces the effectiveness of fraudulent activities by limiting the attacker to false information.

[1256] Furthermore, users can monitor the system's operation and check the AI's judgments. By receiving user feedback and retraining the AI ​​model on the device, the system's accuracy is continuously improved.

[1257] The specific hardware used is a smartphone or tablet, and the software uses Python, the IMAP library (imaplib), the SMTP library (smtplib), and the OpenAI API. The combination of these elements creates an efficient and effective fraud email prevention system.

[1258] For example, if an email is received from the address "unknown@example.com" asking the user to "update their bank account information," the system will identify the email as fraudulent. The user will then click on the phishing link provided and enter false information. Examples of prompts used in this process include:

[1259] Prompt statement:

[1260] "Please check if this email is fraudulent: This email is asking you to update your bank account information. Click the link below to complete the process: http: / / phishing-link.example.com"

[1261] In this way, the system can detect fraudulent emails in real time and keep users safe by deceiving attackers.

[1262] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[1263] Step 1:

[1264] The server receives emails from the outside world. As input, it has unread emails stored in the inbox. The server connects to the mail server using the IMAP protocol and pulls the emails from the inbox. The output of this step is all the retrieved email data.

[1265] Step 2:

[1266] The server filters incoming emails. The input is the email data obtained in step 1. It analyzes the header information and body of the incoming emails to identify emails that match certain criteria (e.g., unknown senders, suspicious content). In this step, it stores emails that are likely to be fraudulent in an analysis queue. The output is the emails stored in the analysis queue.

[1267] Step 3:

[1268] The device receives emails stored in the analysis queue and analyzes them using natural language processing technology. The input is the email data in the analysis queue. The device uses the OpenAI API to analyze the email body and identify whether it is a fraudulent email. During this process, it sends a prompt to the generative AI model. For example, "Please diagnose whether this email is a fraudulent email: [email content]." The output is the determination result of whether the email is a fraudulent email.

[1269] Step 4:

[1270] The server generates fake information based on emails identified as fraudulent. The inputs are the results of the judgment in step 3 and the contents of the fraudulent email. The server prepares unused email addresses, false names, addresses, credit card information, etc., and enters them into a form on the fraudulent website and submits it. The output of this step is the fake information sent to the fraudulent website.

[1271] Step 5:

[1272] The user monitors the system's operation and checks the AI's judgment results. The inputs include the system's judgment results and records of false information transmissions. The user accesses this information through a browser or a dedicated application. The output is user feedback, which is used to retrain the AI ​​model.

[1273] Step 6:

[1274] The device receives feedback from the user and retrains the AI ​​model. The input is the feedback data provided by the user. The device sends this feedback data to the OpenAI API and retrains the AI ​​model. This improves the accuracy of fraudulent email detection from the next time onwards. The output of this step is an updated AI model.

[1275] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[1276] This invention relates to a fraudulent email prevention system, and provides an efficient method for preventing fraudulent emails in particular. The system of this invention consists of four main components: a communication device (server), an analysis terminal (terminal), a user, and an emotion engine.

[1277] 1. Receiving and filtering emails

[1278] The server receives email from outside. The server connects to the mail server and receives emails sent to users. It then filters out potentially fraudulent emails based on the header information and body content of the received emails.

[1279] Examples:

[1280] Let's say you receive two emails, one from "example@trusted.com" and one from "unknown@example.com." If your server filters the email from "unknown@example.com" and determines it is likely to be fraudulent, it places the email in a queue for analysis.

[1281] 2. AI-based fraudulent email identification

[1282] Emails stored in the analysis queue are processed on the terminal. The terminal is equipped with an AI module that uses natural language processing technology to perform detailed analysis of the email body. If the email is identified as fraudulent, the results are fed back to the server.

[1283] Examples:

[1284] The device detects if the email body contains phrases asking you to "update your bank account information" or suspicious link URLs, and identifies it as a fraudulent email.

[1285] 3. Visiting phishing sites and sending false information

[1286] If the email is identified as fraudulent, the server prepares fake data such as an unused email address or phone number, accesses the phishing site URL listed in the fraudulent email, enters the fake information into a form, and submits it.

[1287] Examples:

[1288] The server uses the email address "fakeuser@example.com" to access the phishing site, then enters a false name, address, credit card information, etc., and submits the form. This operation allows the attacker to obtain only false information, reducing the effectiveness of the fraud.

