System

Abstract

An object of a system according to an embodiment is to detect business email compromise and warn a recipient.SOLUTION: A system includes a collection part, an analysis part, and a warning generation part. The collection unit collects mail information. The analysis unit analyzes the information collected by the collection unit. The warning generation unit generates a warning message based on the analysis result obtained by the analysis unit.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] Existing technologies are not sufficient to effectively detect and warn recipients of Business Email Compromise (BEC) attacks, and there is room for improvement.

[0005] The system according to the embodiment aims to detect business email compromise and warn the recipient. [Means for solving the problem]

[0006] The system according to the embodiment includes a collection unit, an analysis unit, and a warning generation unit. The collection unit collects email information. The analysis unit analyzes the information collected by the collection unit. The warning generation unit generates a warning message based on the analysis results obtained by the analysis unit. [Effects of the Invention]

[0007] An embodiment of the system can detect business email compromise and warn the recipient. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10] 1 shows an emotion map onto which multiple emotions are mapped. DETAILED DESCRIPTION OF THE INVENTION

[0009] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0010] First, the terms used in the following description will be explained.

[0011] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, the processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), an APU (Accelerated Processing Unit), or a TPU (Tensor Processing Unit).

[0012] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0013] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0014] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), and Bluetooth (registered trademark).

[0015] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0016] [First embodiment] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0017] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0018] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0019] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0020] The reception device 38 includes a touch panel 38A and a microphone 38B, and receives user input. The touch panel 38A detects contact with a pointer (for example, a pen or a finger) to receive user input by the touch of the pointer. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 (see FIG. 2) acquires the data indicating the user input.

[0021] Output device 40 includes a display 40A and a speaker 40B, and presents data to a user by outputting the data in a form of expression that the user can perceive (e.g., audio and / or text). Display 40A displays visible information such as text and images in accordance with instructions from processor 46. Speaker 40B outputs audio in accordance with instructions from processor 46. Camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0022] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0023] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0024] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0025] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate a user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, but is not limited to these examples. Furthermore, the estimation and prediction of emotion also includes, for example, emotion analysis.

[0026] In the smart device 14, the specific processing is performed by the processor 46. The storage 50 stores a specific processing program 60. The specific processing program 60 is used together with the specific processing program 56 by the data processing system 10. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. Note that the smart device 14 has a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can also perform processing similar to that of the specific processing unit 290 using these models.

[0027] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device (e.g., a generation server) may have the data generation model 58. In this case, the data processing device 12 obtains a processing result (prediction result, etc.) using the data generation model 58 by communicating with the server device having the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device owned by a user (e.g., a mobile phone, a robot, a home appliance, etc.). Next, an example of processing by the data processing system 10 according to the first embodiment will be described.

[0028] (Example 1) A system according to an embodiment of the present invention is a system for preventing business email compromise (BEC). This system uses a generation AI to detect fraudulent emails and warn the recipient. For example, the system analyzes a received email and determines whether it is likely to be fraudulent. If it is, it generates a warning message to warn the recipient. This allows the recipient to quickly respond to the fraudulent email. This ensures the safety of the recipient and prevents business email compromise (BEC). For example, if a company employee receives a fraudulent email, the system generates a warning message and notifies the employee, allowing for a quick response to the fraudulent email. Furthermore, by having the generation AI learn the characteristics of fraudulent emails, the accuracy of analysis will improve from the next time onwards, strengthening the security of the entire company.

[0029] An email spoofing prevention system according to an embodiment includes a collection unit, an analysis unit, and a warning generation unit. The collection unit collects email information. For example, the collection unit can collect email header information and linked URLs. The collection unit can also collect information such as the email sender address, the email body content, and attachments. The analysis unit analyzes the information collected by the collection unit. For example, the analysis unit determines whether the email sender address is spoofed. The analysis unit can also analyze whether the email body content differs from normal business emails. The analysis unit can also analyze whether the attachment contains a virus. The warning generation unit generates a warning message based on the analysis results obtained by the analysis unit. For example, the warning generation unit generates a warning message such as, "This email may be spoofed. Please check the sender address and the email body content." The warning generation unit can also notify the recipient of the generated warning message. This allows the email spoofing prevention system according to an embodiment to detect spoofed emails and alert the recipient.

[0030] The collection unit can collect email header information or linked URLs. For example, the collection unit collects email header information. Header information includes the sender's IP address, the date and time of sending, and the like. The collection unit can also collect linked URLs. For example, the collection unit extracts links included in the email body and collects their URLs. Furthermore, the collection unit can verify the reliability of the collected URLs. This allows the collection unit to collect detailed information about the email and increase the possibility of fraud.

[0031] The analysis unit can analyze the sender address, body content, and attachments of an email to determine the possibility of spoofing. The analysis unit, for example, analyzes the sender address of an email. Analysis of the sender address includes evaluating the reliability of the domain and checking against a blacklist. The analysis unit can also analyze the body content of the email. For example, the analysis unit extracts keywords from the body and analyzes the context. The analysis unit can also analyze attachments to the email. For example, the analysis unit verifies the format of the attachment and performs a virus scan. This allows the analysis unit to determine the possibility of spoofing an email with high accuracy.

[0032] The warning generation unit can generate a specific warning message if there is a high possibility of fraud. For example, if there is a high possibility of fraud, the warning generation unit generates a specific warning message such as, "This email may be fraudulent. Please check the sender address and the content of the email body." The warning generation unit can also notify the recipient of the generated warning message. For example, the warning generation unit sends the warning message to the recipient as a pop-up notification or an email notification. In this way, the warning generation unit can provide the recipient with a specific warning and encourage them to take prompt action.

[0033] The analysis unit can learn the characteristics of spoofed emails using the generation AI and use this information in subsequent analyses. The analysis unit, for example, uses the generation AI to learn the characteristics of spoofed emails. The generation AI can learn the sender address and body text patterns of spoofed emails and use these characteristics in analysis. For example, if a specific sender address or body text pattern is frequently seen in spoofed emails, the generation AI can learn these characteristics and use them in subsequent analyses. This allows the analysis unit to improve the accuracy of detecting spoofed emails.

[0034] The collection unit can periodically update the dataset and collect the latest spoofed email patterns. The collection unit, for example, periodically updates the dataset. Updating the dataset includes collecting the latest spoofed email patterns. For example, the collection unit collects the latest spoofed email patterns from public databases on the Internet or from corporate email servers. This allows the collection unit to collect the latest spoofed email patterns and improve analysis accuracy.

