System

Abstract

A system is provided.SOLUTION: The system includes a means for collecting security data for analyzing an information technology security situation of an enterprise, a means for preprocessing the collected security data, a means for using generation artificial intelligence for analyzing the preprocessed data, a means for specifying vulnerabilities and risks from an analysis result, a means for visualizing the specified vulnerabilities and risks, and a means for proposing specific measures.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] Companies face cyber threats that evolve daily, making it difficult to accurately grasp their security situation and implement appropriate countermeasures in a timely manner using traditional methods. It is particularly challenging to effectively analyze massive amounts of security data and identify potential vulnerabilities and risks. Furthermore, organizations lacking security expertise find it difficult to respond efficiently, which can result in a decline in security awareness and the occurrence of serious security incidents. Therefore, a new approach is needed to resolve these issues and strengthen corporate cybersecurity. [Means for solving the problem]

[0005] The present invention is a system for analyzing a company's information technology security status, and includes the following means: First, a means for collecting security data is provided. Next, a means for preprocessing the collected security data is provided, converting the data into a format that is easy to analyze. Furthermore, a means for using generative artificial intelligence to analyze the preprocessed data is provided. This generative artificial intelligence executes algorithms such as anomaly detection, vulnerability scanning, and intrusion detection. A means for identifying vulnerabilities and risks from the analysis results is provided, and a means for visualizing the identified vulnerabilities and risks is included. Finally, a means for proposing specific countermeasures is provided, supporting the organization in responding quickly and accurately. Log files and network traffic are collected as security data, and the generative artificial intelligence performs anomaly detection, vulnerability scanning, and intrusion detection, thereby strengthening the company's cybersecurity.

[0006] "Security data" is data about the operation of a company's systems and networks, including log files, network traffic, and system configuration information.

[0007] A "log file" is recorded data generated by a system or software during its execution, and includes user operations, system errors, access records, etc.

[0008] "Network traffic" refers to information that describes the flow of data packets over a network, including the type and amount of data being sent and received, and the IP addresses of the sender and receiver.

[0009] "Preprocessing" is the process of formatting and organizing data to make it easier to analyze, and involves cleaning and normalizing the data, removing unnecessary data, etc.

[0010] "Generative AI" is artificial intelligence that uses machine learning and deep learning techniques to analyze data and recognize patterns and make predictions.

[0011] A "vulnerability" is a security weakness in a system or network that may lead to external attacks or unauthorized access.

[0012] "Risk" refers to a potential security problem caused by the existence of a vulnerability, and refers to damage such as information leakage or system loss.

[0013] "Visualization" refers to displaying analytical results in a visually easy-to-understand format, providing information using graphs, charts, and dashboards.

[0014] "Countermeasures" refer to specific actions or configuration changes to address identified vulnerabilities or risks, including applying patches, taking steps to block unauthorized access, and changing system settings.

[0015] "Anomaly detection" is the process of detecting abnormal behavior or events that deviate from normal patterns of behavior, and is a method for identifying unauthorized access or malware activity.

[0016] A "vulnerability scan" is a method of automatically detecting potential vulnerabilities in a system or network by comparing them with a database of known vulnerabilities.

[0017] "Intrusion detection" is a technology that detects unauthorized access to networks and systems in real time, and is a method for early detection of traces of intrusion. [Brief explanation of the drawings]

[0018] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3]FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 11] FIG. 3 is a sequence diagram showing a processing flow of the data processing system according to the first embodiment. [Figure 12] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 1. [Figure 13] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system according to the second embodiment when an emotion engine is combined. [Figure 14] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 2 when an emotion engine is combined. DETAILED DESCRIPTION OF THE INVENTION

[0019] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0020] First, the terms used in the following description will be explained.

[0021] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, a processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), and an APU (Accelerated Processing Unit).

[0022] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0023] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0024] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), Bluetooth (registered trademark), etc.

[0025] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0026] [First embodiment]

[0027] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0028] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0029] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0030] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0031] The reception device 38 includes a touch panel 38A, a microphone 38B, and the like, and receives user input. The touch panel 38A detects contact with an indicator (for example, a pen or a finger) to receive user input by the touch of the indicator. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0032] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form of expression that the user 20 can perceive (for example, audio and / or text). The display 40A displays visible information such as text and images in accordance with instructions from the processor 46. The speaker 40B outputs audio in accordance with instructions from the processor 46. The camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0033] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0034] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0035] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0036] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0037] In the smart device 14, the processor 46 performs the reception output process. The storage 50 stores a reception output program 60. The reception output program 60 is used in conjunction with the specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0038] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0039] The present invention relates to a system for analyzing the information technology security status of an enterprise, and can be specifically implemented as follows.

[0040] This system collects corporate security data, preprocesses it, and analyzes it using generative artificial intelligence. It then identifies and visualizes vulnerabilities and risks from the analysis results. The system also includes a means to propose specific countermeasures.

[0041] The program's processing is explained below in natural language.

[0042] Data collection

[0043] The server collects log files from each company's terminals. The log files include operation logs, system errors, and access records. In addition, the server captures network traffic data in real time through a network traffic monitor. This collected data is then centrally collected and stored for later analysis.

[0044] Data Preprocessing

[0045] The server preprocesses the collected log files and network traffic data. Specifically, it unifies log data in different formats and standardizes timestamps. It also removes unnecessary and duplicate data. This preprocessing converts the data into a format that is easy to analyze.

[0046] AI analysis

[0047] To analyze the pre-processed data, the server uses generative artificial intelligence, which runs anomaly detection, vulnerability scanning, and intrusion detection algorithms, such as detecting repeated unauthorized access attempts from a particular IP address or identifying software versions or system settings that match known vulnerabilities.

[0048] Identifying vulnerabilities and risks

[0049] The server identifies vulnerabilities and risks based on the results of AI analysis. For example, if high-risk vulnerabilities are identified, they are prioritized accordingly and their potential impact on the company is assessed.

[0050] visualization

[0051] The server uses a visualization tool to visually display the analysis results. This display is provided in the form of a dashboard, using graphs and charts in an intuitive and easy-to-understand format. For example, it is easy to identify which vulnerabilities pose the highest risk.

[0052] Action proposals

[0053] The server then suggests specific measures to the user, such as blocking specific IP addresses with a firewall or updating all device software with the latest patches. Users can then take action quickly and accurately based on these suggestions.