[1289] 4. Feedback and Retraining

[1290] Users monitor the system's operation, check the AI's verdicts, and if they're incorrect, provide feedback to retrain the model, improving the system's accuracy and its ability to detect future fraudulent emails.

[1291] Examples:

[1292] The user accesses the system's management console and checks the details of the information sent to the phishing site. If there is a false positive, that information is fed back to the AI ​​model. This information is used to retrain the AI ​​and improve its accuracy the next time.

[1293] 5. Incorporating an Emotional Engine

[1294] The system of the present invention incorporates an emotion engine for recognizing the user's emotions, assessing the user's emotional state from their inputs and actions, and adapting the system's response.

[1295] Examples:

[1296] When a user provides feedback, the emotion engine analyzes the user's emotional state (e.g., stress, satisfaction). For example, if the user is dissatisfied, the system immediately takes measures to improve the problem. The user's emotion data is also used to retrain the AI ​​model, improving the analysis accuracy by taking emotion data into account.

[1297] conclusion

[1298] The system of the present invention can intentionally fall for fraudulent emails, providing false information to attackers and reducing the success rate of fraudulent activities. Furthermore, by incorporating an emotion engine, it is possible to recognize the user's emotional state and adapt the system's response. Continuous learning through user feedback improves the system's accuracy and efficiency. This configuration makes it possible to effectively deter fraudulent activities.

[1299] The processing flow will be explained below.

[1300] Step 1:

[1301] The server receives email from the outside. The server connects to the mail server and receives emails sent to users.

[1302] Step 2:

[1303] The server filters the header information and body content of received emails based on specific criteria, such as the sender's domain, keywords in the subject line, and specific phrases in the body of the email.

[1304] Step 3:

[1305] The server identifies potentially fraudulent emails and places them in a queue for analysis. For example, if an email from "unknown@example.com" is determined to be likely fraudulent, it will be moved to the analysis queue.

[1306] Step 4:

[1307] The terminal retrieves the emails stored in the analysis queue. The terminal checks the analysis queue at regular intervals and retrieves newly stored emails.

[1308] Step 5:

[1309] The device's AI module analyzes the email using natural language processing technology, extracting features from the email body such as phishing links, phrases indicating urgency, and requests for personal information.

[1310] Step 6:

[1311] The device will score whether the email is fraudulent or not based on the extracted features. If the score exceeds a certain level, it will be determined to be fraudulent.

[1312] Step 7:

[1313] The device determines whether the email is fraudulent and sends the results back to the server.

[1314] Step 8:

[1315] The server prepares fake information such as unused email addresses and phone numbers based on emails that are determined to be fraudulent.

[1316] Step 9:

[1317] The server accesses the phishing site URL included in the fraudulent email.

[1318] Step 10:

[1319] The server analyzes the phishing site's form and fills in the fields with prepared fake information, such as a fake name, address, and credit card information.

[1320] Step 11:

[1321] The server submits the form on the phishing site, sending false information to the attacker, which prevents the attacker from obtaining the correct information, reducing the success rate of the fraud.

[1322] Step 12:

[1323] Users monitor the system's operations and judgment results. Users access the system's management console to check details.

[1324] Step 13:

[1325] If a user makes a false positive, they can provide that information back to the system, which will then use it to retrain the AI ​​model.

[1326] Step 14:

[1327] The device's AI module retrains based on feedback provided by the user, improving the accuracy of the model.

[1328] Step 15:

[1329] To recognize emotions from user input and behavior, the device uses an emotion engine that analyzes the content, speed, and behavioral patterns of the user's input.

[1330] Step 16:

[1331] The device's emotion engine classifies the user's emotional state into multiple categories (e.g., joy, anger, sadness, happiness).

[1332] Step 17:

[1333] The device's emotion engine adapts how and when feedback is provided based on the user's emotional state, for example, providing feedback in a simpler way if the user is feeling stressed.

[1334] Step 18:

[1335] The device's emotion engine also uses the user's emotion data to retrain the AI ​​model, improving the accuracy of future analysis.

[1336] Through this series of processing steps, the system of the present invention effectively identifies fraudulent emails and neutralizes the fraudulent activities. Also, by taking into account the user's emotions, a more intuitive and adaptive feedback process is realized, improving the accuracy and efficiency of the system.

