System

Abstract

An object of a system according to an embodiment is to efficiently identify and visualize vulnerabilities and risks in the entire IT infrastructure of a company.SOLUTION: A system according to an embodiment includes a scan unit, a visualization unit, a countermeasure presentation unit, and a regular scan unit. The scanning unit scans the entire IT infrastructure of the company. The visualization unit visualizes the vulnerability and the risk specified by the scanning unit. The countermeasure presentation unit presents a countermeasure based on the vulnerability and the risk visualized by the visualization unit. The periodic scanning unit periodically performs scanning by the scanning unit.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] Conventional technologies make it difficult to efficiently identify and visualize vulnerabilities and risks across a company's entire IT infrastructure, and there is room for improvement.

[0005] The system according to the embodiment aims to efficiently identify and visualize vulnerabilities and risks in the entire IT infrastructure of a company. [Means for solving the problem]

[0006] A system according to an embodiment includes a scanning unit, a visualization unit, a countermeasure presentation unit, and a regular scanning unit. The scanning unit scans the entire IT infrastructure of a company. The visualization unit visualizes vulnerabilities and risks identified by the scanning unit. The countermeasure presentation unit presents countermeasures based on the vulnerabilities and risks visualized by the visualization unit. The regular scanning unit periodically performs scans using the scanning unit. [Effects of the Invention]

[0007] The system according to the embodiment can efficiently identify and visualize vulnerabilities and risks across a company's entire IT infrastructure. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10] 1 shows an emotion map onto which multiple emotions are mapped. DETAILED DESCRIPTION OF THE INVENTION

[0009] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0010] First, the terms used in the following description will be explained.

[0011] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, the processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), an APU (Accelerated Processing Unit), or a TPU (Tensor Processing Unit).

[0012] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0013] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0014] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), and Bluetooth (registered trademark).

[0015] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0016] [First embodiment] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0017] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0018] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0019] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0020] The reception device 38 includes a touch panel 38A and a microphone 38B, and receives user input. The touch panel 38A detects contact with a pointer (for example, a pen or a finger) to receive user input by the touch of the pointer. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 (see FIG. 2) acquires the data indicating the user input.

[0021] Output device 40 includes a display 40A and a speaker 40B, and presents data to a user by outputting the data in a form of expression that the user can perceive (e.g., audio and / or text). Display 40A displays visible information such as text and images in accordance with instructions from processor 46. Speaker 40B outputs audio in accordance with instructions from processor 46. Camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0022] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0023] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0024] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0025] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate a user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, but is not limited to these examples. Furthermore, the estimation and prediction of emotion also includes, for example, emotion analysis.

[0026] In the smart device 14, the specific processing is performed by the processor 46. The storage 50 stores a specific processing program 60. The specific processing program 60 is used together with the specific processing program 56 by the data processing system 10. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. Note that the smart device 14 has a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can also perform processing similar to that of the specific processing unit 290 using these models.

[0027] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device (e.g., a generation server) may have the data generation model 58. In this case, the data processing device 12 obtains a processing result (prediction result, etc.) using the data generation model 58 by communicating with the server device having the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device owned by a user (e.g., a mobile phone, a robot, a home appliance, etc.). Next, an example of processing by the data processing system 10 according to the first embodiment will be described.

[0028] (Example 1) An IT security analysis system according to an embodiment of the present invention scans a company's entire IT infrastructure, and uses a generative AI to identify and visualize vulnerabilities and risks and propose specific countermeasures. This allows the company to quickly and accurately address evolving cyberthreats. For example, the IT security analysis system scans the entire IT infrastructure of a company. For example, it scans the entire network and identifies vulnerabilities in each device and system. The IT security analysis system then visualizes the identified vulnerabilities and risks. The generative AI displays the identified vulnerabilities in a visual format, such as a graph or chart, allowing administrators to understand them at a glance. For example, it displays the location of vulnerabilities on a network map to clearly identify the problem area. The IT security analysis system then proposes optimal countermeasures for the identified vulnerabilities. The generative AI proposes optimal countermeasures for the identified vulnerabilities. Examples of such countermeasures include changing firewall settings, updating software, and applying patches. Finally, the IT security analysis system performs regular scans and provides countermeasures against new threats. This allows companies to maintain the latest security measures. For example, a scan can be performed once a week, and if a new vulnerability is discovered, countermeasures can be immediately proposed. This allows the IT security analysis system to automatically analyze a company's IT security, visualize vulnerabilities and risks, and suggest specific countermeasures. For example, it can quickly and accurately scan a company's entire IT infrastructure and identify vulnerabilities and risks. Administrators can also grasp the location of vulnerabilities and risks at a glance, allowing them to quickly take appropriate countermeasures. Furthermore, regular scans ensure that security measures are always kept up to date.

[0029] An IT security analysis system according to an embodiment includes a scanning unit, a visualization unit, a countermeasure presentation unit, and a regular scanning unit. The scanning unit scans the entire IT infrastructure of a company. For example, the scanning unit scans the entire network to identify vulnerabilities in each device and system. The scanning unit may use methods such as port scanning, vulnerability scanning, and malware scanning. The scanning unit may also use a generation AI to analyze the scan results and identify vulnerabilities and risks. The visualization unit visualizes the vulnerabilities and risks identified by the scanning unit. For example, the visualization unit displays the identified vulnerabilities in a visual format such as a graph or chart. The visualization unit may also use a generation AI to visually display the identified vulnerabilities. For example, the visualization unit displays the location of vulnerabilities on a network map to clarify which part is at fault. The countermeasure presentation unit presents specific countermeasures based on the vulnerabilities and risks visualized by the visualization unit. For example, the countermeasure presentation unit proposes optimal countermeasures for the identified vulnerabilities. The countermeasure presentation unit may also use a generation AI to propose optimal countermeasures for the identified vulnerabilities. For example, the countermeasure presentation unit proposes firewall setting changes, software updates, patch applications, etc. The periodic scanning unit performs regular scans using a scanning unit. The periodic scanning unit performs scans, for example, once a week, and immediately proposes countermeasures if a new vulnerability is discovered. The periodic scanning unit can also perform regular scans using a generative AI and propose countermeasures for new vulnerabilities. As a result, the IT security analysis system according to the embodiment can automatically analyze a company's IT security, visualize vulnerabilities and risks, and propose specific countermeasures. For example, it can quickly and accurately scan a company's entire IT infrastructure and identify vulnerabilities and risks. Furthermore, administrators can grasp the location of vulnerabilities and risks at a glance and quickly take appropriate countermeasures. Furthermore, regular scanning allows security measures to be kept up to date.

[0030] The scanning unit can scan the entire network and identify vulnerabilities in each device and system. For example, the scanning unit can scan the entire network and identify vulnerabilities in each device and system. For example, the scanning unit can use a port scan to identify open ports on the network and detect vulnerabilities. The scanning unit can also use a vulnerability scan to identify software and systems with known vulnerabilities. Furthermore, the scanning unit can also use a malware scan to detect malware on the network. In this way, by scanning the entire network, vulnerabilities in each device and system can be identified. Some or all of the above-mentioned processing in the scanning unit may be performed using the generation AI, or may be performed without using the generation AI. For example, the scanning unit can input the results of a scan of the entire network into the generation AI, which can identify vulnerabilities.

[0031] The visualization unit can display the identified vulnerabilities in a visual format such as a graph or chart. For example, the visualization unit displays the identified vulnerabilities in a visual format such as a graph or chart. For example, the visualization unit can display the importance of each vulnerability using a bar graph. The visualization unit can also display the percentage of each vulnerability type using a pie chart. Furthermore, the visualization unit can also display the trend of the vulnerability by time of discovery using a line graph. In this way, by visually displaying the identified vulnerabilities, the administrator can understand them at a glance. Some or all of the above-mentioned processing in the visualization unit may be performed using the generation AI, or may be performed without using the generation AI. For example, the visualization unit can input data of the identified vulnerabilities into the generation AI, which then displays them in a visual format.