[0035] The analysis unit can improve the analysis accuracy based on the latest collected data set. The analysis unit improves the analysis accuracy based on, for example, the latest collected data set. The latest data set includes the latest patterns of spoofed emails. The analysis unit can adjust the analysis algorithm based on these patterns to improve the analysis accuracy. For example, the analysis unit retrains the generation AI using the latest data set to improve the analysis accuracy. This enables the analysis unit to more accurately detect spoofed emails.

[0036] The warning generation unit can notify the recipient of a warning message. The warning generation unit notifies the recipient of the generated warning message, for example. Notification methods include pop-up notification and email notification. For example, the warning generation unit displays the warning message as a pop-up notification on the recipient's screen. The warning generation unit can also send the warning message to the recipient as an email notification. This allows the warning generation unit to quickly notify the recipient of the warning and urge them to take action against the fraudulent email.

[0037] The collection unit can analyze past email history when collecting emails and select the optimal collection method. The collection unit, for example, analyzes past email history when collecting emails. The analysis of past email history includes the type of history data and an analysis algorithm. For example, the collection unit collects emails by avoiding time periods when many fraudulent emails have been sent in the past. The collection unit can also prioritize collecting emails from specific senders based on the past email history. Furthermore, the collection unit can prioritize collecting emails containing specific keywords based on the past email history. This allows the collection unit to select the optimal collection method based on the past email history and collect emails efficiently.

[0038] The collection unit can filter emails based on the user's current work situation and areas of interest when collecting emails. For example, the collection unit grasps the user's current work situation and areas of interest when collecting emails. The understanding of the work situation includes the type of work and its progress. For example, if the user is in a meeting, the collection unit prioritizes collecting only emails related to the meeting. Also, if the user is concentrating on a specific project, the collection unit can prioritize collecting emails related to the project. Furthermore, the collection unit can prioritize collecting related emails based on the user's areas of interest. For example, the collection unit prioritizes collecting emails related to the user's areas of interest. This allows the collection unit to prioritize collecting highly relevant emails according to the user's work situation and areas of interest.

[0039] The collection unit can evaluate the reliability of the sender of an email when collecting emails and prioritize collecting emails with low reliability. The collection unit, for example, evaluates the reliability of the sender when collecting emails. The evaluation of the reliability of the sender includes the reliability evaluation of the domain and past sending history. For example, the collection unit prioritizes collecting emails with unknown sender addresses and sends them to the analysis unit. The collection unit can also prioritize collecting emails from newly registered sender domains. Furthermore, the collection unit can also prioritize collecting emails from sender IP addresses that have been reported as spam in the past. This allows the collection unit to prioritize collecting emails with low reliability and improve the accuracy of detecting spoofed emails.

[0040] When collecting emails, the collection unit can prioritize collecting highly relevant emails by taking into account the user's geographical location information. For example, the collection unit considers the user's geographical location information when collecting emails. Collection of geographical location information includes GPS data and IP addresses. For example, when the user is on a business trip, the collection unit prioritizes collecting emails related to the business trip destination. Furthermore, when the user is in a specific region, the collection unit can also prioritize collecting emails related to that region. Furthermore, when the user is overseas, the collection unit can prioritize collecting international emails. This allows the collection unit to prioritize collecting highly relevant emails based on the user's geographical location information.

[0041] The collection unit can analyze the user's social media activity when collecting emails and collect related emails. The collection unit, for example, analyzes the user's social media activity when collecting emails. The analysis of social media activity includes the content of posts and the frequency of activity. For example, the collection unit preferentially collects emails related to topics mentioned by the user on social media. The collection unit can also collect related emails by referring to the activities of the user's friends on social media. Furthermore, the collection unit can analyze the content of the user's posts on social media and collect related emails. This allows the collection unit to preferentially collect related emails based on the user's social media activity.

[0042] The collection unit can customize the collection method by reflecting the user's past feedback when collecting emails. For example, the collection unit reflects the user's past feedback when collecting emails. Reflecting past feedback includes the type of feedback and the reflection method. For example, the collection unit prioritizes collecting emails that the user has previously rated as important. The collection unit can also avoid collecting emails that the user has previously rated as spam. Furthermore, the collection unit can customize the collection method based on the user's past feedback. This allows the collection unit to select the optimal collection method based on the user's past feedback.

[0043] The analysis unit can adjust the level of detail of the analysis based on the importance of the email during analysis. The analysis unit, for example, evaluates the importance of the email during analysis. The evaluation of the importance of the email includes an importance score and evaluation criteria. For example, the analysis unit performs a detailed analysis on emails with high importance. The analysis unit can also perform a simplified analysis on emails with low importance. Furthermore, the analysis unit can dynamically adjust the level of detail of the analysis depending on the importance. This allows the analysis unit to provide optimal analysis results depending on the importance of the email.

[0044] The analysis unit can apply different analysis algorithms depending on the category of the email during analysis. For example, the analysis unit classifies the category of the email during analysis. The classification of email categories includes business email, private email, spam email, etc. For example, the analysis unit applies a business-specific analysis algorithm to business email. The analysis unit can also apply a private-specific analysis algorithm to private email. Furthermore, the analysis unit can apply a spam-specific analysis algorithm to spam email. This allows the analysis unit to apply the optimal analysis algorithm depending on the category of the email.

[0045] The analysis unit can improve the accuracy of the analysis by referring to the user's past analysis results during analysis. The analysis unit, for example, refers to the user's past analysis results during analysis. Referring to past analysis results includes methods for saving and referring to analysis results. For example, the analysis unit improves the accuracy of the analysis by referring to analysis results that the user previously rated as important. The analysis unit can also improve the accuracy of the analysis by referring to analysis results that the user previously rated as incorrect. Furthermore, the analysis unit can adjust the analysis algorithm based on the user's past analysis results. This allows the analysis unit to improve the accuracy of the analysis based on the user's past analysis results.

[0046] During analysis, the analysis unit can determine the priority of analysis based on the time when the email was sent. For example, the analysis unit evaluates the time when the email was sent during analysis. The evaluation of the time when the email was sent includes the date and time of sending and the frequency of sending. For example, the analysis unit prioritizes analyzing recently sent emails. The analysis unit can also prioritize analyzing emails sent during important time periods. Furthermore, the analysis unit can prioritize analyzing emails sent during time periods specified by the user. This allows the analysis unit to perform analysis in the optimal order depending on the time when the email was sent.