[0054] Specific examples

[0055] For example, if a suspicious traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time. Next, generative AI analyzes the data and identifies the abnormal pattern. Based on the analysis results, the server classifies communications from a specific IP address as high-risk and displays that risk using a visualization tool. Finally, the server suggests updating the firewall settings to block the suspicious traffic.

[0056] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures to improve security awareness and protect against cyber threats.

[0057] The processing flow will be explained below.

[0058] Step 1: Data collection

[0059] The server collects log files from each terminal. Agent software is installed on the terminal and configured to transfer operation logs, system errors, access records, etc. to the server.

[0060] The server uses a network traffic monitor to monitor network traffic, capturing data packets in real time, which are then temporarily stored for later analysis.

[0061] Step 2: Data Preprocessing

[0062] Normalizing log file and network traffic data collected by the server, for example, converting timestamps from different time zones into a uniform format.

[0063] Remove unnecessary and redundant information from the data pre-processed by the server, especially removing irrelevant system backup logs and redundantly logged events.

[0064] Step 3: AI analysis

[0065] The server analyzes the pre-processed data with raw artificial intelligence, which runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection.

[0066] Specifically, the server detects repeated unauthorized access attempts from a specific IP address and identifies software versions and system settings that match known vulnerabilities.

[0067] Step 4: Identifying vulnerabilities and risks

[0068] The server identifies vulnerabilities and risks based on the results of AI analysis. For example, if a high-risk vulnerability is discovered, it will provide detailed information and assess its impact.

[0069] Based on the analysis results, risks are ranked and the priority of countermeasures is determined.

[0070] Step 5: Visualization

[0071] The server visually displays the analysis results using a visualization tool, presenting the results in a dashboard format using graphs and charts for easy user understanding.

[0072] For example, it allows you to identify at a glance which vulnerabilities pose the highest risk.

[0073] Step 6: Action proposals

[0074] The server then suggests specific measures to the user, such as blocking specific IP addresses with a firewall or instructing them to update all device software to the latest patches.

[0075] Users can act quickly and intelligently based on these suggestions, for example, updating firewall rules to block suspicious traffic.

[0076] Example 1

[0077] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0078] It is important to efficiently and effectively analyze a company's information technology security status and quickly identify potential vulnerabilities and risks. However, conventional systems require complex and time-consuming data collection, preprocessing, and analysis methods, making it difficult to respond in real time. Furthermore, the lack of visualization of analysis results and the lack of specific countermeasure proposals makes it difficult for security personnel to take appropriate action.

[0079] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0080] In this invention, the server includes means for collecting record data from each device in the company, means for preprocessing the collected record data, means for using generative AI to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visually displaying the identified vulnerabilities and risks, and means for proposing specific countermeasures. This enables fast and efficient collection and preprocessing of record data, advanced analysis using a generative AI model, and the proposal of specific countermeasures based on the visualized analysis results.

[0081] "Each device of the company" refers to all computers, servers, routers, switches, and other network devices located within the company.

[0082] "Recorded data" refers to any data collected for security analysis, such as operation logs, system errors, access records, and network traffic data.

[0083] "Preprocessing" refers to processes such as standardizing the data format, standardizing timestamps, and deleting unnecessary and duplicate data in order to prepare the collected recorded data in an analyzable format.

[0084] "Generative AI" refers to AI technology used to analyze collected data and perform functions such as anomaly detection, vulnerability scanning, and intrusion detection.

[0085] "Analysis results" refers to the output obtained when generative AI analyzes preprocessed data, and refers to data that contains potential vulnerabilities and risks.

[0086] "Vulnerability" refers to security holes, defects, and parts of information systems and networks that may be subject to attack.

[0087] "Risk" refers to the potential security incidents that may occur if a particular vulnerability is exploited, and the scope of their impact.

[0088] "Visual display" refers to displaying the analysis results in the form of graphs, charts, or dashboards so that users can intuitively understand them.

[0089] "Specific measures" refer to the countermeasures and course of action that should be taken in response to identified vulnerabilities and risks, such as updating firewall settings and applying software patches.

[0090] The present invention relates to a system for analyzing the information technology security status of an enterprise, which can be implemented in the following specific configurations.

[0091] This system collects recorded data from each device in a company, preprocesses it, and analyzes it using generative artificial intelligence. It then identifies vulnerabilities and risks from the analysis results and visually displays them. It also includes a means to propose specific countermeasures.

[0092] Data collection

[0093] The server collects recorded data such as operation logs, system errors, and access records from each company's terminals. In addition, the server captures network traffic data in real time through a network traffic monitor. This data is then centrally stored in the server's database. Specifically, network traffic is captured using tools such as "Wireshark."

[0094] Data Preprocessing

[0095] The log files and network traffic data collected by the server are preprocessed. Specifically, the data format is unified using the "Pandas" library, and timestamps are standardized. Also, unnecessary and duplicate data is removed to make the data easier to analyze. This preprocessing converts the data into a format that is easy to analyze.

[0096] AI analysis

[0097] To analyze the preprocessed data, the server uses a generative AI model built using Tensorflow (registered trademark) and PyTorch to perform algorithms for anomaly detection, vulnerability scanning, and intrusion detection. It identifies successive unauthorized access attempts from specific IP addresses and software versions and system settings that match known vulnerabilities.

[0098] Identifying vulnerabilities and risks

[0099] The server identifies vulnerabilities and risks based on the results of AI analysis. To do this, it scores vulnerabilities using evaluation criteria such as the Common Vulnerability Scoring System (CVSS). Vulnerabilities are sorted in descending order and their impact is assessed.

[0100] visualization

[0101] The server uses visualization tools to visually display the analysis results. This display is provided in the form of a dashboard using tools such as Tableau or Grafana. Graphs and charts are used to display the results in a format that is intuitive and easy for users to understand. For example, it makes it easy to identify high-risk vulnerabilities.

[0102] Action proposals

[0103] The server then suggests specific countermeasures to the user, such as blocking specific IP addresses with a firewall or updating all device software with the latest patches.The user can then take prompt and appropriate action based on these suggestions.

[0104] Specific examples

[0105] For example, if an abnormal traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time using tools such as Wireshark. Next, generative artificial intelligence using TensorFlow analyzes the data and identifies the abnormal pattern. Based on the analysis results, the server classifies communications from specific IP addresses as high risk and visually displays that risk in Tableau. Finally, the server suggests updating the firewall settings to block the suspicious traffic.