[0032] The countermeasure presentation unit can propose countermeasures for the identified vulnerability. The countermeasure presentation unit can propose, for example, the optimal countermeasure for the identified vulnerability. The countermeasure presentation unit can propose, for example, a change to firewall settings. The countermeasure presentation unit can also propose software updates. Furthermore, the countermeasure presentation unit can also propose patch applications. This allows for the optimal countermeasure for the identified vulnerability to be proposed, thereby enabling a prompt and accurate response. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without the generation AI. For example, the countermeasure presentation unit can input data on the identified vulnerability into the generation AI, which then proposes the optimal countermeasure.

[0033] The regular scanning unit performs regular scans and can immediately propose countermeasures if a new vulnerability is discovered. The regular scanning unit performs scans, for example, once a week and immediately proposes countermeasures if a new vulnerability is discovered. The regular scanning unit can also perform scans daily, for example, to always maintain the latest security measures. The regular scanning unit can also perform scans monthly to regularly check the security status. In this way, by performing regular scans, the latest security measures can always be maintained. Some or all of the above-mentioned processing in the regular scanning unit may be performed using or without the generation AI. For example, the regular scanning unit can input scan results into the generation AI, which can then propose countermeasures for new vulnerabilities.

[0034] The scanning unit can improve the accuracy of the scan by referring to past scan results. For example, the scanning unit can check whether a specific vulnerability has recurred based on past scan results. For example, the scanning unit can prioritize scanning areas where problems frequently occur based on past scan results. The scanning unit can also analyze past scan results and optimize the scan algorithm. In this way, the accuracy of the scan is improved by referring to past scan results. Some or all of the above-mentioned processing in the scanning unit may be performed using or without the generation AI. For example, the scanning unit can input past scan results into the generation AI, which can improve the accuracy of the scan.

[0035] The scanning unit can analyze network traffic patterns and select the optimal scanning method. For example, the scanning unit selects a time period with low network traffic to perform a scan. For example, the scanning unit can analyze traffic patterns and focus scanning on specific devices or systems. Furthermore, if the scanning unit detects a traffic abnormality, it can prioritize scanning that location. In this way, the optimal scanning method can be selected by analyzing network traffic patterns. Some or all of the above-mentioned processing in the scanning unit may be performed using or without the generation AI. For example, the scanning unit can input network traffic data into the generation AI, which can select the optimal scanning method.

[0036] The scanning unit can determine the scanning priority based on the usage status of each device. For example, the scanning unit prioritizes scanning of frequently used devices. For example, the scanning unit can also prioritize scanning of devices that are performing important tasks. The scanning unit can also prioritize scanning of devices that have previously experienced problems. This enables efficient scanning by determining the scanning priority based on the usage status of each device. Some or all of the above-described processing in the scanning unit may be performed using or without the generation AI. For example, the scanning unit can input usage status data of each device into the generation AI, which then determines the scanning priority.

[0037] The scanning unit can select scan targets taking geographical location information into consideration. For example, the scanning unit prioritizes scanning of a company's major bases. For example, the scanning unit can also scan geographically distant bases to grasp the overall security situation. The scanning unit can also prioritize scanning devices in a specific region in response to a threat occurring in that region. This allows optimal selection of scan targets by taking geographical location information into consideration. Some or all of the above-described processing in the scanning unit may be performed using or without the generation AI. For example, the scanning unit can input geographical location information data into the generation AI, which then selects scan targets.

[0038] The scanning unit can analyze social media activity to identify related vulnerabilities. For example, the scanning unit can analyze activity on a company's official account to identify related vulnerabilities. For example, the scanning unit can analyze employees' social media activity to identify the risk of information leakage. The scanning unit can also collect threat information on social media to identify related vulnerabilities. In this way, related vulnerabilities can be identified by analyzing social media activity. Some or all of the above-described processing in the scanning unit may be performed using or without the generation AI. For example, the scanning unit can input social media activity data into the generation AI, which then identifies related vulnerabilities.

[0039] The scanning unit can customize the scanning method by reflecting past feedback. For example, the scanning unit can adjust scan settings based on past feedback. For example, the scanning unit can reflect feedback and strengthen scanning for specific vulnerabilities. The scanning unit can also adjust the frequency and scope of scanning based on feedback. In this way, the scanning method can be optimized by reflecting past feedback. Some or all of the above-mentioned processing in the scanning unit may be performed using or without using the generation AI. For example, the scanning unit can input past feedback data into the generation AI, which can then customize the scanning method.

[0040] The visualization unit can adjust the level of detail of the display based on the severity of the vulnerability. For example, the visualization unit can highlight vulnerabilities with high severity and provide detailed information. For example, the visualization unit can briefly display vulnerabilities with low severity and display details as needed. The visualization unit can also adjust the color and size of the display based on the severity. This makes it possible to emphasize important information by adjusting the level of detail of the display based on the severity of the vulnerability. Some or all of the above-mentioned processing in the visualization unit may be performed using or without the generation AI. For example, the visualization unit can input vulnerability severity data to the generation AI, and the generation AI can adjust the level of detail of the display.

[0041] The visualization unit can apply different visualization methods depending on the vulnerability category. For example, the visualization unit displays network vulnerabilities on a network map. For example, the visualization unit can also display software vulnerabilities in a version control chart. The visualization unit can also display hardware vulnerabilities in a device list. In this way, applying different visualization methods depending on the vulnerability category makes it easier to understand the information. Some or all of the above-mentioned processing in the visualization unit may be performed using or without using the generation AI. For example, the visualization unit can input vulnerability category data into the generation AI, which then applies different visualization methods.

[0042] The visualization unit can improve the accuracy of the display by referring to past visualization results. The visualization unit, for example, optimizes the display layout based on past visualization results. The visualization unit can also, for example, prioritize displaying information frequently referenced by users from past visualization results. The visualization unit can also analyze past visualization results and improve the accuracy of the display. In this way, the accuracy of the display is improved by referring to past visualization results. Some or all of the above-mentioned processing in the visualization unit may be performed using a generation AI, or may be performed without using a generation AI. For example, the visualization unit can input past visualization result data into the generation AI, which can improve the accuracy of the display.

[0043] The visualization unit can determine the display priority based on the time when the vulnerability was discovered. For example, the visualization unit can prioritize displaying recently discovered vulnerabilities. For example, the visualization unit can also prioritize displaying vulnerabilities that were discovered in the past but remain unresolved. The visualization unit can also adjust the display color and size depending on the time of discovery. In this way, by determining the display priority based on the time when the vulnerability was discovered, it is possible to prioritize displaying the latest information. Some or all of the above-mentioned processing in the visualization unit may be performed using the generation AI, or may be performed without using the generation AI. For example, the visualization unit can input data on the time when the vulnerability was discovered into the generation AI, and the generation AI can determine the display priority.

[0044] The visualization unit can adjust the display order based on the relevance of vulnerabilities. For example, the visualization unit can group and display highly relevant vulnerabilities. For example, the visualization unit can also display less relevant vulnerabilities individually. The visualization unit can also adjust the display color and size according to the relevance. In this way, by adjusting the display order based on the relevance of vulnerabilities, related information can be grasped at a glance. Some or all of the above-mentioned processing in the visualization unit may be performed using the generation AI, or may be performed without using the generation AI. For example, the visualization unit can input vulnerability relevance data into the generation AI, and the generation AI can adjust the display order.

[0045] The visualization unit can adjust the display content according to the user's level of expertise. For example, the visualization unit displays detailed technical information to a user with high expertise. For example, the visualization unit can also display concise and easy-to-understand information to a user with low expertise. The visualization unit can also adjust the display layout and terminology according to the user's level of expertise. This makes it easier to understand the information by adjusting the display content according to the user's level of expertise. Some or all of the above-mentioned processing in the visualization unit may be performed using a generation AI, or may be performed without using a generation AI. For example, the visualization unit can input the user's expertise level data into the generation AI, which can then adjust the display content.

[0046] The countermeasure presentation unit can adjust the level of detail of the countermeasures based on the severity of the vulnerability. For example, the countermeasure presentation unit presents detailed countermeasures for vulnerabilities with high severity. For example, the countermeasure presentation unit can also present simple countermeasures for vulnerabilities with low severity. The countermeasure presentation unit can also adjust the priority of the countermeasures according to the severity. In this way, by adjusting the level of detail of the countermeasures based on the severity of the vulnerability, important countermeasures can be emphasized. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without the generation AI. For example, the countermeasure presentation unit can input vulnerability severity data to the generation AI, and the generation AI can adjust the level of detail of the countermeasures.