[0047] The analysis unit can adjust the order of analysis based on the relevance of emails during analysis. The analysis unit, for example, evaluates the relevance of emails during analysis. The evaluation of relevance includes a relevance score and evaluation criteria. For example, the analysis unit prioritizes analysis of emails related to the user's work. The analysis unit can also prioritize analysis of emails related to the user's areas of interest. Furthermore, the analysis unit can prioritize analysis of highly relevant emails based on the user's past feedback. This allows the analysis unit to perform analysis in an optimal order depending on the relevance of emails.

[0048] The analysis unit can adjust the use of technical terms in the analysis according to the user's level of expertise during analysis. The analysis unit, for example, evaluates the user's level of expertise during analysis. The evaluation of the level of expertise includes the user's occupation and past learning history. For example, if the user is an expert, the analysis unit can provide analysis results that make heavy use of technical terms. Also, if the user is a beginner, the analysis unit can provide analysis results that avoid technical terms. Furthermore, the analysis unit can adjust the way the analysis results are expressed according to the user's level of expertise. This allows the analysis unit to provide optimal analysis results according to the user's level of expertise.

[0049] When generating a warning, the warning generation unit can adjust the level of detail of the warning message based on the level of possibility of fraud. For example, when there is a high possibility of fraud, the warning generation unit provides a detailed warning message. For example, it generates a detailed warning message such as, "This email is very likely to be fraudulent. Please carefully check the sender address and the content of the email body." Furthermore, when there is a low possibility of fraud, it can also provide a simplified warning message. For example, it generates a simplified warning message such as, "This email may be fraudulent. Please check carefully." Furthermore, the warning generation unit can dynamically adjust the level of detail of the warning message depending on the possibility of fraud. This allows the warning generation unit to provide a warning message with optimal level of detail depending on the possibility of fraud.

[0050] When generating a warning, the warning generation unit can generate different warning messages depending on the category of the email. The warning generation unit, for example, classifies email categories. Email categories include business email, private email, spam email, etc. For example, the warning generation unit generates a business-specific warning message for business email. For example, it generates a warning message such as, "This business email may be spoofed. Please check the sender address and the content of the email body." The warning generation unit can also generate a private-specific warning message for private email. For example, it generates a warning message such as, "This private email may be spoofed. Please check carefully." Furthermore, the warning generation unit can also generate a spam-specific warning message for spam email. This allows the warning generation unit to provide the optimal warning message depending on the category of the email.

[0051] When generating a warning, the warning generation unit can improve the accuracy of the warning message by referring to the user's past reactions to warning messages. The warning generation unit, for example, refers to the user's past reactions to warning messages. Referring to past reactions to warning messages includes the type of reaction and the reference method. For example, the warning generation unit improves the accuracy of the warning message by referring to warning messages that the user previously rated as important. The warning generation unit can also improve the accuracy of the warning message by referring to warning messages that the user previously rated as incorrect. Furthermore, the warning generation unit can adjust the warning message generation algorithm based on the user's past reactions to warning messages. In this way, the warning generation unit can improve the accuracy of the warning message based on the user's past reactions.

[0052] When generating an alert, the alert generation unit can determine the priority of the alert message based on the time when the email was sent. The alert generation unit, for example, evaluates the time when the email was sent. The evaluation of the time when the email was sent includes the date and time of sending and the frequency of sending. For example, the alert generation unit can generate an alert message with priority for emails sent recently. The alert generation unit can also generate an alert message with priority for emails sent during an important time period. Furthermore, the alert generation unit can generate an alert message with priority for emails sent during a time period specified by the user. This allows the alert generation unit to provide alert messages in the optimal order depending on the time when the email was sent.

[0053] The warning generation unit can adjust the order of warning messages based on the relevance of emails when generating a warning. The warning generation unit, for example, evaluates the relevance of emails. The evaluation of relevance includes a relevance score and an evaluation criterion. For example, the warning generation unit can generate warning messages with priority for emails related to the user's work. The warning generation unit can also generate warning messages with priority for emails related to the user's areas of interest. Furthermore, the warning generation unit can generate warning messages with priority for highly relevant emails based on the user's past feedback. This allows the warning generation unit to provide warning messages in an optimal order according to the relevance of the emails.

[0054] When generating a warning, the warning generation unit can adjust the use of technical terms in the warning message depending on the user's level of expertise. The warning generation unit, for example, evaluates the user's level of expertise. The evaluation of the level of expertise includes the user's occupation and past learning history. For example, if the user is an expert, the warning generation unit provides a warning message that uses a lot of technical terms. Also, if the user is a beginner, the warning generation unit can provide a warning message that avoids technical terms. Furthermore, the warning generation unit can adjust the way the warning message is expressed depending on the user's level of expertise. This allows the warning generation unit to provide an optimal warning message depending on the user's level of expertise.

[0055] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0056] When collecting emails, the collection unit can analyze the user's past behavioral patterns and determine the optimal collection timing. For example, if the user frequently checks emails during a specific time period, emails can be collected according to that time period. Also, if the user receives a lot of emails on a specific day of the week, collection can be strengthened according to that day. Furthermore, emails can be collected during a similar time period by referring to the reception times of emails that the user previously rated as important. This allows the collection unit to collect emails at the optimal timing based on the user's behavioral patterns.

[0057] When analyzing emails, the analysis unit can determine the analysis priority by taking into account the user's current work situation. For example, if the user is in a meeting, emails related to the meeting can be analyzed first, and if the user is concentrating on a specific project, emails related to that project can be analyzed first. Also, if the user is on a business trip, emails related to the business trip destination can be analyzed first. This allows the analysis unit to perform analysis in the optimal order depending on the user's work situation.

[0058] When analyzing emails, the analysis unit can dynamically adjust the analysis algorithm based on past analysis results. For example, it can learn the characteristics of emails that have been previously determined to be fraudulent emails and adjust the analysis algorithm based on those characteristics. It can also learn the characteristics of emails that have been incorrectly determined to be fraudulent in the past and improve the analysis algorithm based on those characteristics. Furthermore, it can also improve the analysis accuracy for specific senders or keywords based on past analysis results. This allows the analysis unit to improve its analysis accuracy based on past analysis results.

[0059] When collecting emails, the collection unit can determine the priority of emails to be collected taking into account the user's geographical location information. For example, if the user is on a business trip, emails related to the business trip destination can be collected with priority, and if the user is in a specific region, emails related to that region can be collected with priority. Also, if the user is overseas, international emails can be collected with priority. This allows the collection unit to collect optimal emails based on the user's geographical location information.

[0060] When analyzing emails, the analysis unit can adjust the way the analysis results are presented depending on the user's level of expertise. For example, if the user is an expert, it can provide detailed analysis results using a lot of technical terminology, and if the user is a beginner, it can provide concise analysis results that avoid technical terminology. Also, if the user is an intermediate user, it can provide analysis results that include an appropriate amount of technical terminology. This allows the analysis unit to provide optimal analysis results depending on the user's level of expertise.