[0106] Example prompt sentence:

[0107] Create a system that automatically collects data when an abnormal traffic pattern occurs from a specific device within the company's network, preprocesses the data using Python's Pandas and Datetime, and then uses TensorFlow to detect the anomaly. Create a system that visualizes the results in Tableau and suggests necessary measures to the user.

[0108] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures to improve security awareness and protect against cyber threats.

[0109] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0110] Step 1:

[0111] The server collects recorded data from each device in the company.

[0112] Specifically, the system collects operation logs, system errors, and access records generated by the terminals in real time and sends them to the server. In addition, the server uses a network traffic monitor such as Wireshark to capture network traffic data in real time. The input includes operation logs, system errors, access records, and network traffic data, and the output stores this data in a centralized database on the server.

[0113] Step 2:

[0114] The server preprocesses the collected recording data.

[0115] Specifically, the server uses the Pandas library to unify data from multiple different formats, standardizes timestamps using the Datetime module, and removes unnecessary and duplicate data using functions such as drop_duplicates. Inputs include raw operation logs, system errors, access records, and network traffic data extracted from a centralized database, and output provides preprocessed data in a format that can be analyzed.

[0116] Step 3:

[0117] The server uses the generative AI model to analyze the preprocessed data.

[0118] Specifically, the server uses frameworks such as TensorFlow and PyTorch to run algorithms for anomaly detection, vulnerability scanning, and intrusion detection. It extracts specific features and performs analysis based on those features. The input includes preprocessed data, and the output is analysis results related to identified anomaly patterns, vulnerabilities, and risks.

[0119] Step 4:

[0120] The server identifies vulnerabilities and risks from the analysis results.

[0121] Specifically, the server scores vulnerabilities using evaluation criteria such as CVSS based on the analysis result data. Vulnerabilities are prioritized in descending order and their impact is assessed. The input is the analysis result data obtained from the generative AI model, and the output is a prioritized list of vulnerabilities and risks.

[0122] Step 5:

[0123] The server visually displays the analysis results using a visualization tool.

[0124] Specifically, visualization tools such as Tableau and Grafana are used to display the analysis results in the form of a dashboard. Graphs and charts are used to visualize the results in a format that is intuitively easy for users to understand. The input is a prioritized list of vulnerabilities and risks, and the output is a visually displayed dashboard.

[0125] Step 6:

[0126] The server proposes specific measures to the user.

[0127] Specifically, this includes suggestions for blocking specific IP addresses with a firewall, updating all terminal software with the latest patches, etc. The input is the visualized analysis results and a list of vulnerabilities, and the output is a specific action plan that the user should implement.

[0128] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures to improve security awareness and protect against cyber threats.

[0129] (Application example 1)

[0130] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0131] There is a need to efficiently and quickly analyze a company's information technology security status, identify vulnerabilities and risks in real time, and quickly implement appropriate countermeasures. However, current technology does not fully provide the means to provide analysis results in real time and enable immediate response, making it difficult for administrators to quickly implement appropriate countermeasures. In addition, there is a lack of security monitoring software for mobile devices, making it difficult for administrators to effectively monitor and respond to the situation even when they are away from the office.

[0132] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0133] In this invention, the server includes means for collecting security data, means for preprocessing the collected security data, means for using a generation system to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visualizing the identified vulnerabilities and risks, means for proposing specific countermeasures, and software for mobile terminals that provides the analysis results in real time and enables a prompt response to risks, thereby enabling efficient analysis of a company's information technology security status and a prompt and accurate response to threats.

[0134] "Security data" refers to data including operational logs, system errors, access records, and network traffic information related to a company's information technology environment.

[0135] "Preprocessing" is the process of converting collected security data into a unified format, removing unnecessary and duplicate data, and preparing the data in a format that is easy to analyze.

[0136] A "generative system" refers to an artificial intelligence or machine learning model that makes specific perceptions or predictions based on data.

[0137] A "vulnerability" is a security weakness or flaw that exists in an information system.

[0138] "Risk" refers to the potential damage or impact caused by the exploitation of a security vulnerability.

[0139] "Software for mobile devices" is a program that runs on mobile electronic devices such as smartphones and tablets and monitors, analyzes, and displays security status in real time.

[0140] "Real-time" refers to data collection, processing, and display occurring almost instantaneously.

[0141] "Visualization" refers to displaying the results of data analysis in a visual format such as a graph or chart, making it easier to understand intuitively.

[0142] "Specific measures" are action plans that prescribe remediation and defense measures for identified vulnerabilities and risks.

[0143] To implement this invention, a system for analyzing the information technology security status of a company is required. This system is composed of a server, a mobile terminal, and a network that links them.

[0144] First, the server collects security data from each company's terminals. This security data includes operation logs, system errors, access records, and network traffic information. Because this data is provided in various formats, the server collects the data in bulk and converts it into a unified format. In this preprocessing step, unnecessary and duplicate data is deleted and timestamps are standardized.

[0145] The pre-processed data is then analyzed using a generative system that uses generative artificial intelligence models that run algorithms for anomaly detection, vulnerability scanning, and intrusion detection. Specifically, a server scales the data and feeds it into the artificial intelligence models to detect anomalous patterns and vulnerabilities.

[0146] Once vulnerabilities and risks are identified from the analysis results, the server provides this information in real time to mobile device software, which runs on mobile devices such as smartphones and tablets and displays the results visually, for example, using graphs and charts to visualize vulnerabilities and risks in an intuitive format.

[0147] The server then suggests specific countermeasures, such as blocking specific IP addresses or updating all device software with the latest patches, based on the identified vulnerabilities and risks. Users can then take action quickly and accurately based on these suggestions.

[0148] As a concrete example, consider the case where a series of unauthorized access attempts are detected from a specific IP address within a company's network. The server captures and preprocesses this information in real time. Next, generative artificial intelligence analyzes the data and identifies abnormal patterns. Based on the analysis results, the server classifies communications from the specific IP address as high-risk and visualizes this risk in mobile device software. Finally, the server suggests updating the firewall settings to the user and block the suspicious traffic.

[0149] This system enables real-time monitoring and analysis of a company's information technology security status, enabling prompt and appropriate countermeasures to be taken.