[0047] The countermeasure presentation unit can apply different countermeasure algorithms depending on the vulnerability category. For example, the countermeasure presentation unit can suggest a firewall setting change for a network vulnerability. For example, the countermeasure presentation unit can also suggest a software update for a software vulnerability. The countermeasure presentation unit can also suggest device replacement or repair for a hardware vulnerability. In this way, by applying different countermeasure algorithms depending on the vulnerability category, optimal countermeasures can be provided. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without using the generation AI. For example, the countermeasure presentation unit can input vulnerability category data into the generation AI, which can then apply different countermeasure algorithms.

[0048] The countermeasure presentation unit can improve the accuracy of countermeasures by referring to past countermeasure results. The countermeasure presentation unit, for example, proposes optimal countermeasures based on past countermeasure results. The countermeasure presentation unit can also, for example, preferentially propose effective countermeasures based on past countermeasure results. The countermeasure presentation unit can also analyze past countermeasure results and optimize countermeasure algorithms. In this way, the accuracy of countermeasures is improved by referring to past countermeasure results. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without the generation AI. For example, the countermeasure presentation unit inputs past countermeasure result data into the generation AI, which can improve the accuracy of the countermeasures.

[0049] The countermeasure presentation unit can determine the priority of countermeasures based on the time when the vulnerability was discovered. For example, the countermeasure presentation unit quickly presents countermeasures for recently discovered vulnerabilities. For example, the countermeasure presentation unit can also preferentially present countermeasures for vulnerabilities that were discovered in the past but remain unresolved. The countermeasure presentation unit can also adjust the priority of countermeasures according to the time when the vulnerability was discovered. In this way, by determining the priority of countermeasures based on the time when the vulnerability was discovered, it is possible to respond quickly to the latest vulnerabilities. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without the generation AI. For example, the countermeasure presentation unit can input data on the time when the vulnerability was discovered into the generation AI, and the generation AI can determine the priority of countermeasures.

[0050] The countermeasure presentation unit can adjust the order of countermeasures based on the relevance of vulnerabilities. For example, the countermeasure presentation unit groups and presents countermeasures for highly relevant vulnerabilities. For example, the countermeasure presentation unit can also present individual countermeasures for less relevant vulnerabilities. The countermeasure presentation unit can also adjust the order of countermeasures according to the relevance. In this way, by adjusting the order of countermeasures based on the relevance of vulnerabilities, countermeasures can be efficiently taken for related vulnerabilities. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without the generation AI. For example, the countermeasure presentation unit can input vulnerability relevance data to the generation AI, and the generation AI can adjust the order of countermeasures.

[0051] The countermeasure presentation unit can adjust the use of technical terms for the countermeasures according to the user's level of expertise. For example, the countermeasure presentation unit can present the countermeasures using detailed technical terms to a user with high expertise. For example, the countermeasure presentation unit can also present the countermeasures using simple and easy-to-understand terms to a user with low expertise. The countermeasure presentation unit can also adjust the way in which the countermeasures are explained according to the user's level of expertise. This can promote the user's understanding by adjusting the use of technical terms for the countermeasures according to the user's level of expertise. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without the generation AI. For example, the countermeasure presentation unit can input the user's expertise level data into the generation AI, which can then adjust the use of technical terms for the countermeasures.

[0052] The regular scanning unit can optimize the scan algorithm by referring to past scan data. For example, the regular scanning unit can check whether a specific vulnerability has recurred based on past scan data. For example, the regular scanning unit can prioritize scanning areas where problems frequently occur based on past scan data. The regular scanning unit can also analyze past scan data and optimize the scan algorithm. In this way, the scan algorithm can be optimized by referring to past scan data. Some or all of the above-mentioned processing in the regular scanning unit may be performed using or without using the generation AI. For example, the regular scanning unit can input past scan data into the generation AI, which then optimizes the scan algorithm.

[0053] The regular scanning unit can update the scan data by reflecting user feedback. The regular scanning unit can, for example, adjust scan settings based on user feedback. The regular scanning unit can also, for example, reflect feedback and strengthen scans for specific vulnerabilities. The regular scanning unit can also adjust the frequency and scope of scans based on feedback. In this way, scan data can be optimized by reflecting user feedback. Some or all of the above-mentioned processing in the regular scanning unit may be performed using or without using the generation AI. For example, the regular scanning unit can input user feedback data into the generation AI, which can then update the scan data.

[0054] The regular scanning unit can weight the scan data based on when the vulnerability was discovered. For example, the regular scanning unit can assign a higher weight to a vulnerability that was recently discovered. For example, the regular scanning unit can also assign a higher weight to a vulnerability that was discovered in the past but remains unresolved. The regular scanning unit can also adjust the weighting of the scan data depending on when the vulnerability was discovered. In this way, by weighting the scan data based on when the vulnerability was discovered, it is possible to respond quickly to the latest vulnerabilities. Some or all of the above-mentioned processing in the regular scanning unit may be performed using or without the generation AI. For example, the regular scanning unit can input data on when the vulnerability was discovered into the generation AI, and the generation AI can weight the scan data.

[0055] The regular scanning unit can integrate information from different data sources to enrich the scan data. For example, the regular scanning unit integrates vulnerability information from different data sources to enrich the scan data. For example, the regular scanning unit can integrate threat information from different data sources to enrich the scan data. The regular scanning unit can also integrate feedback from different data sources to enrich the scan data. In this way, the scan data can be enriched by integrating information from different data sources. Some or all of the above-described processing in the regular scanning unit may be performed using or without the generation AI. For example, the regular scanning unit can input information from different data sources into the generation AI, which can enrich the scan data.

[0056] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0057] The scanning unit can improve the accuracy of the scan by referring to past scan results. For example, it can check whether a specific vulnerability has recurred based on past scan results. It can also prioritize scanning areas where problems frequently occur. It can also analyze past scan results and optimize the scan algorithm. In this way, the accuracy of the scan can be improved by referring to past scan results.

[0058] The scanning unit can analyze network traffic patterns and select the optimal scanning method. For example, it can select a time period when network traffic is low to perform a scan. It can also analyze traffic patterns and perform focused scanning of specific devices or systems. In addition, if it detects a traffic anomaly, it can prioritize scanning of that area. This allows it to select the optimal scanning method by analyzing network traffic patterns.

[0059] The scanning unit can determine the scanning priority based on the usage status of each device. For example, it can prioritize scanning of frequently used devices. It can also prioritize scanning of devices that are used for important tasks. It can also prioritize scanning of devices that have previously experienced problems. In this way, determining the scanning priority based on the usage status of each device enables efficient scanning.

[0060] The scanning unit can select scan targets taking geographical location information into consideration. For example, it can prioritize scanning of a company's main bases. It can also scan geographically distant bases to grasp the overall security situation. It can also prioritize scanning of devices in a specific region in response to threats occurring in that region. This allows for optimal selection of scan targets by taking geographical location information into consideration.

[0061] The scanning department can analyze social media activity to identify related vulnerabilities. For example, it can analyze the activity of a company's official account to identify related vulnerabilities. It can also analyze employees' social media activity to identify the risk of information leakage. It can also collect threat information on social media to identify related vulnerabilities. This makes it possible to identify related vulnerabilities by analyzing social media activity.

[0062] The processing flow of the first embodiment will be briefly explained below.

[0063] Step 1: The scanning unit scans the entire company's IT infrastructure. The scanning unit scans the entire network and identifies vulnerabilities in each device and system. Specifically, it can use methods such as port scanning, vulnerability scanning, and malware scanning. It is also possible to use generative AI to analyze the scan results and identify vulnerabilities and risks. Step 2: The visualization section visualizes the vulnerabilities and risks identified by the scanning section. The visualization section displays the identified vulnerabilities in a visual format such as a graph or chart. Generative AI can also be used to visually display the identified vulnerabilities. For example, it can display the location of vulnerabilities on a network map to clarify which part of the network has the problem. Step 3: The countermeasure suggestion unit presents specific countermeasures based on the vulnerabilities and risks visualized by the visualization unit. The countermeasure suggestion unit proposes optimal countermeasures for the identified vulnerabilities. Generative AI can also be used to propose optimal countermeasures for the identified vulnerabilities. For example, it suggests changing firewall settings, updating software, or applying patches. Step 4: The regular scanning unit performs regular scans. For example, the regular scanning unit performs scans once a week, and immediately proposes countermeasures if new vulnerabilities are discovered. Generative AI can also be used to perform regular scans and propose countermeasures for new vulnerabilities.