[0061] The processing flow of the first embodiment will be briefly explained below.

[0062] Step 1: The collection unit collects email information. For example, the collection unit can collect information such as email header information, link URLs, sender addresses, body content, and attachments. Step 2: The analysis unit analyzes the information collected by the collection unit. For example, the analysis unit can analyze whether the sender address of the email is forged, whether the content of the email body differs from that of regular business emails, and whether the attached file contains a virus. Step 3: The warning generator generates a warning message based on the analysis results obtained by the analyzer. For example, a warning message such as "This email may be spoofed. Please check the sender address and the contents of the email body" can be generated and notified to the recipient.

[0063] (Example 2) A system according to an embodiment of the present invention is a system for preventing business email compromise (BEC). This system uses a generation AI to detect fraudulent emails and warn the recipient. For example, the system analyzes a received email and determines whether it is likely to be fraudulent. If it is, it generates a warning message to warn the recipient. This allows the recipient to quickly respond to the fraudulent email. This ensures the safety of the recipient and prevents business email compromise (BEC). For example, if a company employee receives a fraudulent email, the system generates a warning message and notifies the employee, allowing for a quick response to the fraudulent email. Furthermore, by having the generation AI learn the characteristics of fraudulent emails, the accuracy of analysis will improve from the next time onwards, strengthening the security of the entire company.

[0064] An email spoofing prevention system according to an embodiment includes a collection unit, an analysis unit, and a warning generation unit. The collection unit collects email information. For example, the collection unit can collect email header information and linked URLs. The collection unit can also collect information such as the email sender address, the email body content, and attachments. The analysis unit analyzes the information collected by the collection unit. For example, the analysis unit determines whether the email sender address is spoofed. The analysis unit can also analyze whether the email body content differs from normal business emails. The analysis unit can also analyze whether the attachment contains a virus. The warning generation unit generates a warning message based on the analysis results obtained by the analysis unit. For example, the warning generation unit generates a warning message such as, "This email may be spoofed. Please check the sender address and the email body content." The warning generation unit can also notify the recipient of the generated warning message. This allows the email spoofing prevention system according to an embodiment to detect spoofed emails and alert the recipient.

[0065] The collection unit can collect email header information or linked URLs. For example, the collection unit collects email header information. Header information includes the sender's IP address, the date and time of sending, and the like. The collection unit can also collect linked URLs. For example, the collection unit extracts links included in the email body and collects their URLs. Furthermore, the collection unit can verify the reliability of the collected URLs. This allows the collection unit to collect detailed information about the email and increase the possibility of fraud.

[0066] The analysis unit can analyze the sender address, body content, and attachments of an email to determine the possibility of spoofing. The analysis unit, for example, analyzes the sender address of an email. Analysis of the sender address includes evaluating the reliability of the domain and checking against a blacklist. The analysis unit can also analyze the body content of the email. For example, the analysis unit extracts keywords from the body and analyzes the context. The analysis unit can also analyze attachments to the email. For example, the analysis unit verifies the format of the attachment and performs a virus scan. This allows the analysis unit to determine the possibility of spoofing an email with high accuracy.

[0067] The warning generation unit can generate a specific warning message if there is a high possibility of fraud. For example, if there is a high possibility of fraud, the warning generation unit generates a specific warning message such as, "This email may be fraudulent. Please check the sender address and the content of the email body." The warning generation unit can also notify the recipient of the generated warning message. For example, the warning generation unit sends the warning message to the recipient as a pop-up notification or an email notification. In this way, the warning generation unit can provide the recipient with a specific warning and encourage them to take prompt action.

[0068] The analysis unit can learn the characteristics of spoofed emails using the generation AI and use this information in subsequent analyses. The analysis unit, for example, uses the generation AI to learn the characteristics of spoofed emails. The generation AI can learn the sender address and body text patterns of spoofed emails and use these characteristics in analysis. For example, if a specific sender address or body text pattern is frequently seen in spoofed emails, the generation AI can learn these characteristics and use them in subsequent analyses. This allows the analysis unit to improve the accuracy of detecting spoofed emails.

[0069] The collection unit can periodically update the dataset and collect the latest spoofed email patterns. The collection unit, for example, periodically updates the dataset. Updating the dataset includes collecting the latest spoofed email patterns. For example, the collection unit collects the latest spoofed email patterns from public databases on the Internet or from corporate email servers. This allows the collection unit to collect the latest spoofed email patterns and improve analysis accuracy.

[0070] The analysis unit can improve the analysis accuracy based on the latest collected data set. The analysis unit improves the analysis accuracy based on, for example, the latest collected data set. The latest data set includes the latest patterns of spoofed emails. The analysis unit can adjust the analysis algorithm based on these patterns to improve the analysis accuracy. For example, the analysis unit retrains the generation AI using the latest data set to improve the analysis accuracy. This enables the analysis unit to more accurately detect spoofed emails.

[0071] The warning generation unit can notify the recipient of a warning message. The warning generation unit notifies the recipient of the generated warning message, for example. Notification methods include pop-up notification and email notification. For example, the warning generation unit displays the warning message as a pop-up notification on the recipient's screen. The warning generation unit can also send the warning message to the recipient as an email notification. This allows the warning generation unit to quickly notify the recipient of the warning and urge them to take action against the fraudulent email.

[0072] The collection unit can estimate the user's emotions and optimize the timing of email collection based on the estimated user emotions. The collection unit, for example, estimates the user's emotions. To estimate emotions, an emotion analysis algorithm is used. For example, the collection unit analyzes the user's facial expressions and voice data to estimate emotions. Next, the collection unit optimizes the timing of email collection based on the estimated user emotions. For example, if the user is feeling stressed, email collection can be delayed and emails can be collected when the user is relaxed. Also, if the user is concentrating, email collection can be temporarily stopped and emails can be collected when the user's concentration is broken. Furthermore, if the user is in a hurry, only important emails can be collected as a priority and other emails can be postponed. This allows the collection unit to collect emails at the optimal timing according to the user's emotions.

[0073] The collection unit can analyze past email history when collecting emails and select the optimal collection method. The collection unit, for example, analyzes past email history when collecting emails. The analysis of past email history includes the type of history data and an analysis algorithm. For example, the collection unit collects emails by avoiding time periods when many fraudulent emails have been sent in the past. The collection unit can also prioritize collecting emails from specific senders based on the past email history. Furthermore, the collection unit can prioritize collecting emails containing specific keywords based on the past email history. This allows the collection unit to select the optimal collection method based on the past email history and collect emails efficiently.