[0150] Prompt Sentence Examples

[0151] "Please suggest a way to identify and block IP addresses that have consecutive failed login attempts within the corporate network."

[0152] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0153] Step 1:

[0154] The server collects security data from each company's terminals. Specifically, it centralizes operation logs, system errors, access records, and network traffic data. The input is raw data collected from each company's terminals, and the output is integrated security data.

[0155] Step 2:

[0156] It preprocesses security data collected by the server, standardizing log data in different formats, unifying timestamps, and removing unnecessary and duplicate data. The input is the collected raw data, and the output is preprocessed data that has been converted into an easy-to-analyze format.

[0157] Step 3:

[0158] The server uses a generative AI model to analyze the preprocessed data. The model runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection to perform the analysis. The input is the preprocessed data, and the output is the detection results for anomalies, vulnerabilities, and intrusions.

[0159] Step 4:

[0160] The server identifies vulnerabilities and risks from the analysis results. Specifically, it identifies unauthorized access attempts from specific IP addresses, and software versions and system settings that match known vulnerabilities. The input is the analysis results, and the output is the identified vulnerabilities and risks.

[0161] Step 5:

[0162] The server provides the identified vulnerabilities and risks to mobile device software, which runs on smartphones and tablets and visualizes the analysis results in real time. The input is the identified vulnerability and risk information, and the output is the visualized analysis results.

[0163] Step 6:

[0164] Users use software for mobile devices to check the status of vulnerabilities and risks. The input is visualized analysis results, allowing users to easily understand the situation.

[0165] Step 7:

[0166] The server then suggests specific countermeasures to the user, such as blocking specific IP addresses with a firewall or updating all device software with the latest patches. The input is the identified vulnerabilities and risks, and the output is specific actionable countermeasure suggestions.

[0167] Furthermore, an emotion engine that estimates the user's emotion may be combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0168] The present invention relates to a system that analyzes an enterprise's information technology security situation and combines it with an emotion engine that recognizes user emotions, and can be specifically implemented as follows.

[0169] The system collects corporate security data, preprocesses it, and analyzes it using generative artificial intelligence. It then identifies and visualizes vulnerabilities and risks from the analysis results. It also includes a means to adjust the priority of security reports and countermeasure proposals using an emotion engine that recognizes user emotions.

[0170] The program's processing is explained below in natural language.

[0171] Data collection

[0172] The server collects log files from each company's terminals. The log files include operation logs, system errors, and access records. In addition, the server captures network traffic data in real time through a network traffic monitor. This collected data is then centrally collected and stored for later analysis.

[0173] Data Preprocessing

[0174] The server preprocesses the collected log files and network traffic data. Specifically, it unifies log data in different formats and standardizes timestamps. It also removes unnecessary and duplicate data. This preprocessing converts the data into a format that is easy to analyze.

[0175] AI analysis

[0176] To analyze the pre-processed data, the server uses generative artificial intelligence, which runs anomaly detection, vulnerability scanning, and intrusion detection algorithms, such as detecting repeated unauthorized access attempts from a particular IP address or identifying software versions or system settings that match known vulnerabilities.

[0177] Identifying vulnerabilities and risks

[0178] The server identifies vulnerabilities and risks from the results of AI analysis. For example, if a high-risk vulnerability is discovered, it evaluates its detailed information and impact. Based on the analysis results, it ranks the risks and determines the priority of countermeasures.

[0179] visualization

[0180] The server uses a visualization tool to visually display the analysis results. This display is provided in the form of a dashboard, using graphs and charts in an intuitive and easy-to-understand format. For example, it is easy to identify which vulnerabilities pose the highest risk.

[0181] Emotion Recognition and Action Suggestion

[0182] Furthermore, the server analyzes the user's emotions using an emotion engine. The emotion engine recognizes the user's emotions in real time and evaluates their stress and anxiety levels. For example, if a user checking a security report is feeling high levels of stress, the emotion engine will detect this and suggest countermeasures that need to be prioritized. Conversely, if the user is calm, the engine can provide detailed explanations and suggest multi-step procedures.

[0183] Specific examples

[0184] For example, if a suspicious traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time. Generative AI then analyzes the data to identify anomalous patterns. Based on the analysis results, the server classifies communications from specific IP addresses as high-risk and displays that risk using a visualization tool.

[0185] The emotion engine then analyzes the user's emotions. If the user is feeling highly stressed, it will prioritize suggesting blocking specific IP addresses with a firewall as the most important measure. If the user responds quickly to this suggestion, it can minimize security risks. If the user is calm, it can recommend detailed forensic analysis and additional security hardening steps.

[0186] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures while taking into account user sentiment, thereby improving security awareness and protecting against cyber threats.

[0187] The processing flow will be explained below.

[0188] Step 1: Data collection

[0189] The server collects log files from each terminal. These log files include operation logs, system errors, and access records. Agent software installed on the terminal periodically transfers these log files from the server to the server.

[0190] The server captures network traffic data in real time through a network traffic monitor, which is then stored for analysis.

[0191] Step 2: Data Preprocessing

[0192] The server preprocesses the collected log files and network traffic data to unify the data format and standardize timestamps.

[0193] The server removes unnecessary and duplicated data during the preprocessing process, which improves analysis accuracy.

[0194] Step 3: AI analysis

[0195] The server analyzes the pre-processed data using generative artificial intelligence, which runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection.

[0196] Specifically, the server detects repeated unauthorized access attempts from a specific IP address, or identifies software versions or system settings that match known vulnerabilities.

[0197] Step 4: Identifying vulnerabilities and risks

[0198] The server identifies vulnerabilities and risks based on the results of AI analysis. For example, if a high-risk vulnerability is discovered, it provides detailed information and evaluates its impact.

[0199] Rank risks and prioritize responses.

[0200] Step 5: Visualization

[0201] The server visually displays the analysis results using a visualization tool, presenting the results in a dashboard format using graphs and charts for easy user understanding.

[0202] For example, it allows you to identify at a glance which vulnerabilities pose the highest risk.

[0203] Step 6: Emotion Recognition

[0204] The server analyzes the user's emotions using an emotion engine, which recognizes emotions in real time from the user's facial expressions, voice, and input content, and evaluates the level of stress and anxiety.

[0205] For example, if a user is feeling high stress, emotional data about that feeling is collected and reflected in subsequent countermeasure proposals.