[1337] Example 2

[1338] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1339] In modern society, fraudulent emails are becoming more prevalent, causing many people to suffer financial losses and the leakage of personal information. Conventional methods have limited detection accuracy and countermeasures against fraudulent emails, making it difficult to effectively prevent them. Furthermore, systems often respond in a fixed manner without taking the user's emotional state into account, resulting in a poor user experience. Given these circumstances, there is a need for a system that can accurately detect fraudulent emails and respond to the user's emotional state.

[1340] The identification process by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means. In this invention, the server includes means for filtering electronic information received from an external device by a communication device, means for identifying potentially fraudulent electronic information and storing the electronic information in an analysis queue, means for analyzing the electronic information stored in the analysis queue using natural language processing technology and identifying fraudulent information, means for generating false information based on the electronic information identified as fraudulent information and inputting it to a fraudulent website, means for receiving feedback from a user and retraining the generation AI model, and means for evaluating the user's emotional state using an emotion engine and adapting the system's response. This enables highly accurate detection of fraudulent emails, improves the user experience, and enables effective and flexible deterrence of fraudulent activities.

[1341] "Communications equipment" refers to any device that receives electronic information from the outside and processes the data internally.

[1342] "Electronic Information" refers to data transmitted in electronic form, such as by email.

[1343] "Filtering" refers to the process of sorting received electronic information based on specific criteria to remove inappropriate data.

[1344] "Analysis queue" refers to a data structure for temporarily storing electronic information that requires analysis.

[1345] "Natural language processing technology" refers to a method by which computers understand and analyze human language.

[1346] "Fraudulent Information" means electronic information created with the intent to commit fraud.

[1347] "False information" refers to false data intentionally generated to prevent fraud.

[1348] A "phishing site" is a website designed to defraud users of their personal information.

[1349] "Feedback" refers to the evaluations and opinions provided by users regarding the system's judgment results.

[1350] A "generative AI model" refers to an artificial intelligence algorithm that learns patterns from large amounts of data and is trained to perform specific tasks.

[1351] "Emotion engine" refers to the algorithms and software used to assess a user's emotional state and adapt the system's response.

[1352] "Header information" refers to metadata such as the sender, recipient, date and time included at the beginning of electronic information.

[1353] "Scoring" refers to the process of numerically assessing the importance and risk of electronic information based on specific criteria.

[1354] The present invention is a fraudulent email prevention system that consists of four main components: a communication device, an analysis terminal, a user, and an emotion engine. A specific embodiment of this system will be described in detail below.

[1355] Receiving and filtering emails

[1356] The server connects to the mail server using IMAP or POP3 protocols to receive emails sent to users. The received emails are analyzed for header information and body content, and then filtered based on specific spam filter rules and blacklists. For example, emails from "unknown@example.com" are filtered and stored in a queue for analysis.

[1357] AI-based fraudulent email identification

[1358] The terminal takes emails stored in the analysis queue and analyzes them using natural language processing techniques. This analysis uses Python natural language processing libraries (e.g., NLTK and SpaCy). Specifically, the email body is tokenized and keywords and phrases characteristic of fraud are extracted. A machine learning model (e.g., a model using Scikit-learn or TensorFlow) is then applied to determine whether the email is fraudulent. For example, the terminal may detect phrases such as "update your bank account information" or suspicious links and identify the email as fraudulent.

[1359] Visiting phishing sites and sending false information

[1360] If the email is identified as fraudulent, the server generates fake information. Specifically, it prepares an unused email address and randomly generated personal information (such as name, address, phone number, and credit card information). It then sends an HTTP request to access the phishing site URL listed in the fraudulent email, enters the fake information into the form, and submits it. For example, the server accesses the phishing site using the email address "fakeuser@example.com" and submits the fake information.

[1361] Feedback and Retraining

[1362] Users access the system administration console to check the AI's judgment results and information sent to phishing sites. If an incorrect judgment is made, the user provides feedback. For example, they can input information such as "this email is legitimate" into the system. The feedback information is used to retrain the AI ​​model, and the accuracy of the system is improved by retraining the generative AI model (for example, a model implemented in TensorFlow or PyTorch).

[1363] Incorporating an emotion engine

[1364] The system incorporates an emotion engine to evaluate the user's emotional state. The emotion engine collects emotion data through the user's feedback process and UX interactions, and uses an emotion analysis model (e.g., Sentiment Analysis API or a custom emotion analysis model) to evaluate the user's emotional state (e.g., stress, satisfaction). If the user is dissatisfied, the system automatically takes appropriate measures. The emotion data is also incorporated into the AI ​​model's retraining process, further improving the accuracy of the analysis.