[0074] The collection unit can filter emails based on the user's current work situation and areas of interest when collecting emails. For example, the collection unit grasps the user's current work situation and areas of interest when collecting emails. The understanding of the work situation includes the type of work and its progress. For example, if the user is in a meeting, the collection unit prioritizes collecting only emails related to the meeting. Also, if the user is concentrating on a specific project, the collection unit can prioritize collecting emails related to the project. Furthermore, the collection unit can prioritize collecting related emails based on the user's areas of interest. For example, the collection unit prioritizes collecting emails related to the user's areas of interest. This allows the collection unit to prioritize collecting highly relevant emails according to the user's work situation and areas of interest.

[0075] The collection unit can evaluate the reliability of the sender of an email when collecting emails and prioritize collecting emails with low reliability. The collection unit, for example, evaluates the reliability of the sender when collecting emails. The evaluation of the reliability of the sender includes the reliability evaluation of the domain and past sending history. For example, the collection unit prioritizes collecting emails with unknown sender addresses and sends them to the analysis unit. The collection unit can also prioritize collecting emails from newly registered sender domains. Furthermore, the collection unit can also prioritize collecting emails from sender IP addresses that have been reported as spam in the past. This allows the collection unit to prioritize collecting emails with low reliability and improve the accuracy of detecting spoofed emails.

[0076] The collection unit can estimate the user's emotions and set the priority of emails to be collected based on the estimated user emotions. The collection unit, for example, estimates the user's emotions. To estimate emotions, an emotion analysis algorithm is used. For example, the collection unit analyzes the user's facial expressions and voice data to estimate emotions. Next, the collection unit sets the priority of emails to be collected based on the estimated user emotions. For example, if the user is feeling stressed, emails of low importance can be postponed. Also, if the user is relaxed, all emails can be collected equally. Furthermore, if the user is in a hurry, only important emails can be collected preferentially. In this way, the collection unit can collect important emails preferentially according to the user's emotions.

[0077] When collecting emails, the collection unit can prioritize collecting highly relevant emails by taking into account the user's geographical location information. For example, the collection unit considers the user's geographical location information when collecting emails. Collection of geographical location information includes GPS data and IP addresses. For example, when the user is on a business trip, the collection unit prioritizes collecting emails related to the business trip destination. Furthermore, when the user is in a specific region, the collection unit can also prioritize collecting emails related to that region. Furthermore, when the user is overseas, the collection unit can prioritize collecting international emails. This allows the collection unit to prioritize collecting highly relevant emails based on the user's geographical location information.

[0078] The collection unit can analyze the user's social media activity when collecting emails and collect related emails. The collection unit, for example, analyzes the user's social media activity when collecting emails. The analysis of social media activity includes the content of posts and the frequency of activity. For example, the collection unit preferentially collects emails related to topics mentioned by the user on social media. The collection unit can also collect related emails by referring to the activities of the user's friends on social media. Furthermore, the collection unit can analyze the content of the user's posts on social media and collect related emails. This allows the collection unit to preferentially collect related emails based on the user's social media activity.

[0079] The collection unit can customize the collection method by reflecting the user's past feedback when collecting emails. For example, the collection unit reflects the user's past feedback when collecting emails. Reflecting past feedback includes the type of feedback and the reflection method. For example, the collection unit prioritizes collecting emails that the user has previously rated as important. The collection unit can also avoid collecting emails that the user has previously rated as spam. Furthermore, the collection unit can customize the collection method based on the user's past feedback. This allows the collection unit to select the optimal collection method based on the user's past feedback.

[0080] The analysis unit can estimate the user's emotions and optimize the method of expressing the analysis based on the estimated user's emotions. The analysis unit, for example, estimates the user's emotions. To estimate the emotions, an emotion analysis algorithm is used. For example, the analysis unit analyzes the user's facial expressions and voice data to estimate the emotions. Next, the analysis unit optimizes the method of expressing the analysis based on the estimated user's emotions. For example, if the user is nervous, a simple and highly visible analysis result can be provided. Also, if the user is relaxed, a detailed analysis result can be provided. Furthermore, if the user is in a hurry, an analysis result that focuses on the main points can be provided. This allows the analysis unit to provide the optimal analysis result according to the user's emotions.

[0081] The analysis unit can adjust the level of detail of the analysis based on the importance of the email during analysis. The analysis unit, for example, evaluates the importance of the email during analysis. The evaluation of the importance of the email includes an importance score and evaluation criteria. For example, the analysis unit performs a detailed analysis on emails with high importance. The analysis unit can also perform a simplified analysis on emails with low importance. Furthermore, the analysis unit can dynamically adjust the level of detail of the analysis depending on the importance. This allows the analysis unit to provide optimal analysis results depending on the importance of the email.

[0082] The analysis unit can apply different analysis algorithms depending on the category of the email during analysis. For example, the analysis unit classifies the category of the email during analysis. The classification of email categories includes business email, private email, spam email, etc. For example, the analysis unit applies a business-specific analysis algorithm to business email. The analysis unit can also apply a private-specific analysis algorithm to private email. Furthermore, the analysis unit can apply a spam-specific analysis algorithm to spam email. This allows the analysis unit to apply the optimal analysis algorithm depending on the category of the email.

[0083] The analysis unit can improve the accuracy of the analysis by referring to the user's past analysis results during analysis. The analysis unit, for example, refers to the user's past analysis results during analysis. Referring to past analysis results includes methods for saving and referring to analysis results. For example, the analysis unit improves the accuracy of the analysis by referring to analysis results that the user previously rated as important. The analysis unit can also improve the accuracy of the analysis by referring to analysis results that the user previously rated as incorrect. Furthermore, the analysis unit can adjust the analysis algorithm based on the user's past analysis results. This allows the analysis unit to improve the accuracy of the analysis based on the user's past analysis results.

[0084] The analysis unit can estimate the user's emotions and optimize the length of the analysis based on the estimated user's emotions. The analysis unit, for example, estimates the user's emotions. To estimate the emotions, an emotion analysis algorithm is used. For example, the analysis unit analyzes the user's facial expressions and voice data to estimate the emotions. Next, the analysis unit optimizes the length of the analysis based on the estimated user's emotions. For example, if the user is in a hurry, the analysis unit can provide a short and to-the-point analysis result. If the user is relaxed, the analysis unit can provide a detailed analysis result. Furthermore, if the user is excited, the analysis unit can provide an analysis result with visually stimulating effects. In this way, the analysis unit can provide an analysis result of optimal length according to the user's emotions.