[0206] Step 7: Action proposals

[0207] The server then suggests specific measures to the user, such as blocking specific IP addresses with a firewall or instructing them to update all device software to the latest patches.

[0208] If the user feels high stress based on the emotion engine, the server will prioritize important countermeasures, while if the user feels calm, it will also suggest detailed explanations and additional steps.

[0209] Step 8: Implement and Reassess

[0210] The user implements the suggested measures, for example, updating firewall rules to block suspicious traffic.

[0211] In order to reassess the system status after the server has implemented countermeasures, data is collected and analyzed again to reconfirm vulnerabilities and risks.

[0212] Example 2

[0213] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0214] Conventional security analysis systems collect, preprocess, and visualize the analysis results of security data, but they are unable to propose countermeasures that take the user's emotional state into account. This means that they are forced to respond without considering the user's stress and anxiety, making it difficult to quickly and effectively address security risks. Furthermore, because there is no way to adjust the priority of specific countermeasures based on the user's emotional state, it is not always possible to obtain user acceptance or cooperation in implementing countermeasures.

[0215] The specific processing by the specific processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means.

[0216] In this invention, the server includes means for collecting security data, means for preprocessing the collected security data, means for using generative artificial intelligence to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visualizing the identified vulnerabilities and risks, means for detecting the emotional state of the user, means for adjusting the priority of countermeasures based on the emotional state, and means for proposing specific countermeasures. This makes it possible to propose effective countermeasures taking the user's emotional state into consideration, thereby realizing a prompt and optimal response to security risks.

[0217] "Security data" refers to data such as log files and network traffic collected to analyze a company's information technology security status.

[0218] "Preprocessing" refers to processes such as standardizing formats, standardizing timestamps, and deleting unnecessary and duplicate data in order to convert collected data into a format that is easier to analyze.

[0219] "Generative AI" is AI that analyzes data using algorithms and machine learning models for anomaly detection, vulnerability scanning, and intrusion detection.

[0220] A "vulnerability" is a security flaw or weakness that exists in a system or software.

[0221] "Risk" is an assessment of the extent to which a particular vulnerability or abnormal activity could affect systems and data.

[0222] "Visualization" means visually displaying analysis results and risks in an easy-to-understand format (e.g., graphs and charts).

[0223] "Emotional state" refers to the user's emotional response to checking the security report and the proposed measures, such as stress or anxiety.

[0224] "Countermeasure priority" refers to the ordering of countermeasures to be implemented for identified vulnerabilities and risks based on urgency and importance.

[0225] "Countermeasure proposals" are proposals for specific actions or procedures to be taken to address identified vulnerabilities or risks.

[0226] MODE FOR CARRYING OUT THE INVENTION

[0227] The present invention relates to a system that analyzes the information technology security status of an enterprise and combines it with an emotion engine that recognizes the emotions of users. Specific embodiments of the system will be described below.

[0228] Data collection

[0229] The server collects log files from each company's terminals. These log files include operation logs, system errors, and access records. In addition, the server uses a network traffic monitor to capture network traffic data in real time. This data is stored in a database. This method aggregates basic data to grasp the overall picture of the company's security status.

[0230] Data Preprocessing

[0231] The server preprocesses the collected log files and network traffic data. Specifically, it unifies log data in different formats, standardizes timestamps, and removes unnecessary and duplicate data. This preprocessing converts the data into a format that is easy to analyze.

[0232] AI analysis

[0233] The server uses generative artificial intelligence (AI) to analyze the pre-processed data. This AI runs anomaly detection, vulnerability scanning, and intrusion detection algorithms. For example, it can detect repeated unauthorized access attempts from a specific IP address or identify software versions or system configurations that match known vulnerabilities. This analysis reveals potential threats present on the system.

[0234] Identifying vulnerabilities and risks

[0235] The server identifies vulnerabilities and risks from the results of AI analysis. Specifically, it evaluates the detailed information and impact of high-risk vulnerabilities discovered. Based on the analysis results, it ranks the identified risks and determines the priority of countermeasures. This allows effective security measures to be implemented quickly.

[0236] visualization

[0237] The server visually displays the analysis results using a visualization tool. The results are presented in a dashboard format, using graphs and charts in an intuitive and easy-to-understand format, making it easy to identify the highest-risk vulnerabilities.

[0238] Emotion Recognition and Action Suggestion

[0239] The server analyzes the user's emotions using an emotion engine, which evaluates in real time the stress and anxiety the user feels when using the system. For example, if a user feels high levels of stress while reviewing a security report, the emotion engine will detect this and prioritize suggesting the most important countermeasures. Conversely, if the user is calm, the engine will suggest countermeasures that include detailed explanations and multi-step procedures.

[0240] Specific examples

[0241] For example, if a suspicious traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time. Generative AI then analyzes the data to identify abnormal patterns. Based on the analysis results, the server classifies communications from a specific IP address as high risk and displays that risk using a visualization tool.

[0242] The emotion engine then analyzes the user's emotions. If the user is feeling highly stressed, the most important countermeasure will be prioritized, suggesting blocking specific IP addresses with a firewall. If the user responds quickly to this suggestion, security risks will be minimized. Conversely, if the user is calm, detailed forensic analysis and additional security hardening steps will be suggested.

[0243] Prompt Sentence Examples

[0244] Here are some example prompts to input to a generative AI model:

[0245] "Please provide details of a system that detects, analyzes, and provides user-sensitive suggestions on how to address suspicious traffic patterns on a corporate network."

[0246] In this way, the present invention efficiently analyzes a company's information technology security situation and takes appropriate measures while taking into account user sentiment, thereby improving security awareness and protecting against cyber threats.

[0247] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0248] Step 1: Data collection

[0249] The server collects log files from each terminal in the company. As input, it reads operation logs, system errors, and access records from each terminal. The server also uses a network traffic monitor to capture network traffic data in real time. This data includes specific IP addresses, port information, and the contents of data packets. As output, all collected data is stored in a database, forming the basis for analyzing the company's security status. It is desirable for this collection work to be performed periodically or continuously.

[0250] Step 2: Data Preprocessing

[0251] The server preprocesses the collected log files and network traffic data. The inputs are raw log files and network traffic data stored in a database. Specific operations include unifying log data in different formats and standardizing timestamps. It also removes unnecessary and duplicate data. After the data cleaning is complete, the output is a unified dataset in an easy-to-analyze format. This dataset is ready for use in the next step, AI analysis.