[1365] Example prompt: If two emails are received, one from "example@trusted.com" and one from "unknown@example.com", and the email from "unknown@example.com" is filtered and identified as a fraudulent email, place it in the analysis queue.

[1366] According to this embodiment, the accuracy of detecting fraudulent emails is improved, and the user experience is also improved at the same time. A system for maximizing the deterrent effect of fraudulent acts is provided.

[1367] The flow of the identification process in the second embodiment will be described with reference to FIG.

[1368] Step 1: Receiving email and initial filtering

[1369] The server connects to an external mail server using the IMAP or POP3 protocol to receive new, unread emails, which are then temporarily stored before being analyzed.

[1370] Input: Unread emails received from external mail servers

[1371] Output: Archived unread emails

[1372] The server scans the header information (sender, subject, date and time of receipt, etc.) and part of the body of the email received, and filters out suspicious emails based on spam filtering rules and blacklists.

[1373] What happens: The server filters email from "unknown@example.com" to identify potentially fraudulent emails.

[1374] Input: Archived unread emails

[1375] Output: Filtered emails

[1376] Step 2: Queueing the analysis

[1377] The server stores filtered suspicious emails in an analysis queue, which serves as a temporary repository for subsequent detailed analysis.

[1378] Input: filtered email

[1379] Output: Emails queued for analysis

[1380] Step 3: Identifying fraudulent emails with AI

[1381] The device retrieves emails from the analysis queue, tokenizes and analyzes the email body using natural language processing techniques (e.g., NLTK or SpaCy), extracts keywords and phrases characteristic of fraud, and applies machine learning models (e.g., Scikit-learn or TensorFlow) to determine whether the email is fraudulent.

[1382] What it does: The device will detect phrases like "update your bank account information" and suspicious links and identify the email as fraudulent.

[1383] Input: Emails stored in the analysis queue

[1384] Output: Fraudulent email detection result

[1385] Step 4: Generate and send fake information

[1386] If the email is identified as fraudulent, the server generates an unused email address and randomly generated personal information (such as name, address, phone number, credit card information, etc.).

[1387] Input: Fraudulent email detection result

[1388] Output: Fake information

[1389] The server sends an HTTP request to access the phishing site URL listed in the fraudulent email, enters false information into the form, and submits it.

[1390] Specific actions: Access a phishing site using the email address "fakeuser@example.com" and send fake information.

[1391] Input: Fake information

[1392] Output: Result of sending to phishing site

[1393] Step 5: Feedback and Retraining

[1394] The user accesses the system management console to check the AI's judgment results and information sent to phishing sites. If there are any incorrect judgments, the user provides feedback. This feedback information is used to retrain the AI ​​model.

[1395] Specific action: The user enters information into the system, such as "this email is legitimate."

[1396] Input: AI judgment results, user evaluation

[1397] Output: AI model reflecting the correction results

[1398] Step 6: Incorporating the Emotion Engine

[1399] The server collects emotional data through the user's feedback process and UX interactions, and evaluates the user's emotional state using a sentiment analysis model (e.g., Sentiment Analysis API or a self-made sentiment analysis model).

[1400] Input: User feedback, interaction data

[1401] Output: User's emotional state rating

[1402] The server adapts the system's response based on the user's emotional state: if negative emotions are detected, the system automatically takes countermeasures.

[1403] Specific action: If the emotional state is evaluated as "stressed," the system will strengthen the user support function.

[1404] Input: User's emotional state rating

[1405] Output: Result of countermeasure implementation

[1406] (Application example 2)

[1407] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1408] In recent years, fraudulent activities have become increasingly sophisticated, with an increase in fraudulent activities using email and other communication methods. Conventional methods are inadequate to deal with such fraudulent activities, resulting in a constant stream of user damage. Furthermore, in detecting and combating fraudulent activities, automated methods for early detection and responses that take into account the user's emotional state are required. The present invention aims to solve these problems and provide a system for efficiently detecting and responding to fraudulent communications.

[1409] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 2 is realized by the following means.