[0085] During analysis, the analysis unit can determine the priority of analysis based on the time when the email was sent. For example, the analysis unit evaluates the time when the email was sent during analysis. The evaluation of the time when the email was sent includes the date and time of sending and the frequency of sending. For example, the analysis unit prioritizes analyzing recently sent emails. The analysis unit can also prioritize analyzing emails sent during important time periods. Furthermore, the analysis unit can prioritize analyzing emails sent during time periods specified by the user. This allows the analysis unit to perform analysis in the optimal order depending on the time when the email was sent.

[0086] The analysis unit can adjust the order of analysis based on the relevance of emails during analysis. The analysis unit, for example, evaluates the relevance of emails during analysis. The evaluation of relevance includes a relevance score and evaluation criteria. For example, the analysis unit prioritizes analysis of emails related to the user's work. The analysis unit can also prioritize analysis of emails related to the user's areas of interest. Furthermore, the analysis unit can prioritize analysis of highly relevant emails based on the user's past feedback. This allows the analysis unit to perform analysis in an optimal order depending on the relevance of emails.

[0087] The analysis unit can adjust the use of technical terms in the analysis according to the user's level of expertise during analysis. The analysis unit, for example, evaluates the user's level of expertise during analysis. The evaluation of the level of expertise includes the user's occupation and past learning history. For example, if the user is an expert, the analysis unit can provide analysis results that make heavy use of technical terms. Also, if the user is a beginner, the analysis unit can provide analysis results that avoid technical terms. Furthermore, the analysis unit can adjust the way the analysis results are expressed according to the user's level of expertise. This allows the analysis unit to provide optimal analysis results according to the user's level of expertise.

[0088] The warning generation unit can estimate the user's emotion and optimize the way in which the warning message is expressed based on the estimated user's emotion. The warning generation unit, for example, estimates the user's emotion. To estimate the emotion, an emotion analysis algorithm is used. For example, the warning generation unit analyzes the user's facial expressions and voice data to estimate the emotion. Next, the warning generation unit optimizes the way in which the warning message is expressed based on the estimated user's emotion. For example, if the user is nervous, a simple, highly visible warning message can be provided. Also, if the user is relaxed, a detailed warning message can be provided. Furthermore, if the user is in a hurry, a warning message that focuses on the main points can be provided. In this way, the warning generation unit can provide an optimal warning message according to the user's emotion.

[0089] When generating a warning, the warning generation unit can adjust the level of detail of the warning message based on the level of possibility of fraud. For example, when there is a high possibility of fraud, the warning generation unit provides a detailed warning message. For example, it generates a detailed warning message such as, "This email is very likely to be fraudulent. Please carefully check the sender address and the content of the email body." Furthermore, when there is a low possibility of fraud, it can also provide a simplified warning message. For example, it generates a simplified warning message such as, "This email may be fraudulent. Please check carefully." Furthermore, the warning generation unit can dynamically adjust the level of detail of the warning message depending on the possibility of fraud. This allows the warning generation unit to provide a warning message with optimal level of detail depending on the possibility of fraud.

[0090] When generating a warning, the warning generation unit can generate different warning messages depending on the category of the email. The warning generation unit, for example, classifies email categories. Email categories include business email, private email, spam email, etc. For example, the warning generation unit generates a business-specific warning message for business email. For example, it generates a warning message such as, "This business email may be spoofed. Please check the sender address and the content of the email body." The warning generation unit can also generate a private-specific warning message for private email. For example, it generates a warning message such as, "This private email may be spoofed. Please check carefully." Furthermore, the warning generation unit can also generate a spam-specific warning message for spam email. This allows the warning generation unit to provide the optimal warning message depending on the category of the email.

[0091] When generating a warning, the warning generation unit can improve the accuracy of the warning message by referring to the user's past reactions to warning messages. The warning generation unit, for example, refers to the user's past reactions to warning messages. Referring to past reactions to warning messages includes the type of reaction and the reference method. For example, the warning generation unit improves the accuracy of the warning message by referring to warning messages that the user previously rated as important. The warning generation unit can also improve the accuracy of the warning message by referring to warning messages that the user previously rated as incorrect. Furthermore, the warning generation unit can adjust the warning message generation algorithm based on the user's past reactions to warning messages. In this way, the warning generation unit can improve the accuracy of the warning message based on the user's past reactions.

[0092] The warning generation unit can estimate the user's emotion and optimize the length of the warning message based on the estimated user's emotion. The warning generation unit, for example, estimates the user's emotion. To estimate the emotion, an emotion analysis algorithm is used. For example, the warning generation unit analyzes the user's facial expressions and voice data to estimate the emotion. Next, the warning generation unit optimizes the length of the warning message based on the estimated user's emotion. For example, if the user is nervous, a short and to-the-point warning message can be provided. Alternatively, if the user is relaxed, a detailed warning message can be provided. Furthermore, if the user is in a hurry, a quick and concise warning message can be provided. In this way, the warning generation unit can provide a warning message of optimal length according to the user's emotion.

[0093] When generating an alert, the alert generation unit can determine the priority of the alert message based on the time when the email was sent. The alert generation unit, for example, evaluates the time when the email was sent. The evaluation of the time when the email was sent includes the date and time of sending and the frequency of sending. For example, the alert generation unit can generate an alert message with priority for emails sent recently. The alert generation unit can also generate an alert message with priority for emails sent during an important time period. Furthermore, the alert generation unit can generate an alert message with priority for emails sent during a time period specified by the user. This allows the alert generation unit to provide alert messages in the optimal order depending on the time when the email was sent.

[0094] The warning generation unit can adjust the order of warning messages based on the relevance of emails when generating a warning. The warning generation unit, for example, evaluates the relevance of emails. The evaluation of relevance includes a relevance score and an evaluation criterion. For example, the warning generation unit can generate warning messages with priority for emails related to the user's work. The warning generation unit can also generate warning messages with priority for emails related to the user's areas of interest. Furthermore, the warning generation unit can generate warning messages with priority for highly relevant emails based on the user's past feedback. This allows the warning generation unit to provide warning messages in an optimal order according to the relevance of the emails.