[0252] Step 3: AI analysis

[0253] The server uses generative artificial intelligence (AI) to analyze the preprocessed data set. The preprocessed data is passed as input. Specifically, the AI ​​runs anomaly detection, vulnerability scanning, and intrusion detection algorithms. For example, it might detect repeated unauthorized access attempts from a specific IP address and check whether software versions and system configurations match known vulnerabilities. The output is an analysis result, which generates a list of potential system vulnerabilities and anomalous activity.

[0254] Step 4: Identifying vulnerabilities and risks

[0255] The server identifies vulnerabilities and risks from the results of the AI ​​analysis. The AI ​​analysis results are used as input. Specifically, it evaluates the details and impact of discovered high-risk vulnerabilities, including which system part the vulnerability affects, the scope of impact, and how frequently it occurs. The output is a list of vulnerabilities with a risk ranking and the prioritization of countermeasures. This information is passed to the next visualization step.

[0256] Step 5: Visualization

[0257] The server visualizes vulnerability and risk data. The input is the list of vulnerabilities with risk rankings identified in the previous step. Specifically, it uses a visualization tool to generate graphs and charts in a dashboard format. The output is provided in a visually easy-to-understand format, allowing users to easily identify high-risk vulnerabilities and their countermeasure status, helping users make decisions.

[0258] Step 6: Emotion recognition and action suggestions

[0259] The server uses an emotion engine to analyze the user's emotions. Inputs include reaction data regarding security report confirmation and countermeasure proposals when the user operates the system. Specifically, the emotion engine evaluates the user's stress and anxiety in real time and adjusts the priority of countermeasures based on this. The output generates countermeasure proposals according to the user's emotional state. For example, when the user is highly stressed, it prioritizes quick countermeasures, and when the user is relaxed, it provides detailed explanations. This output is presented to the user, encouraging them to take appropriate action.

[0260] (Application example 2)

[0261] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0262] Modern companies face many information technology security risks and are required to quickly and effectively identify these risks and implement appropriate countermeasures. However, conventional systems suggest countermeasures without considering the user's emotions, which can lead to users overlooking important information or failing to implement appropriate countermeasures. These problems are particularly pronounced when users are experiencing high levels of stress or anxiety. Therefore, a new system is needed that can efficiently and effectively analyze a company's information technology security situation and suggest appropriate countermeasures based on the user's emotions.

[0263] The identification processing by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for collecting security data, means for preprocessing the collected security data, means for using generative artificial intelligence to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visualizing the identified vulnerabilities and risks, means for recognizing user emotions, and means for dynamically proposing specific countermeasures based on the user emotions. This enables companies to effectively monitor and analyze the information technology security status in real time and take appropriate countermeasures that take into account the user's emotional state.

[0264] "Security data" refers to operation logs, system errors, access records, and network traffic data collected from each terminal and server within the company.

[0265] "Preprocessing" refers to data processing such as standardizing formats to convert collected security data into a format that is easier to analyze, standardizing timestamps, and deleting unnecessary data.

[0266] "Generative AI" refers to advanced AI techniques for analyzing large amounts of data and performing anomaly detection, vulnerability scanning, and intrusion detection.

[0267] "Vulnerability" refers to security holes and potential risks that exist in a system or network.

[0268] "Risk" refers to the potential security issues and impacts that may occur if a particular vulnerability is exploited.

[0269] "Visualization" refers to visually displaying analysis results in the form of graphs or charts so that users can intuitively understand them.

[0270] "Emotion recognition" refers to technology that analyzes a user's emotional state in real time.

[0271] "Dynamic suggestion" refers to changing the priority and specific content of measures according to the user's emotional state and instantly presenting the most appropriate measures.

[0272] "System" refers to a technical framework that encompasses an integrated set of means for collecting, pre-processing, analyzing, visualizing, recognizing emotions, and proposing countermeasures for security data.

[0273] The present invention relates to a system for efficiently and effectively analyzing the information technology security situation of a company and providing appropriate countermeasures taking into account user sentiment. This system is implemented by the following steps.

[0274] First, the server collects security data from each company's terminals and network devices, including operation logs, system errors, access records, and network traffic data, and then aggregates the collected data in one place and stores it for later analysis.

[0275] The server then pre-processes the collected data, which includes unifying log data in different formats, standardizing timestamps, and removing unnecessary and duplicate data, converting the data into a format that is easy to analyze.

[0276] The pre-processed data is then analyzed using generative artificial intelligence, which runs anomaly detection, vulnerability scanning, and intrusion detection algorithms to, for example, detect repeated unauthorized access attempts from a particular IP address or identify software versions or system configurations that match known vulnerabilities.

[0277] The server identifies vulnerabilities and risks from the analysis results. Specifically, if a high-risk vulnerability is discovered, it evaluates its detailed information and impact and assigns a risk ranking.

[0278] The identified vulnerabilities and risks are then visually displayed using a visualization tool. The display is presented in a dashboard format, with graphs and charts in an intuitive, easy-to-understand format, allowing users to easily identify the highest-risk vulnerabilities.

[0279] The server also uses an emotion recognition engine to analyze the user's emotions. This engine recognizes the user's emotions in real time and evaluates their stress and anxiety levels. For example, if the user feels high levels of stress while reviewing a security report, the emotion engine will detect this and suggest the necessary countermeasures as a priority. Conversely, if the user is calm, the server can provide detailed explanations and multi-step procedures.

[0280] A concrete example of this system is when a suspicious traffic pattern is detected from a specific device within a company's network. The server captures the information in real time and performs preprocessing. After that, the generative AI analyzes the data to identify abnormal patterns. Based on the analysis results, the server classifies communications from specific IP addresses as high risk and displays that risk using a visualization tool. The emotion engine then analyzes the user's emotions, and if the user is experiencing high stress, it prioritizes suggesting blocking the specific IP address via a firewall.

[0281] Example prompt sentence:

[0282] "Please describe what you do when a user feels frustrated while reviewing a security report. Please provide detailed instructions on how to quickly suggest blocking high-risk IP addresses."

[0283] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0284] Step 1:

[0285] The server collects security data from each company's terminals and network devices, specifically operation logs, system errors, access records, and network traffic data.