[1410] In this invention, the server includes means for filtering communications received by the communication device from outside, means for identifying potentially fraudulent communications and storing the communications in an analysis queue, means for analyzing the communications stored in the analysis queue using natural language processing technology to identify fraudulent communications, means for generating false information based on communications identified as fraudulent communications and inputting it to a fraudulent website, means incorporating an emotion engine that evaluates the emotional state of the user from input and adapts the system's response based on that evaluation, and means for receiving feedback from the user and retraining the generation AI model, thereby enabling early detection of fraudulent communications and effective countermeasures.

[1411] A "communications device" is an electronic device or system for receiving and processing electronic mail or other forms of communication.

[1412] "Filtering means" is a function that analyzes the content of received communications and determines and classifies their importance and risk based on specific conditions.

[1413] "Potentially fraudulent communications" are communications that are deemed to contain an intention to deceive users and steal their money or personal information.

[1414] An "analysis queue" is a temporary storage location or list of filtered communications for further detailed analysis.

[1415] "Natural language processing technology" is a technology for analyzing human language using machines, and specifically, it is a method for understanding sentences, analyzing their meaning, and classifying them.

[1416] The "means for identifying fraudulent communications" is a function that uses natural language processing technology to determine whether a received communication contains fraudulent intent.

[1417] "Fake information" refers to fictitious personal information or credit card information that is entered into a fraudulent website.

[1418] A "fraudulent website" is a fraudulent website that aims to fraudulently obtain money or personal information from users.

[1419] The "emotion engine" is a function that evaluates the user's emotional state based on their input and actions and adjusts the system's response.

[1420] A "generative AI model" is a predictive model that is automatically generated by AI and is retrained based on user feedback.

[1421] The present invention relates to a system for effectively detecting and combating fraudulent communications, which includes a communication device, a filtering means, an analytical queue, a fraudulent communications identification means using natural language processing techniques, a false information generation means, an emotion engine, and a retraining means using a generative AI model.

[1422] System Configuration

[1423] The system mainly consists of the following components:

[1424] 1. Communications equipment

[1425] Receives external communications and processes them on the system.

[1426] Specifically, electronic devices such as servers and smartphones are used to receive email and other communications.

[1427] 2. Filtering Methods

[1428] Scans header information and the body of communications to identify potentially fraudulent communications.

[1429] Filtering criteria include the sender address, email content, and whether or not the email contains links.

[1430] 3. Analysis Queue

[1431] Temporarily store filtered communications and prepare them for further analysis.

[1432] This storage location is often a portion of a server or a dedicated database.

[1433] 4. Methods for identifying fraudulent communications using natural language processing (NLP)

[1434] It uses NLP technology to analyze the content of communications and identify fraudulent activity.

[1435] For example, we use the Transformers library to determine the likelihood of fraud based on the overall context or specific keywords.

[1436] 5. Methods for generating false information

[1437] If the communication is identified as fraudulent, false personal information, credit card information, etc. is generated and entered into the fraudulent website.

[1438] The deceptive information is randomly generated to ensure that attackers only obtain meaningless data.

[1439] 6. Emotion Engine

[1440] It assesses the user's emotional state from their input and behavior and adapts the system's response accordingly.

[1441] For example, if the user is feeling stressed, the system will take measures such as displaying a supportive message.

[1442] 7. Retraining Methods (Generative AI Models)

[1443] Receive user feedback and retrain the generative AI model.

[1444] This will continually improve the system's ability to identify fraudulent communications.

[1445] Specific examples

[1446] As a concrete example of how this system can be used, consider the case where a user receives email using a smartphone. The system automatically filters the emails received by the user and stores potentially fraudulent emails in an analysis queue. Next, the emails stored in the analysis queue are analyzed in detail using natural language processing technology, and may be identified as fraudulent emails. At this time, false information is generated and entered into the fraudulent website specified in the fraudulent email. At the same time, feedback from the user is received, allowing the generative AI model to be retrained and the system's performance to improve.

[1447] Examples of specific prompts include the following:

[1448] "I've been receiving a lot of phishing emails lately, but since I started using this app, I've hardly fallen for them. I would like you to strengthen the email filtering function to further improve the accuracy of the system."

[1449] This system enables early detection of fraudulent communications and effective countermeasures, thereby increasing users' sense of security.

[1450] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[1451] Step 1:

[1452] The server receives emails from the outside via communication devices. The received emails are first scanned on the server for header information and body content. The header information and body content of the email are passed to the server as input, and the risk of the email is determined based on this, after which filtering is performed. As an output, potentially fraudulent emails are identified and stored in an analysis queue.