[0095] When generating a warning, the warning generation unit can adjust the use of technical terms in the warning message depending on the user's level of expertise. The warning generation unit, for example, evaluates the user's level of expertise. The evaluation of the level of expertise includes the user's occupation and past learning history. For example, if the user is an expert, the warning generation unit provides a warning message that uses a lot of technical terms. Also, if the user is a beginner, the warning generation unit can provide a warning message that avoids technical terms. Furthermore, the warning generation unit can adjust the way the warning message is expressed depending on the user's level of expertise. This allows the warning generation unit to provide an optimal warning message depending on the user's level of expertise. === Hard Collateral 1-1 === Each of the multiple elements including the collection unit, analysis unit, and warning generation unit described above is realized, for example, by at least one of the smart device 14 and the data processing device 12. For example, the collection unit can collect email information using the computer 36 or camera 42 of the smart device 14. The analysis unit is realized, for example, by the specific processing unit 290 of the data processing device 12 and analyzes the collected information. The warning generation unit is realized, for example, by the control unit 46A of the smart device 14 and generates a warning message based on the analysis result and notifies the recipient. === Hard Collateral 1-2 === Each of the multiple elements including the collection unit, analysis unit, and warning generation unit described above is realized, for example, by at least one of the smart glasses 214 and the data processing device 12. For example, the collection unit can collect email information using the computer 36 or camera 42 of the smart glasses 214. The analysis unit is realized, for example, by the specific processing unit 290 of the data processing device 12 and analyzes the collected information. The warning generation unit is realized, for example, by the control unit 46A of the smart glasses 214 and generates a warning message based on the analysis result and notifies the recipient. === Hard Collateral 1-3 === Each of the multiple elements including the above-mentioned collection unit, analysis unit, and warning generation unit is realized, for example, by at least one of the headset type terminal 314 and the data processing device 12. For example, the collection unit can collect email information using the computer 36 or camera 42 of the headset type terminal 314. The analysis unit is realized, for example, by the specific processing unit 290 of the data processing device 12, and analyzes the collected information. The warning generation unit is realized, for example, by the control unit 46A of the headset type terminal 314, and generates a warning message based on the analysis result and notifies the recipient. === Hard Collateral 1-4 === Each of the multiple elements including the collection unit, analysis unit, and warning generation unit described above is realized, for example, by at least one of the robot 414 and the data processing device 12. For example, the collection unit can collect email information using the computer 36 or camera 42 of the robot 414. The analysis unit is realized, for example, by the specific processing unit 290 of the data processing device 12, and analyzes the collected information. The warning generation unit is realized, for example, by the control unit 46A of the robot 414, and generates a warning message based on the analysis result and notifies the recipient.

[0096] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0097] The analysis unit can estimate the user's emotions and determine the priority of analysis based on the estimated user emotions. For example, if the user is feeling stressed, emails of high importance can be analyzed first, and if the user is relaxed, all emails can be analyzed equally. Also, if the user is in a hurry, emails that require a quick response can be analyzed first. This allows the analysis unit to perform analysis in the optimal order according to the user's emotions.

[0098] When collecting emails, the collection unit can analyze the user's past behavioral patterns and determine the optimal collection timing. For example, if the user frequently checks emails during a specific time period, emails can be collected according to that time period. Also, if the user receives a lot of emails on a specific day of the week, collection can be strengthened according to that day. Furthermore, emails can be collected during a similar time period by referring to the reception times of emails that the user previously rated as important. This allows the collection unit to collect emails at the optimal timing based on the user's behavioral patterns.

[0099] The warning generation unit can estimate the user's emotion and adjust the tone of the warning message based on the estimated user's emotion. For example, if the user is nervous, the warning message can be provided in a calm tone, and if the user is relaxed, the warning message can be provided in a detailed tone. Also, if the user is in a hurry, the warning message can be provided in a concise and to-the-point tone. In this way, the warning generation unit can provide a warning message with an optimal tone depending on the user's emotion.

[0100] When analyzing emails, the analysis unit can determine the analysis priority by taking into account the user's current work situation. For example, if the user is in a meeting, emails related to the meeting can be analyzed first, and if the user is concentrating on a specific project, emails related to that project can be analyzed first. Also, if the user is on a business trip, emails related to the business trip destination can be analyzed first. This allows the analysis unit to perform analysis in the optimal order depending on the user's work situation.

[0101] The collection unit can estimate the user's emotions when collecting emails and filter the emails to be collected based on the estimated user emotions. For example, if the user is feeling stressed, emails of low importance can be filtered out, and if the user is relaxed, all emails can be collected. Also, if the user is in a hurry, only important emails can be collected preferentially. This allows the collection unit to collect the most appropriate emails according to the user's emotions.

[0102] When analyzing emails, the analysis unit can dynamically adjust the analysis algorithm based on past analysis results. For example, it can learn the characteristics of emails that have been previously determined to be fraudulent emails and adjust the analysis algorithm based on those characteristics. It can also learn the characteristics of emails that have been incorrectly determined to be fraudulent in the past and improve the analysis algorithm based on those characteristics. Furthermore, it can also improve the analysis accuracy for specific senders or keywords based on past analysis results. This allows the analysis unit to improve its analysis accuracy based on past analysis results.

[0103] The warning generation unit can estimate the user's emotion and optimize the display method of the warning message based on the estimated user's emotion. For example, if the user is nervous, the warning message can be displayed in a visually calm color, and if the user is relaxed, the warning message can be displayed with detailed information. Also, if the user is in a hurry, the warning message can be displayed in a concise and highly visible manner. In this way, the warning generation unit can provide the warning message in the optimal display method according to the user's emotion.

[0104] When collecting emails, the collection unit can determine the priority of emails to be collected taking into account the user's geographical location information. For example, if the user is on a business trip, emails related to the business trip destination can be collected with priority, and if the user is in a specific region, emails related to that region can be collected with priority. Also, if the user is overseas, international emails can be collected with priority. This allows the collection unit to collect optimal emails based on the user's geographical location information.

[0105] When analyzing emails, the analysis unit can adjust the way the analysis results are presented depending on the user's level of expertise. For example, if the user is an expert, it can provide detailed analysis results using a lot of technical terminology, and if the user is a beginner, it can provide concise analysis results that avoid technical terminology. Also, if the user is an intermediate user, it can provide analysis results that include an appropriate amount of technical terminology. This allows the analysis unit to provide optimal analysis results depending on the user's level of expertise.

[0106] The warning generation unit can estimate the user's emotion and optimize the length of the warning message based on the estimated user's emotion. For example, if the user is nervous, a short and to-the-point warning message can be provided, and if the user is relaxed, a detailed warning message can be provided. Also, if the user is in a hurry, a quick and concise warning message can be provided. In this way, the warning generation unit can provide a warning message of optimal length according to the user's emotion.

[0107] The processing flow of the second embodiment will be briefly explained below.