[0064] (Example 2) An IT security analysis system according to an embodiment of the present invention scans a company's entire IT infrastructure, and uses a generative AI to identify and visualize vulnerabilities and risks and propose specific countermeasures. This allows the company to quickly and accurately address evolving cyberthreats. For example, the IT security analysis system scans the entire IT infrastructure of a company. For example, it scans the entire network and identifies vulnerabilities in each device and system. The IT security analysis system then visualizes the identified vulnerabilities and risks. The generative AI displays the identified vulnerabilities in a visual format, such as a graph or chart, allowing administrators to understand them at a glance. For example, it displays the location of vulnerabilities on a network map to clearly identify the problem area. The IT security analysis system then proposes optimal countermeasures for the identified vulnerabilities. The generative AI proposes optimal countermeasures for the identified vulnerabilities. Examples of such countermeasures include changing firewall settings, updating software, and applying patches. Finally, the IT security analysis system performs regular scans and provides countermeasures against new threats. This allows companies to maintain the latest security measures. For example, a scan can be performed once a week, and if a new vulnerability is discovered, countermeasures can be immediately proposed. This allows the IT security analysis system to automatically analyze a company's IT security, visualize vulnerabilities and risks, and suggest specific countermeasures. For example, it can quickly and accurately scan a company's entire IT infrastructure and identify vulnerabilities and risks. Administrators can also grasp the location of vulnerabilities and risks at a glance, allowing them to quickly take appropriate countermeasures. Furthermore, regular scans ensure that security measures are always kept up to date.

[0065] An IT security analysis system according to an embodiment includes a scanning unit, a visualization unit, a countermeasure presentation unit, and a regular scanning unit. The scanning unit scans the entire IT infrastructure of a company. For example, the scanning unit scans the entire network to identify vulnerabilities in each device and system. The scanning unit may use methods such as port scanning, vulnerability scanning, and malware scanning. The scanning unit may also use a generation AI to analyze the scan results and identify vulnerabilities and risks. The visualization unit visualizes the vulnerabilities and risks identified by the scanning unit. For example, the visualization unit displays the identified vulnerabilities in a visual format such as a graph or chart. The visualization unit may also use a generation AI to visually display the identified vulnerabilities. For example, the visualization unit displays the location of vulnerabilities on a network map to clarify which part is at fault. The countermeasure presentation unit presents specific countermeasures based on the vulnerabilities and risks visualized by the visualization unit. For example, the countermeasure presentation unit proposes optimal countermeasures for the identified vulnerabilities. The countermeasure presentation unit may also use a generation AI to propose optimal countermeasures for the identified vulnerabilities. For example, the countermeasure presentation unit proposes firewall setting changes, software updates, patch applications, etc. The periodic scanning unit performs regular scans using a scanning unit. The periodic scanning unit performs scans, for example, once a week, and immediately proposes countermeasures if a new vulnerability is discovered. The periodic scanning unit can also perform regular scans using a generative AI and propose countermeasures for new vulnerabilities. As a result, the IT security analysis system according to the embodiment can automatically analyze a company's IT security, visualize vulnerabilities and risks, and propose specific countermeasures. For example, it can quickly and accurately scan a company's entire IT infrastructure and identify vulnerabilities and risks. Furthermore, administrators can grasp the location of vulnerabilities and risks at a glance and quickly take appropriate countermeasures. Furthermore, regular scanning allows security measures to be kept up to date.

[0066] The scanning unit can scan the entire network and identify vulnerabilities in each device and system. For example, the scanning unit can scan the entire network and identify vulnerabilities in each device and system. For example, the scanning unit can use a port scan to identify open ports on the network and detect vulnerabilities. The scanning unit can also use a vulnerability scan to identify software and systems with known vulnerabilities. Furthermore, the scanning unit can also use a malware scan to detect malware on the network. In this way, by scanning the entire network, vulnerabilities in each device and system can be identified. Some or all of the above-mentioned processing in the scanning unit may be performed using the generation AI, or may be performed without using the generation AI. For example, the scanning unit can input the results of a scan of the entire network into the generation AI, which can identify vulnerabilities.

[0067] The visualization unit can display the identified vulnerabilities in a visual format such as a graph or chart. For example, the visualization unit displays the identified vulnerabilities in a visual format such as a graph or chart. For example, the visualization unit can display the importance of each vulnerability using a bar graph. The visualization unit can also display the percentage of each vulnerability type using a pie chart. Furthermore, the visualization unit can also display the trend of the vulnerability by time of discovery using a line graph. In this way, by visually displaying the identified vulnerabilities, the administrator can understand them at a glance. Some or all of the above-mentioned processing in the visualization unit may be performed using the generation AI, or may be performed without using the generation AI. For example, the visualization unit can input data of the identified vulnerabilities into the generation AI, which then displays them in a visual format.

[0068] The countermeasure presentation unit can propose countermeasures for the identified vulnerability. The countermeasure presentation unit can propose, for example, the optimal countermeasure for the identified vulnerability. The countermeasure presentation unit can propose, for example, a change to firewall settings. The countermeasure presentation unit can also propose software updates. Furthermore, the countermeasure presentation unit can also propose patch applications. This allows for the optimal countermeasure for the identified vulnerability to be proposed, thereby enabling a prompt and accurate response. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without the generation AI. For example, the countermeasure presentation unit can input data on the identified vulnerability into the generation AI, which then proposes the optimal countermeasure.

[0069] The regular scanning unit performs regular scans and can immediately propose countermeasures if a new vulnerability is discovered. The regular scanning unit performs scans, for example, once a week and immediately proposes countermeasures if a new vulnerability is discovered. The regular scanning unit can also perform scans daily, for example, to always maintain the latest security measures. The regular scanning unit can also perform scans monthly to regularly check the security status. In this way, by performing regular scans, the latest security measures can always be maintained. Some or all of the above-mentioned processing in the regular scanning unit may be performed using or without the generation AI. For example, the regular scanning unit can input scan results into the generation AI, which can then propose countermeasures for new vulnerabilities.

[0070] The scanning unit can estimate the user's emotions and adjust the timing of scanning based on the estimated user emotions. For example, if the user is feeling stressed, the scanning unit can reduce the frequency of scanning and only perform scanning at important times. For example, if the user is relaxed, the scanning unit can increase the frequency of scanning and perform detailed scans. Furthermore, if the user is in a hurry, the scanning unit can shorten the scanning time and provide results quickly. This reduces the burden on the user by adjusting the timing of scanning according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, an emotion engine or a generation AI. The generation AI can be, but is not limited to, a text generation AI (e.g., LLM) or a multimodal generation AI. Some or all of the above-mentioned processing in the scanning unit can be performed using the generation AI, or can be performed without using the generation AI. For example, the scanning unit can input the user's emotion data into the generation AI, which can then adjust the timing of scanning.

[0071] The scanning unit can improve the accuracy of the scan by referring to past scan results. For example, the scanning unit can check whether a specific vulnerability has recurred based on past scan results. For example, the scanning unit can prioritize scanning areas where problems frequently occur based on past scan results. The scanning unit can also analyze past scan results and optimize the scan algorithm. In this way, the accuracy of the scan is improved by referring to past scan results. Some or all of the above-mentioned processing in the scanning unit may be performed using or without the generation AI. For example, the scanning unit can input past scan results into the generation AI, which can improve the accuracy of the scan.

[0072] The scanning unit can analyze network traffic patterns and select the optimal scanning method. For example, the scanning unit selects a time period with low network traffic to perform a scan. For example, the scanning unit can analyze traffic patterns and focus scanning on specific devices or systems. Furthermore, if the scanning unit detects a traffic abnormality, it can prioritize scanning that location. In this way, the optimal scanning method can be selected by analyzing network traffic patterns. Some or all of the above-mentioned processing in the scanning unit may be performed using or without the generation AI. For example, the scanning unit can input network traffic data into the generation AI, which can select the optimal scanning method.