[1453] Step 2:

[1454] The server queues identified potentially fraudulent emails for analysis. In this step, filtered emails are stored in a dedicated database or temporary storage area for further analysis. The input is the filtered emails, and the output is the emails stored in the analysis queue.

[1455] Step 3:

[1456] The device analyzes the emails stored in the analysis queue using natural language processing (NLP) technology. Here, the text data of the input email body is analyzed in detail using the Transformers library, etc. Keywords and phrases that determine fraudulence are detected, and emails identified as fraudulent are generated as output.

[1457] Step 4:

[1458] The server generates fake information based on emails identified as fraudulent and inputs that information into the fraudulent website. The input is the fraudulent email and the fake information template used to generate it, and the output is the fake information sent to the fraudulent website. Specifically, randomly generated fake personal information and credit card information is used. This fake information is sent from the server to the fraudulent website as an HTTP request.

[1459] Step 5:

[1460] The user monitors the system's operation and provides feedback. The user's feedback is analyzed by the emotion engine. The user provides a feedback statement as input, which is then analyzed by the emotion engine. The analysis results in an evaluation of the user's emotional state (e.g., satisfied, dissatisfied) and is output.

[1461] Step 6:

[1462] The server retrains the generative AI model based on user feedback. The input is the user feedback data and the analysis results of the emotion engine, and the output is updated parameters of the AI ​​model. By retraining the model, the accuracy of identifying fraudulent emails next time will improve.

[1463] This will enable early detection of fraudulent communications and effective countermeasures.

[1464] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[1465] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1466] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the robot 414.

[1467] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[1468] FIG. 9 is a diagram illustrating an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and actions arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion includes both affect and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[1469] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[1470] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[1471] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. Emotions can also be created for robots, automobiles, and motorcycles, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on Voice Emotion Recognition and Emotional Brain Physiological Signal Analysis Systems, Tokushima University, Doctoral Dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the "reaction" domain, where sensation is dominant. The right half of the emotion map lists emotions belonging to the "situation" domain, where situational awareness is dominant.

[1472] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[1473] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[1474] The system according to the present disclosure has been described above mainly with respect to the functions of the data processing device 12, but the system according to the present disclosure is not necessarily implemented on a server. The system according to the present disclosure may be implemented as a general information processing system. The present disclosure may be implemented, for example, as a software program running on a personal computer or an application running on a smartphone, etc. The method according to the present disclosure may be provided to users in the form of SaaS (Software as a Service).

[1475] In the above embodiment, an example was given in which the specific processing is performed by one computer 22, but the technology of the present disclosure is not limited to this, and the specific processing may be distributed and performed by a plurality of computers including the computer 22. For example, the data generation model 58 may be provided in an external device of the data processing device 12, and data may be generated in the external device in accordance with input data.

[1476] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[1477] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[1478] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[1479] The hardware resource for executing a specific process can be any of the following processors: An example of a processor is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. Another example of a processor is a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[1480] The hardware resource that executes the specific processing may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific processing may be a single processor.

[1481] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[1482] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[1483] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[1484] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[1485] The following is further disclosed regarding the above embodiment.

[1486] (Claim 1)

[1487] means for filtering emails received by the communication device from outside;

[1488] a means for identifying potentially fraudulent emails and placing the emails in an analysis queue;

[1489] A means for analyzing emails stored in the analysis queue using natural language processing technology to identify fraudulent emails;

[1490] generating false information based on the email identified as fraudulent and inputting the false information into the fraudulent website;

[1491] A means to receive user feedback and retrain the AI ​​model;

[1492] A system including:

[1493] (Claim 2)

[1494] 10. The system of claim 1, wherein the system scans the header information and body of emails received from outside to identify emails that meet specific conditions.

[1495] (Claim 3)

[1496] The system according to claim 1, wherein a score is assigned to determine whether an email is fraudulent, and if the score exceeds a certain level, the email is determined to be fraudulent.