[0108] Step 1: The collection unit collects email information. For example, the collection unit can collect information such as email header information, link URLs, sender addresses, body content, and attachments. Step 2: The analysis unit analyzes the information collected by the collection unit. For example, the analysis unit can analyze whether the sender address of the email is forged, whether the content of the email body differs from that of regular business emails, and whether the attached file contains a virus. Step 3: The warning generator generates a warning message based on the analysis results obtained by the analyzer. For example, a warning message such as "This email may be spoofed. Please check the sender address and the contents of the email body" can be generated and notified to the recipient.

[0109] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0110] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (registered trademark) (Internet search engine).<URL: https: / / openai.com / blog / chatgpt> Examples of generative AIs include the data generation model 58, such as a neural network model (e.g., a neural network model), and a neural network model (e.g., a neural network model). The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating speech, text data indicating text, and image data indicating an image is also input to the data generation model 58. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specification processing unit 290 performs the above-mentioned specification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0111] Furthermore, the processing by the data processing system 10 described above is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart device 14, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart device 14. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information necessary for processing from the smart device 14 or an external device, and the smart device 14 acquires or collects information necessary for processing from the data processing device 12 or an external device.

[0112] The correspondence between each part and the device or control part is not limited to the example described above, and various modifications are possible.

[0113] [Second embodiment] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0114] 3, the data processing system 210 includes the data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0115] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0116] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0117] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0118] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0119] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0120] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0121] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0122] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate a user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, but is not limited to these examples. Furthermore, the estimation and prediction of emotion also includes, for example, emotion analysis.

[0123] In the smart glasses 214, the specific processing is performed by the processor 46. A specific processing program 60 is stored in the storage 50. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. The smart glasses 214 also have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can perform processing similar to that of the specific processing unit 290 using these models.

[0124] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0125] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0126] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AI other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0127] The data processing system 210 according to the second embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 210 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart glasses 214, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart glasses 214. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the smart glasses 214 or an external device, etc., and the smart glasses 214 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0128] The correspondence between each part and the device or control part is not limited to the example described above, and various modifications are possible.

[0129] [Third embodiment] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[0130] 5, the data processing system 310 includes the data processing device 12 and a headset terminal 314. An example of the data processing device 12 is a server.

[0131] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0132] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[0133] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0134] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0135] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0136] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0137] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0138] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate a user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, but is not limited to these examples. Furthermore, the estimation and prediction of emotion also includes, for example, emotion analysis.

[0139] In the headset type terminal 314, the identification process is performed by the processor 46. A identification program 60 is stored in the storage 50. The processor 46 reads the identification program 60 from the storage 50 and executes the read identification program 60 on the RAM 48. The identification process is realized by the processor 46 operating as a control unit 46A in accordance with the identification program 60 executed on the RAM 48. Note that the headset type terminal 314 has a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can also perform processing similar to that of the identification processing unit 290 using these models.

[0140] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0141] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0142] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AI other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0143] The data processing system 310 according to the third embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 310 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the headset type terminal 314, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the headset type terminal 314. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the headset type terminal 314 or an external device, etc., and the headset type terminal 314 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0144] The correspondence between each part and the device or control part is not limited to the example described above, and various modifications are possible.

[0145] [Fourth embodiment] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[0146] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0147] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0148] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[0149] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0150] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS image sensor or a CCD image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0151] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0152] The control object 443 includes a display device, LEDs in the eyes, and motors that drive the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[0153] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0154] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0155] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate a user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, but is not limited to these examples. Furthermore, the estimation and prediction of emotion also includes, for example, emotion analysis.

[0156] In the robot 414, the processor 46 performs the identification process. The storage 50 stores the identification program 60. The processor 46 reads the identification program 60 from the storage 50 and executes the read identification program 60 on the RAM 48. The identification process is realized by the processor 46 operating as the control unit 46A in accordance with the identification program 60 executed on the RAM 48. The robot 414 also has a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can perform the same process as the identification processing unit 290 using these models.

[0157] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0158] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0159] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AI other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0160] The data processing system 410 according to the fourth embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 410 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the robot 414, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the robot 414. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the robot 414 or an external device, etc., and the robot 414 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0161] The correspondence between each part and the device or control part is not limited to the example described above, and various modifications are possible.

[0162] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[0163] FIG. 9 illustrates an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and behaviors arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion encompasses both emotions and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[0164] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[0165] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[0166] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is expressed, and when they approach the ideal, a state of pleasure is expressed. Emotions can also be created for robots, cars, and motorcycles, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is expressed, and when they approach the ideal, a state of pleasure is expressed. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on speech emotion recognition and brain physiological signal analysis systems for emotions, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the "reaction" domain, where sensation is dominant. The right half of the emotion map lists emotions belonging to the "situation" domain, where situational awareness is dominant.

[0167] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[0168] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[0169] In the above embodiment, an example was given in which a specific process is performed by one computer 22, but the technology disclosed herein is not limited to this, and distributed processing of the specific process may be performed by multiple computers including computer 22.

[0170] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[0171] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[0172] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[0173] The hardware resource for executing a specific process can be any of the following types of processors: A processor, for example, is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. A processor also includes a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[0174] The hardware resource that executes the specific process may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific process may be a single processor.

[0175] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[0176] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[0177] In the above example, the first to fourth embodiments have been described separately, but some or all of these embodiments may be combined. The smart device 14, smart glasses 214, headset terminal 314, and robot 414 are merely examples, and they may be combined, or other devices may be used. In the above example, the first and second embodiments have been described separately, but they may be combined.

[0178] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[0179] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[0180] [Explanation of symbols]

[0181] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot

Claims

1. a collection unit that collects email information; an analysis unit that analyzes the information collected by the collection unit; a warning generation unit that generates a warning message based on the analysis result obtained by the analysis unit; Equipped with A system characterized by:

2. The collecting unit Harvesting email header information or linked URLs The system of claim 1 .

3. The analysis unit Analyzes the sender address, body content, and attachments of emails to determine whether they are likely to be fraudulent The system of claim 1 .

4. The warning generation unit Generate specific warning messages when fraud is likely The system of claim 1 .

5. The analysis unit Generative AI learns the characteristics of fraudulent emails and uses this information for future analyses The system of claim 1 .

6. The collecting unit Regularly update the dataset to capture the latest spoofed email patterns The system of claim 1 .

7. The analysis unit Improve analysis accuracy based on the most recent datasets collected The system of claim 1 .

8. The warning generation unit Send a warning message to the recipient The system of claim 1 .

Images