[0073] The scanning unit can determine the scanning priority based on the usage status of each device. For example, the scanning unit prioritizes scanning of frequently used devices. For example, the scanning unit can also prioritize scanning of devices that are performing important tasks. The scanning unit can also prioritize scanning of devices that have previously experienced problems. This enables efficient scanning by determining the scanning priority based on the usage status of each device. Some or all of the above-described processing in the scanning unit may be performed using or without the generation AI. For example, the scanning unit can input usage status data of each device into the generation AI, which then determines the scanning priority.

[0074] The scanning unit can estimate the user's emotions and adjust the scanning range based on the estimated user emotions. For example, if the user is stressed, the scanning unit can limit the scanning range and scan only important areas. For example, if the user is relaxed, the scanning unit can widen the scanning range and perform a detailed scan. Furthermore, if the user is in a hurry, the scanning unit can narrow the scanning range and provide results quickly. This reduces the burden on the user by adjusting the scanning range according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, an emotion engine or a generation AI. The generation AI can be, but is not limited to, a text generation AI (e.g., LLM) or a multimodal generation AI. Some or all of the above-described processing in the scanning unit can be performed using the generation AI, or can be performed without using the generation AI. For example, the scanning unit can input the user's emotion data into the generation AI, which can then adjust the scanning range.

[0075] The scanning unit can select scan targets taking geographical location information into consideration. For example, the scanning unit prioritizes scanning of a company's major bases. For example, the scanning unit can also scan geographically distant bases to grasp the overall security situation. The scanning unit can also prioritize scanning devices in a specific region in response to a threat occurring in that region. This allows optimal selection of scan targets by taking geographical location information into consideration. Some or all of the above-described processing in the scanning unit may be performed using or without the generation AI. For example, the scanning unit can input geographical location information data into the generation AI, which then selects scan targets.

[0076] The scanning unit can analyze social media activity to identify related vulnerabilities. For example, the scanning unit can analyze activity on a company's official account to identify related vulnerabilities. For example, the scanning unit can analyze employees' social media activity to identify the risk of information leakage. The scanning unit can also collect threat information on social media to identify related vulnerabilities. In this way, related vulnerabilities can be identified by analyzing social media activity. Some or all of the above-described processing in the scanning unit may be performed using or without the generation AI. For example, the scanning unit can input social media activity data into the generation AI, which then identifies related vulnerabilities.

[0077] The scanning unit can customize the scanning method by reflecting past feedback. For example, the scanning unit can adjust scan settings based on past feedback. For example, the scanning unit can reflect feedback and strengthen scanning for specific vulnerabilities. The scanning unit can also adjust the frequency and scope of scanning based on feedback. In this way, the scanning method can be optimized by reflecting past feedback. Some or all of the above-mentioned processing in the scanning unit may be performed using or without using the generation AI. For example, the scanning unit can input past feedback data into the generation AI, which can then customize the scanning method.

[0078] The visualization unit can estimate the user's emotions and adjust the visualization expression method based on the estimated user emotions. For example, if the user is nervous, the visualization unit can provide a simple, highly visible graph. For example, if the user is relaxed, the visualization unit can provide a chart containing detailed information. Furthermore, if the user is in a hurry, the visualization unit can provide a concise display that focuses on the main points. This can promote user understanding by adjusting the visualization expression method according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, an emotion engine or a generation AI. The generation AI can be, but is not limited to, a text generation AI (e.g., LLM) or a multimodal generation AI. Some or all of the above-mentioned processing in the visualization unit can be performed using the generation AI, or can be performed without using the generation AI. For example, the visualization unit can input the user's emotion data into the generation AI, which can then adjust the visualization expression method.

[0079] The visualization unit can adjust the level of detail of the display based on the severity of the vulnerability. For example, the visualization unit can highlight vulnerabilities with high severity and provide detailed information. For example, the visualization unit can briefly display vulnerabilities with low severity and display details as needed. The visualization unit can also adjust the color and size of the display based on the severity. This makes it possible to emphasize important information by adjusting the level of detail of the display based on the severity of the vulnerability. Some or all of the above-mentioned processing in the visualization unit may be performed using or without the generation AI. For example, the visualization unit can input vulnerability severity data to the generation AI, and the generation AI can adjust the level of detail of the display.

[0080] The visualization unit can apply different visualization methods depending on the vulnerability category. For example, the visualization unit displays network vulnerabilities on a network map. For example, the visualization unit can also display software vulnerabilities in a version control chart. The visualization unit can also display hardware vulnerabilities in a device list. In this way, applying different visualization methods depending on the vulnerability category makes it easier to understand the information. Some or all of the above-mentioned processing in the visualization unit may be performed using or without using the generation AI. For example, the visualization unit can input vulnerability category data into the generation AI, which then applies different visualization methods.

[0081] The visualization unit can improve the accuracy of the display by referring to past visualization results. The visualization unit, for example, optimizes the display layout based on past visualization results. The visualization unit can also, for example, prioritize displaying information frequently referenced by users from past visualization results. The visualization unit can also analyze past visualization results and improve the accuracy of the display. In this way, the accuracy of the display is improved by referring to past visualization results. Some or all of the above-mentioned processing in the visualization unit may be performed using a generation AI, or may be performed without using a generation AI. For example, the visualization unit can input past visualization result data into the generation AI, which can improve the accuracy of the display.

[0082] The visualization unit can estimate the user's emotions and adjust the length of the visualization based on the estimated user emotions. For example, if the user is nervous, the visualization unit can provide a short, to-the-point visualization. For example, if the user is relaxed, the visualization unit can provide a longer visualization with detailed information. Furthermore, if the user is in a hurry, the visualization unit can provide a concise, quickly understandable visualization. This can promote user understanding by adjusting the length of the visualization according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, an emotion engine or a generation AI. The generation AI can be, but is not limited to, a text generation AI (e.g., LLM) or a multimodal generation AI. Some or all of the above-described processing in the visualization unit can be performed using the generation AI, or can be performed without using the generation AI. For example, the visualization unit can input the user's emotion data into the generation AI, which can adjust the length of the visualization.

[0083] The visualization unit can determine the display priority based on the time when the vulnerability was discovered. For example, the visualization unit can prioritize displaying recently discovered vulnerabilities. For example, the visualization unit can also prioritize displaying vulnerabilities that were discovered in the past but remain unresolved. The visualization unit can also adjust the display color and size depending on the time of discovery. In this way, by determining the display priority based on the time when the vulnerability was discovered, it is possible to prioritize displaying the latest information. Some or all of the above-mentioned processing in the visualization unit may be performed using the generation AI, or may be performed without using the generation AI. For example, the visualization unit can input data on the time when the vulnerability was discovered into the generation AI, and the generation AI can determine the display priority.

[0084] The visualization unit can adjust the display order based on the relevance of vulnerabilities. For example, the visualization unit can group and display highly relevant vulnerabilities. For example, the visualization unit can also display less relevant vulnerabilities individually. The visualization unit can also adjust the display color and size according to the relevance. In this way, by adjusting the display order based on the relevance of vulnerabilities, related information can be grasped at a glance. Some or all of the above-mentioned processing in the visualization unit may be performed using the generation AI, or may be performed without using the generation AI. For example, the visualization unit can input vulnerability relevance data into the generation AI, and the generation AI can adjust the display order.

[0085] The visualization unit can adjust the display content according to the user's level of expertise. For example, the visualization unit displays detailed technical information to a user with high expertise. For example, the visualization unit can also display concise and easy-to-understand information to a user with low expertise. The visualization unit can also adjust the display layout and terminology according to the user's level of expertise. This makes it easier to understand the information by adjusting the display content according to the user's level of expertise. Some or all of the above-mentioned processing in the visualization unit may be performed using a generation AI, or may be performed without using a generation AI. For example, the visualization unit can input the user's expertise level data into the generation AI, which can then adjust the display content.