[0286] Input: Security data from each company's endpoints and network devices

[0287] Output: A consolidated collection of collected security data.

[0288] Step 2:

[0289] The server preprocesses the collected data, specifically by unifying log data in different formats, standardizing timestamps, and removing unnecessary and duplicate data.

[0290] Input: Security data collected in step 1

[0291] Output: Preprocessed security data

[0292] Step 3:

[0293] The server analyzes the pre-processed data using generative artificial intelligence, which runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection.

[0294] Input: Security data preprocessed in step 2

[0295] Output: Analysis results (anomaly detection results, vulnerability list, intrusion detection results)

[0296] Step 4:

[0297] The server identifies vulnerabilities and risks from the analysis results. Specifically, it ranks the risks based on the analysis results and identifies high-risk vulnerabilities.

[0298] Input: Analysis results obtained in step 3

[0299] Output: List of vulnerabilities and risks

[0300] Step 5:

[0301] The vulnerabilities and risks identified for a server are visually displayed using a visualization tool, presented in a dashboard format using graphs and charts for an intuitive understanding.

[0302] Input: List of vulnerabilities and risks obtained in step 4

[0303] Output: Visualized dashboard

[0304] Step 6:

[0305] The server analyzes the user's emotions using an emotion recognition engine, which recognizes the user's emotions in real time and assesses their stress and anxiety levels.

[0306] Input: Real-time user emotion data

[0307] Output: Evaluation result of the user's emotional state

[0308] Step 7:

[0309] The server dynamically suggests specific measures based on the user's emotional state. For example, if the user is feeling highly stressed, the server will prioritize the most important measures. Conversely, if the user is calm, the server will suggest detailed explanations and multi-step procedures.

[0310] Input: The evaluation result of the user's emotional state obtained in step 6, and the list of vulnerabilities and risks obtained in step 4

[0311] Output: Specific measures suggested to the user

[0312] Through these steps, the system can effectively monitor and analyze a company's information technology security situation in real time and provide appropriate countermeasures that take into account the user's emotional state.

[0313] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0314] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (registered trademark) (Internet search engine).<URL: https: / / openai.com / blog / chatgpt> ), Gemini (registered trademark) (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0315] In the above embodiment, an example in which the specific process is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific process may be performed by the smart device 14.

[0316] [Second embodiment]

[0317] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0318] 3, the data processing system 210 includes the data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0319] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0320] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0321] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0322] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0323] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0324] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0325] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0326] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0327] In the smart glasses 214, the reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0328] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal."

[0329] The present invention relates to a system for analyzing the information technology security status of an enterprise, and can be specifically implemented as follows.

[0330] This system collects corporate security data, preprocesses it, and analyzes it using generative artificial intelligence. It then identifies and visualizes vulnerabilities and risks from the analysis results. The system also includes a means to propose specific countermeasures.

[0331] The program's processing is explained below in natural language.

[0332] Data collection

[0333] The server collects log files from each company's terminals. The log files include operation logs, system errors, and access records. In addition, the server captures network traffic data in real time through a network traffic monitor. This collected data is then centrally collected and stored for later analysis.

[0334] Data Preprocessing

[0335] The server preprocesses the collected log files and network traffic data. Specifically, it unifies log data in different formats and standardizes timestamps. It also removes unnecessary and duplicate data. This preprocessing converts the data into a format that is easy to analyze.

[0336] AI analysis

[0337] To analyze the pre-processed data, the server uses generative artificial intelligence, which runs anomaly detection, vulnerability scanning, and intrusion detection algorithms, such as detecting repeated unauthorized access attempts from a particular IP address or identifying software versions or system settings that match known vulnerabilities.

[0338] Identifying vulnerabilities and risks

[0339] The server identifies vulnerabilities and risks based on the results of AI analysis. For example, if high-risk vulnerabilities are identified, they are prioritized accordingly and their potential impact on the company is assessed.

[0340] visualization

[0341] The server uses a visualization tool to visually display the analysis results. This display is provided in the form of a dashboard, using graphs and charts in an intuitive and easy-to-understand format. For example, it is easy to identify which vulnerabilities pose the highest risk.

[0342] Action proposals

[0343] The server then suggests specific measures to the user, such as blocking specific IP addresses with a firewall or updating all device software with the latest patches. Users can then take action quickly and accurately based on these suggestions.

[0344] Specific examples

[0345] For example, if a suspicious traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time. Next, generative AI analyzes the data and identifies the abnormal pattern. Based on the analysis results, the server classifies communications from a specific IP address as high-risk and displays that risk using a visualization tool. Finally, the server suggests updating the firewall settings to block the suspicious traffic.

[0346] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures to improve security awareness and protect against cyber threats.

[0347] The processing flow will be explained below.

[0348] Step 1: Data collection

[0349] The server collects log files from each terminal. Agent software is installed on the terminal and configured to transfer operation logs, system errors, access records, etc. to the server.

[0350] The server uses a network traffic monitor to monitor network traffic, capturing data packets in real time, which are then temporarily stored for later analysis.

[0351] Step 2: Data Preprocessing

[0352] Normalizing log file and network traffic data collected by the server, for example, converting timestamps from different time zones into a uniform format.

[0353] Remove unnecessary and redundant information from the data pre-processed by the server, especially removing irrelevant system backup logs and redundantly logged events.

[0354] Step 3: AI analysis

[0355] The server analyzes the pre-processed data with raw artificial intelligence, which runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection.

[0356] Specifically, the server detects repeated unauthorized access attempts from a specific IP address and identifies software versions and system settings that match known vulnerabilities.

[0357] Step 4: Identifying vulnerabilities and risks

[0358] The server identifies vulnerabilities and risks based on the results of AI analysis. For example, if a high-risk vulnerability is discovered, it will provide detailed information and assess its impact.

[0359] Based on the analysis results, risks are ranked and the priority of countermeasures is determined.

[0360] Step 5: Visualization

[0361] The server visually displays the analysis results using a visualization tool, presenting the results in a dashboard format using graphs and charts for easy user understanding.

[0362] For example, it allows you to identify at a glance which vulnerabilities pose the highest risk.

[0363] Step 6: Action proposals

[0364] The server then suggests specific measures to the user, such as blocking specific IP addresses with a firewall or instructing them to update all device software to the latest patches.

[0365] Users can act quickly and intelligently based on these suggestions, for example, updating firewall rules to block suspicious traffic.