[1497] "Example 1"

[1498] (Claim 1)

[1499] means for filtering emails received by the communication device from outside;

[1500] a means for identifying potentially fraudulent emails and placing the emails in an analysis queue;

[1501] A means for analyzing emails stored in the analysis queue using natural language processing technology to identify fraudulent emails;

[1502] generating unused identifying information based on the email identified as a fraudulent email and inputting the unused identifying information into the fraudulent site;

[1503] A means to receive user feedback and retrain the AI ​​model;

[1504] Automating access to fraudulent sites;

[1505] A means for feeding back the analyzed information to the server;

[1506] A system including:

[1507] (Claim 2)

[1508] 10. The system of claim 1, wherein the system scans the header information and body of emails received from outside to identify emails that meet specific conditions.

[1509] (Claim 3)

[1510] The system according to claim 1, wherein a score is assigned to determine whether an email is fraudulent, and if the score exceeds a certain level, the email is determined to be fraudulent.

[1511] "Application Example 1"

[1512] (Claim 1)

[1513] means for filtering emails received by the communication device from outside;

[1514] a means for identifying potentially fraudulent emails and placing the emails in an analysis queue;

[1515] A means for analyzing emails stored in the analysis queue using natural language processing technology to identify fraudulent emails;

[1516] generating false information based on the email identified as fraudulent and inputting the false information into the fraudulent website;

[1517] A means to receive user feedback and retrain the AI ​​model;

[1518] A means to monitor emails in real time using smart devices and automatically identify and process fraudulent emails;

[1519] A means for determining whether an email is fraudulent using a prompt sentence generated by an AI model;

[1520] A system including:

[1521] (Claim 2)

[1522] 10. The system of claim 1, wherein the system scans the header information and body of emails received from outside to identify emails that meet specific conditions.

[1523] (Claim 3)

[1524] The system according to claim 1, wherein a score is assigned to determine whether an email is fraudulent, and if the score exceeds a certain level, the email is determined to be fraudulent.

[1525] "Example 2: Combining Emotion Engines"

[1526] (Claim 1)

[1527] means for filtering electronic information received by the communication device from the outside;

[1528] means for identifying potentially fraudulent electronic information and storing the electronic information in an analysis queue;

[1529] means for analyzing the electronic information stored in the analysis queue using natural language processing techniques to identify fraudulent information;

[1530] means for generating false information based on the electronic information identified as fraudulent information and inputting the false information into a fraudulent website;

[1531] A means to receive user feedback and retrain the generative AI model;

[1532] means for assessing the emotional state of the user using an emotion engine and adapting the system's response;

[1533] A system including:

[1534] (Claim 2)

[1535] 2. The system according to claim 1, wherein the system scans the header information and body of electronic information received from an external source to identify electronic information that meets specific conditions.

[1536] (Claim 3)

[1537] The system according to claim 1, wherein the system scores information to determine whether it is fraudulent, and determines that the information is fraudulent if the score exceeds a certain level.

[1538] "Application example 2 when combining emotion engines"

[1539] Content of new invention claims

[1540] (Claim 1)

[1541] means for filtering communications received by the communications device from the outside;

[1542] means for identifying potentially fraudulent communications and storing such communications in an analysis queue;

[1543] means for analyzing the communications stored in the analysis queue using natural language processing techniques to identify fraudulent communications;

[1544] means for generating false information based on the identified communications and inputting the false information into a fraudulent site;

[1545] means incorporating an emotion engine for assessing the user's emotional state from input and adapting the system's response accordingly;

[1546] A means to receive user feedback and retrain the generative AI model;

[1547] A system including:

[1548] (Claim 2)

[1549] 10. The system of claim 1, wherein the system scans header information and content of externally received communications to identify communications that meet specified criteria.

[1550] (Claim 3)

[1551] The system according to claim 1, wherein the system scores fraudulent communications, determines that a communication is fraudulent if the score exceeds a certain level, and adjusts the response according to the user's emotional state. [Explanation of symbols]

[1552] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot< / url:> < / url:> < / url:> < / url:>

Claims

1. means for filtering emails received by the communication device from outside; a means for identifying potentially fraudulent emails and placing the emails in an analysis queue; A means for analyzing emails stored in the analysis queue using natural language processing technology to identify fraudulent emails; generating false information based on the email identified as fraudulent and inputting the false information into the fraudulent website; A means to receive user feedback and retrain the AI ​​model; A system including:

2. 2. The system according to claim 1, wherein the system scans the header information and the body of emails received from outside and identifies emails that meet specific conditions.

3. 2. The system according to claim 1, wherein a score is calculated to determine whether an email is fraudulent, and if the score exceeds a certain level, the email is determined to be fraudulent.

Images