[0086] The countermeasure presentation unit can estimate the user's emotions and adjust the way in which countermeasures are presented based on the estimated user emotions. For example, if the user is nervous, the countermeasure presentation unit presents simple, highly visible countermeasures. For example, if the user is relaxed, the countermeasure presentation unit can present countermeasures that include detailed information. Furthermore, if the user is in a hurry, the countermeasure presentation unit can present concise countermeasures that focus on the main points. This allows the user's understanding to be promoted by adjusting the way in which countermeasures are presented according to the user's emotions. The emotion estimation is realized using an emotion estimation function, for example, an emotion engine or a generation AI. The generation AI may be, but is not limited to, a text generation AI (e.g., LLM) or a multimodal generation AI. Some or all of the above-described processing in the countermeasure presentation unit may be performed using the generation AI, or may be performed without using the generation AI. For example, the countermeasure presentation unit can input the user's emotion data into the generation AI, which can then adjust the way in which countermeasures are presented.

[0087] The countermeasure presentation unit can adjust the level of detail of the countermeasures based on the severity of the vulnerability. For example, the countermeasure presentation unit presents detailed countermeasures for vulnerabilities with high severity. For example, the countermeasure presentation unit can also present simple countermeasures for vulnerabilities with low severity. The countermeasure presentation unit can also adjust the priority of the countermeasures according to the severity. In this way, by adjusting the level of detail of the countermeasures based on the severity of the vulnerability, important countermeasures can be emphasized. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without the generation AI. For example, the countermeasure presentation unit can input vulnerability severity data to the generation AI, and the generation AI can adjust the level of detail of the countermeasures.

[0088] The countermeasure presentation unit can apply different countermeasure algorithms depending on the vulnerability category. For example, the countermeasure presentation unit can suggest a firewall setting change for a network vulnerability. For example, the countermeasure presentation unit can also suggest a software update for a software vulnerability. The countermeasure presentation unit can also suggest device replacement or repair for a hardware vulnerability. In this way, by applying different countermeasure algorithms depending on the vulnerability category, optimal countermeasures can be provided. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without using the generation AI. For example, the countermeasure presentation unit can input vulnerability category data into the generation AI, which can then apply different countermeasure algorithms.

[0089] The countermeasure presentation unit can improve the accuracy of countermeasures by referring to past countermeasure results. The countermeasure presentation unit, for example, proposes optimal countermeasures based on past countermeasure results. The countermeasure presentation unit can also, for example, preferentially propose effective countermeasures based on past countermeasure results. The countermeasure presentation unit can also analyze past countermeasure results and optimize countermeasure algorithms. In this way, the accuracy of countermeasures is improved by referring to past countermeasure results. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without the generation AI. For example, the countermeasure presentation unit inputs past countermeasure result data into the generation AI, which can improve the accuracy of the countermeasures.

[0090] The countermeasure presentation unit can estimate the user's emotions and adjust the length of the countermeasures based on the estimated user emotions. For example, if the user is nervous, the countermeasure presentation unit can present short, concise countermeasures that include detailed information. For example, if the user is relaxed, the countermeasure presentation unit can present longer countermeasures that include detailed information. Furthermore, if the user is in a hurry, the countermeasure presentation unit can present concise, quickly understandable countermeasures. This can promote the user's understanding by adjusting the length of the countermeasures according to the user's emotions. The emotion estimation is realized using an emotion estimation function, for example, an emotion engine or a generation AI. The generation AI can be, but is not limited to, a text generation AI (e.g., LLM) or a multimodal generation AI. Some or all of the above-described processing in the countermeasure presentation unit can be performed using the generation AI, or can be performed without using the generation AI. For example, the countermeasure presentation unit can input the user's emotion data into the generation AI, which can adjust the length of the countermeasures.

[0091] The countermeasure presentation unit can determine the priority of countermeasures based on the time when the vulnerability was discovered. For example, the countermeasure presentation unit quickly presents countermeasures for recently discovered vulnerabilities. For example, the countermeasure presentation unit can also preferentially present countermeasures for vulnerabilities that were discovered in the past but remain unresolved. The countermeasure presentation unit can also adjust the priority of countermeasures according to the time when the vulnerability was discovered. In this way, by determining the priority of countermeasures based on the time when the vulnerability was discovered, it is possible to respond quickly to the latest vulnerabilities. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without the generation AI. For example, the countermeasure presentation unit can input data on the time when the vulnerability was discovered into the generation AI, and the generation AI can determine the priority of countermeasures.

[0092] The countermeasure presentation unit can adjust the order of countermeasures based on the relevance of vulnerabilities. For example, the countermeasure presentation unit groups and presents countermeasures for highly relevant vulnerabilities. For example, the countermeasure presentation unit can also present individual countermeasures for less relevant vulnerabilities. The countermeasure presentation unit can also adjust the order of countermeasures according to the relevance. In this way, by adjusting the order of countermeasures based on the relevance of vulnerabilities, countermeasures can be efficiently taken for related vulnerabilities. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without the generation AI. For example, the countermeasure presentation unit can input vulnerability relevance data to the generation AI, and the generation AI can adjust the order of countermeasures.

[0093] The countermeasure presentation unit can adjust the use of technical terms for the countermeasures according to the user's level of expertise. For example, the countermeasure presentation unit can present the countermeasures using detailed technical terms to a user with high expertise. For example, the countermeasure presentation unit can also present the countermeasures using simple and easy-to-understand terms to a user with low expertise. The countermeasure presentation unit can also adjust the way in which the countermeasures are explained according to the user's level of expertise. This can promote the user's understanding by adjusting the use of technical terms for the countermeasures according to the user's level of expertise. Some or all of the above-mentioned processing in the countermeasure presentation unit may be performed using or without the generation AI. For example, the countermeasure presentation unit can input the user's expertise level data into the generation AI, which can then adjust the use of technical terms for the countermeasures.

[0094] The periodic scanning unit can estimate the user's emotions and adjust the frequency of periodic scanning based on the estimated user emotions. For example, if the user is feeling stressed, the periodic scanning unit can reduce the frequency of scanning and only perform scans at important times. For example, if the user is relaxed, the periodic scanning unit can increase the frequency of scanning and perform detailed scans. Furthermore, if the user is in a hurry, the periodic scanning unit can shorten the scanning time and provide results quickly. This reduces the burden on the user by adjusting the frequency of periodic scanning according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, an emotion engine or a generation AI. The generation AI can be, but is not limited to, a text generation AI (e.g., LLM) or a multimodal generation AI. Some or all of the above-mentioned processing in the periodic scanning unit can be performed using the generation AI, or can be performed without using the generation AI. For example, the periodic scanning unit can input the user's emotion data into the generation AI, which can then adjust the frequency of periodic scanning.

[0095] The regular scanning unit can optimize the scan algorithm by referring to past scan data. For example, the regular scanning unit can check whether a specific vulnerability has recurred based on past scan data. For example, the regular scanning unit can prioritize scanning areas where problems frequently occur based on past scan data. The regular scanning unit can also analyze past scan data and optimize the scan algorithm. In this way, the scan algorithm can be optimized by referring to past scan data. Some or all of the above-mentioned processing in the regular scanning unit may be performed using or without using the generation AI. For example, the regular scanning unit can input past scan data into the generation AI, which then optimizes the scan algorithm.

[0096] The regular scanning unit can update the scan data by reflecting user feedback. The regular scanning unit can, for example, adjust scan settings based on user feedback. The regular scanning unit can also, for example, reflect feedback and strengthen scans for specific vulnerabilities. The regular scanning unit can also adjust the frequency and scope of scans based on feedback. In this way, scan data can be optimized by reflecting user feedback. Some or all of the above-mentioned processing in the regular scanning unit may be performed using or without using the generation AI. For example, the regular scanning unit can input user feedback data into the generation AI, which can then update the scan data.

[0097] The regular scanning unit can estimate the user's emotions and adjust the timing of regular scanning based on the estimated user emotions. For example, if the user is feeling stressed, the regular scanning unit can adjust the timing of scanning and perform scanning only at important times. For example, if the user is relaxed, the regular scanning unit can increase the timing of scanning and perform detailed scanning. Furthermore, if the user is in a hurry, the regular scanning unit can shorten the timing of scanning and provide results quickly. This reduces the burden on the user by adjusting the timing of regular scanning according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, an emotion engine or a generation AI. The generation AI can be, but is not limited to, a text generation AI (e.g., LLM) or a multimodal generation AI. Some or all of the above-mentioned processing in the regular scanning unit can be performed using the generation AI, or can be performed without using the generation AI. For example, the regular scanning unit can input user emotion data into the generation AI, which can then adjust the timing of regular scanning.

[0098] The regular scanning unit can weight the scan data based on when the vulnerability was discovered. For example, the regular scanning unit can assign a higher weight to a vulnerability that was recently discovered. For example, the regular scanning unit can also assign a higher weight to a vulnerability that was discovered in the past but remains unresolved. The regular scanning unit can also adjust the weighting of the scan data depending on when the vulnerability was discovered. In this way, by weighting the scan data based on when the vulnerability was discovered, it is possible to respond quickly to the latest vulnerabilities. Some or all of the above-mentioned processing in the regular scanning unit may be performed using or without the generation AI. For example, the regular scanning unit can input data on when the vulnerability was discovered into the generation AI, and the generation AI can weight the scan data.

[0099] The regular scanning unit can integrate information from different data sources to enrich the scan data. For example, the regular scanning unit integrates vulnerability information from different data sources to enrich the scan data. For example, the regular scanning unit can integrate threat information from different data sources to enrich the scan data. The regular scanning unit can also integrate feedback from different data sources to enrich the scan data. In this way, the scan data can be enriched by integrating information from different data sources. Some or all of the above-described processing in the regular scanning unit may be performed using or without the generation AI. For example, the regular scanning unit can input information from different data sources into the generation AI, which can enrich the scan data. === Hard Collateral 1-1 === Each of the multiple elements, including the scanning unit, visualization unit, countermeasure presentation unit, and regular scanning unit, is realized, for example, by at least one of the smart device 14 and the data processing device 12. For example, the scanning unit is realized by at least one of the smart device 14 and the data processing device 12. For example, the scanning unit scans the entire network using the camera 42 and communication I / F 44 of the smart device 14 and identifies vulnerabilities using the identification processing unit 290 of the data processing device 12. The visualization unit is realized, for example, by the display 40A of the smart device 14 or the identification processing unit 290 of the data processing device 12 and visually displays the identified vulnerabilities. The countermeasure presentation unit is realized, for example, by the identification processing unit 290 of the data processing device 12 and proposes optimal countermeasures for the identified vulnerabilities. The regular scanning unit is realized, for example, by the control unit 46A of the smart device 14 or the identification processing unit 290 of the data processing device 12 and periodically scans and proposes countermeasures for new vulnerabilities. === Hard Collateral 1-2 === Each of the multiple elements including the scanning unit, visualization unit, countermeasure presentation unit, and periodic scanning unit described above is realized, for example, by at least one of the smart glasses 214 and the data processing device 12. For example, the scanning unit is realized by at least one of the smart glasses 214 and the data processing device 12. For example, the scanning unit scans the entire network using the camera 42 and communication I / F 44 of the smart glasses 214 and identifies vulnerabilities using the identification processing unit 290 of the data processing device 12. The visualization unit is realized, for example, by the display of the smart glasses 214 or the identification processing unit 290 of the data processing device 12 and visually displays the identified vulnerabilities. The countermeasure presentation unit is realized, for example, by the identification processing unit 290 of the data processing device 12 and proposes optimal countermeasures for the identified vulnerabilities. The periodic scanning unit is realized, for example, by the control unit 46A of the smart glasses 214 or the identification processing unit 290 of the data processing device 12 and periodically scans and proposes countermeasures for new vulnerabilities. === Hard Collateral 1-3 === Each of the multiple elements including the scanning unit, visualization unit, countermeasure presentation unit, and periodic scanning unit described above is realized, for example, by at least one of the headset type terminal 314 and the data processing device 12. For example, the scanning unit is realized by at least one of the headset type terminal 314 and the data processing device 12. For example, the scanning unit scans the entire network using the camera 42 and communication I / F 44 of the headset type terminal 314 and identifies vulnerabilities using the identification processing unit 290 of the data processing device 12. The visualization unit is realized, for example, by the display 343 of the headset type terminal 314 or the identification processing unit 290 of the data processing device 12, and visually displays the identified vulnerabilities. The countermeasure presentation unit is realized, for example, by the identification processing unit 290 of the data processing device 12, and proposes optimal countermeasures for the identified vulnerabilities. The periodic scanning unit is realized, for example, by the control unit 46A of the headset type terminal 314 or the identification processing unit 290 of the data processing device 12, and periodically scans and proposes countermeasures for new vulnerabilities. === Hard Collateral 1-4 === Each of the multiple elements including the scanning unit, visualization unit, countermeasure presentation unit, and regular scanning unit described above is realized, for example, by at least one of the robot 414 and the data processing device 12. For example, the scanning unit is realized by at least one of the robot 414 and the data processing device 12. For example, the scanning unit scans the entire network using the camera 42 and communication I / F 44 of the robot 414 and identifies vulnerabilities using the identification processing unit 290 of the data processing device 12. The visualization unit is realized, for example, by the display of the robot 414 or the identification processing unit 290 of the data processing device 12, and visually displays the identified vulnerabilities. The countermeasure presentation unit is realized, for example, by the identification processing unit 290 of the data processing device 12, and proposes optimal countermeasures for the identified vulnerabilities. The regular scanning unit is realized, for example, by the control unit 46A of the robot 414 or the identification processing unit 290 of the data processing device 12, and periodically scans and proposes countermeasures for new vulnerabilities.

[0100] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0101] The scanning unit can estimate the user's emotions and adjust the timing of scans based on the estimated user emotions. For example, if the user is feeling stressed, the scanning frequency can be reduced and scans can be performed only at important times. If the user is relaxed, the scanning frequency can be increased and detailed scans can be performed. Also, if the user is in a hurry, the scanning time can be shortened and results can be provided quickly. In this way, the burden on the user can be reduced by adjusting the scanning timing according to the user's emotions.

[0102] The visualization unit can estimate the user's emotions and adjust the visualization method based on the estimated user emotions. For example, if the user is nervous, a simple, highly visible graph can be provided. If the user is relaxed, a chart containing detailed information can be provided. Also, if the user is in a hurry, a concise display that focuses on the main points can be provided. In this way, adjusting the visualization method according to the user's emotions can promote user understanding.

[0103] The countermeasure presentation unit can estimate the user's emotions and adjust the way in which countermeasures are presented based on the estimated user emotions. For example, if the user is nervous, a simple, highly visible countermeasure can be presented. If the user is relaxed, a countermeasure including detailed information can be presented. Also, if the user is in a hurry, a concise countermeasure that focuses on the main points can be presented. In this way, by adjusting the way in which countermeasures are presented according to the user's emotions, it is possible to promote the user's understanding.

[0104] The regular scanning unit can estimate the user's emotions and adjust the frequency of regular scanning based on the estimated user emotions. For example, if the user is feeling stressed, the frequency of scanning can be reduced and scanning can be performed only at important times. If the user is relaxed, the frequency of scanning can be increased and detailed scans can be performed. Also, if the user is in a hurry, the scanning time can be shortened and results can be provided quickly. In this way, adjusting the frequency of regular scanning according to the user's emotions can reduce the burden on the user.

[0105] The regular scan unit can estimate the user's emotions and adjust the timing of regular scans based on the estimated user emotions. For example, if the user is feeling stressed, the scan timing can be adjusted to perform scans only at important times. If the user is relaxed, the scan timing can be increased to perform more detailed scans. Also, if the user is in a hurry, the scan timing can be shortened to provide results quickly. In this way, adjusting the timing of regular scans according to the user's emotions can reduce the burden on the user.

[0106] The scanning unit can improve the accuracy of the scan by referring to past scan results. For example, it can check whether a specific vulnerability has recurred based on past scan results. It can also prioritize scanning areas where problems frequently occur. It can also analyze past scan results and optimize the scan algorithm. In this way, the accuracy of the scan can be improved by referring to past scan results.

[0107] The scanning unit can analyze network traffic patterns and select the optimal scanning method. For example, it can select a time period when network traffic is low to perform a scan. It can also analyze traffic patterns and perform focused scanning of specific devices or systems. In addition, if it detects a traffic anomaly, it can prioritize scanning of that area. This allows it to select the optimal scanning method by analyzing network traffic patterns.

[0108] The scanning unit can determine the scanning priority based on the usage status of each device. For example, it can prioritize scanning of frequently used devices. It can also prioritize scanning of devices that are used for important tasks. It can also prioritize scanning of devices that have previously experienced problems. In this way, determining the scanning priority based on the usage status of each device enables efficient scanning.

[0109] The scanning unit can select scan targets taking geographical location information into consideration. For example, it can prioritize scanning of a company's main bases. It can also scan geographically distant bases to grasp the overall security situation. It can also prioritize scanning of devices in a specific region in response to threats occurring in that region. This allows for optimal selection of scan targets by taking geographical location information into consideration.

[0110] The scanning department can analyze social media activity to identify related vulnerabilities. For example, it can analyze the activity of a company's official account to identify related vulnerabilities. It can also analyze employees' social media activity to identify the risk of information leakage. It can also collect threat information on social media to identify related vulnerabilities. This makes it possible to identify related vulnerabilities by analyzing social media activity.

[0111] The processing flow of the second embodiment will be briefly explained below.

[0112] Step 1: The scanning unit scans the entire company's IT infrastructure. The scanning unit scans the entire network and identifies vulnerabilities in each device and system. Specifically, it can use methods such as port scanning, vulnerability scanning, and malware scanning. It is also possible to use generative AI to analyze the scan results and identify vulnerabilities and risks. Step 2: The visualization section visualizes the vulnerabilities and risks identified by the scanning section. The visualization section displays the identified vulnerabilities in a visual format such as a graph or chart. Generative AI can also be used to visually display the identified vulnerabilities. For example, it can display the location of vulnerabilities on a network map to clarify which part of the network has the problem. Step 3: The countermeasure suggestion unit presents specific countermeasures based on the vulnerabilities and risks visualized by the visualization unit. The countermeasure suggestion unit proposes optimal countermeasures for the identified vulnerabilities. Generative AI can also be used to propose optimal countermeasures for the identified vulnerabilities. For example, it suggests changing firewall settings, updating software, or applying patches. Step 4: The regular scanning unit performs regular scans. For example, the regular scanning unit performs scans once a week, and immediately proposes countermeasures if new vulnerabilities are discovered. Generative AI can also be used to perform regular scans and propose countermeasures for new vulnerabilities.

[0113] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0114] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (registered trademark) (Internet search engine).<URL: https: / / openai.com / blog / chatgpt> Examples of generative AIs include the data generation model 58, such as a neural network model (e.g., a neural network model), and a neural network model (e.g., a neural network model). The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating speech, text data indicating text, and image data indicating an image is also input to the data generation model 58. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specification processing unit 290 performs the above-mentioned specification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0115] Furthermore, the processing by the data processing system 10 described above is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart device 14, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart device 14. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information necessary for processing from the smart device 14 or an external device, and the smart device 14 acquires or collects information necessary for processing from the data processing device 12 or an external device.

[0116] The correspondence between each part and the device or control part is not limited to the example described above, and various modifications are possible.

[0117] [Second embodiment] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0118] 3, the data processing system 210 includes the data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0119] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0120] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0121] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0122] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0123] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0124] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0125] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0126] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate a user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, but is not limited to these examples. Furthermore, the estimation and prediction of emotion also includes, for example, emotion analysis.

[0127] In the smart glasses 214, the specific processing is performed by the processor 46. A specific processing program 60 is stored in the storage 50. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. The smart glasses 214 also have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can perform processing similar to that of the specific processing unit 290 using these models.

[0128] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0129] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0130] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AI other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0131] The data processing system 210 according to the second embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 210 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart glasses 214, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart glasses 214. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the smart glasses 214 or an external device, etc., and the smart glasses 214 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0132] The correspondence between each part and the device or control part is not limited to the example described above, and various modifications are possible.

[0133] [Third embodiment] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[0134] 5, the data processing system 310 includes the data processing device 12 and a headset terminal 314. An example of the data processing device 12 is a server.

[0135] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0136] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[0137] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0138] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0139] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0140] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0141] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0142] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate a user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, but is not limited to these examples. Furthermore, the estimation and prediction of emotion also includes, for example, emotion analysis.

[0143] In the headset type terminal 314, the identification process is performed by the processor 46. A identification program 60 is stored in the storage 50. The processor 46 reads the identification program 60 from the storage 50 and executes the read identification program 60 on the RAM 48. The identification process is realized by the processor 46 operating as a control unit 46A in accordance with the identification program 60 executed on the RAM 48. Note that the headset type terminal 314 has a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can also perform processing similar to that of the identification processing unit 290 using these models.

[0144] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0145] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0146] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AI other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0147] The data processing system 310 according to the third embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 310 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the headset type terminal 314, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the headset type terminal 314. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the headset type terminal 314 or an external device, etc., and the headset type terminal 314 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0148] The correspondence between each part and the device or control part is not limited to the example described above, and various modifications are possible.

[0149] [Fourth embodiment] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[0150] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0151] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0152] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[0153] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0154] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS image sensor or a CCD image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0155] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0156] The control object 443 includes a display device, LEDs in the eyes, and motors that drive the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[0157] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0158] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0159] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate a user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, but is not limited to these examples. Furthermore, the estimation and prediction of emotion also includes, for example, emotion analysis.

[0160] In the robot 414, the processor 46 performs the identification process. The storage 50 stores the identification program 60. The processor 46 reads the identification program 60 from the storage 50 and executes the read identification program 60 on the RAM 48. The identification process is realized by the processor 46 operating as the control unit 46A in accordance with the identification program 60 executed on the RAM 48. The robot 414 also has a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can perform the same process as the identification processing unit 290 using these models.

[0161] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0162] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0163] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AI other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0164] The data processing system 410 according to the fourth embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 410 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the robot 414, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the robot 414. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the robot 414 or an external device, etc., and the robot 414 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0165] The correspondence between each part and the device or control part is not limited to the example described above, and various modifications are possible.

[0166] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[0167] FIG. 9 illustrates an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and behaviors arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion encompasses both emotions and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[0168] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[0169] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[0170] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is expressed, and when they approach the ideal, a state of pleasure is expressed. Emotions can also be created for robots, cars, and motorcycles, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is expressed, and when they approach the ideal, a state of pleasure is expressed. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on speech emotion recognition and brain physiological signal analysis systems for emotions, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the "reaction" domain, where sensation is dominant. The right half of the emotion map lists emotions belonging to the "situation" domain, where situational awareness is dominant.

[0171] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[0172] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[0173] In the above embodiment, an example was given in which a specific process is performed by one computer 22, but the technology disclosed herein is not limited to this, and distributed processing of the specific process may be performed by multiple computers including computer 22.

[0174] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[0175] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[0176] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[0177] The hardware resource for executing a specific process can be any of the following types of processors: A processor, for example, is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. A processor also includes a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[0178] The hardware resource that executes the specific process may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific process may be a single processor.

[0179] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[0180] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[0181] In the above example, the first to fourth embodiments have been described separately, but some or all of these embodiments may be combined. The smart device 14, smart glasses 214, headset terminal 314, and robot 414 are merely examples, and they may be combined, or other devices may be used. In the above example, the first and second embodiments have been described separately, but they may be combined.

[0182] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[0183] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[0184] [Explanation of symbols]

[0185] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot

Claims

1. The scanning department scans the entire IT infrastructure of a company, a visualization unit that visualizes the vulnerabilities and risks identified by the scanning unit; a countermeasure presentation unit that presents countermeasures based on the vulnerabilities and risks visualized by the visualization unit; a periodic scanning unit that periodically scans the image data using the scanning unit; A system characterized by:

2. The scanning unit Scan your entire network to identify vulnerabilities in each device and system 2. The system of claim 1.

3. The visualization unit View identified vulnerabilities in a visual format as graphs or charts 2. The system of claim 1.

4. The countermeasure presentation unit Propose countermeasures for identified vulnerabilities 2. The system of claim 1.

5. The periodic scanning unit Regular scans are performed and any new vulnerabilities discovered are immediately addressed.

2. The system of claim 1.

6. The scanning unit Estimate the user's emotions and adjust the timing of scans based on the estimated user emotions 2. The system of claim 1.

7. The scanning unit Improve your scan accuracy by referencing past scan results 2. The system of claim 1.

8. The scanning unit Analyzes network traffic patterns to determine optimal scanning methods 2. The system of claim 1.

Images