[0366] Example 1

[0367] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0368] It is important to efficiently and effectively analyze a company's information technology security status and quickly identify potential vulnerabilities and risks. However, conventional systems require complex and time-consuming data collection, preprocessing, and analysis methods, making it difficult to respond in real time. Furthermore, the lack of visualization of analysis results and the lack of specific countermeasure proposals makes it difficult for security personnel to take appropriate action.

[0369] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0370] In this invention, the server includes means for collecting record data from each device in the company, means for preprocessing the collected record data, means for using generative AI to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visually displaying the identified vulnerabilities and risks, and means for proposing specific countermeasures. This enables fast and efficient collection and preprocessing of record data, advanced analysis using a generative AI model, and the proposal of specific countermeasures based on the visualized analysis results.

[0371] "Each device of the company" refers to all computers, servers, routers, switches, and other network devices located within the company.

[0372] "Recorded data" refers to any data collected for security analysis, such as operation logs, system errors, access records, and network traffic data.

[0373] "Preprocessing" refers to processes such as standardizing the data format, standardizing timestamps, and deleting unnecessary and duplicate data in order to prepare the collected recorded data in an analyzable format.

[0374] "Generative AI" refers to AI technology used to analyze collected data and perform functions such as anomaly detection, vulnerability scanning, and intrusion detection.

[0375] "Analysis results" refers to the output obtained when generative AI analyzes preprocessed data, and refers to data that contains potential vulnerabilities and risks.

[0376] "Vulnerability" refers to security holes, defects, and parts of information systems and networks that may be subject to attack.

[0377] "Risk" refers to the potential security incidents that may occur if a particular vulnerability is exploited, and the scope of their impact.

[0378] "Visual display" refers to displaying the analysis results in the form of graphs, charts, or dashboards so that users can intuitively understand them.

[0379] "Specific measures" refer to the countermeasures and course of action that should be taken in response to identified vulnerabilities and risks, such as updating firewall settings and applying software patches.

[0380] The present invention relates to a system for analyzing the information technology security status of an enterprise, which can be implemented in the following specific configurations.

[0381] This system collects recorded data from each device in a company, preprocesses it, and analyzes it using generative artificial intelligence. It then identifies vulnerabilities and risks from the analysis results and visually displays them. It also includes a means to propose specific countermeasures.

[0382] Data collection

[0383] The server collects recorded data such as operation logs, system errors, and access records from each company's terminals. In addition, the server captures network traffic data in real time through a network traffic monitor. This data is then centrally stored in the server's database. Specifically, network traffic is captured using tools such as "Wireshark."

[0384] Data Preprocessing

[0385] The log files and network traffic data collected by the server are preprocessed. Specifically, the data format is unified using the "Pandas" library, and timestamps are standardized. Also, unnecessary and duplicate data is removed to make the data easier to analyze. This preprocessing converts the data into a format that is easy to analyze.

[0386] AI analysis

[0387] To analyze the preprocessed data, the server uses a generative AI model built using TensorFlow and PyTorch to perform anomaly detection, vulnerability scanning, and intrusion detection algorithms, identifying successive unauthorized access attempts from specific IP addresses and software versions and system configurations that match known vulnerabilities.

[0388] Identifying vulnerabilities and risks

[0389] The server identifies vulnerabilities and risks based on the results of AI analysis. To do this, it scores vulnerabilities using evaluation criteria such as the Common Vulnerability Scoring System (CVSS). Vulnerabilities are sorted in descending order and their impact is assessed.

[0390] visualization

[0391] The server uses visualization tools to visually display the analysis results. This display is provided in the form of a dashboard using tools such as Tableau or Grafana. Graphs and charts are used to display the results in a format that is intuitive and easy for users to understand. For example, it makes it easy to identify high-risk vulnerabilities.

[0392] Action proposals

[0393] The server then suggests specific countermeasures to the user, such as blocking specific IP addresses with a firewall or updating all device software with the latest patches.The user can then take prompt and appropriate action based on these suggestions.

[0394] Specific examples

[0395] For example, if an abnormal traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time using tools such as Wireshark. Next, generative artificial intelligence using TensorFlow analyzes the data and identifies the abnormal pattern. Based on the analysis results, the server classifies communications from specific IP addresses as high risk and visually displays that risk in Tableau. Finally, the server suggests updating the firewall settings to block the suspicious traffic.

[0396] Example prompt sentence:

[0397] Create a system that automatically collects data when an abnormal traffic pattern occurs from a specific device within the company's network, preprocesses the data using Python's Pandas and Datetime, and then uses TensorFlow to detect the anomaly. Create a system that visualizes the results in Tableau and suggests necessary measures to the user.

[0398] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures to improve security awareness and protect against cyber threats.

[0399] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0400] Step 1:

[0401] The server collects recorded data from each device in the company.

[0402] Specifically, the system collects operation logs, system errors, and access records generated by the terminals in real time and sends them to the server. In addition, the server uses a network traffic monitor such as Wireshark to capture network traffic data in real time. The input includes operation logs, system errors, access records, and network traffic data, and the output stores this data in a centralized database on the server.

[0403] Step 2:

[0404] The server preprocesses the collected recording data.

[0405] Specifically, the server uses the Pandas library to unify data from multiple different formats, standardizes timestamps using the Datetime module, and removes unnecessary and duplicate data using functions such as drop_duplicates. Inputs include raw operation logs, system errors, access records, and network traffic data extracted from a centralized database, and output provides preprocessed data in a format that can be analyzed.

[0406] Step 3:

[0407] The server uses the generative AI model to analyze the preprocessed data.

[0408] Specifically, the server uses frameworks such as TensorFlow and PyTorch to run algorithms for anomaly detection, vulnerability scanning, and intrusion detection. It extracts specific features and performs analysis based on those features. The input includes preprocessed data, and the output is analysis results related to identified anomaly patterns, vulnerabilities, and risks.

[0409] Step 4:

[0410] The server identifies vulnerabilities and risks from the analysis results.

[0411] Specifically, the server scores vulnerabilities using evaluation criteria such as CVSS based on the analysis result data. Vulnerabilities are prioritized in descending order and their impact is assessed. The input is the analysis result data obtained from the generative AI model, and the output is a prioritized list of vulnerabilities and risks.

[0412] Step 5:

[0413] The server visually displays the analysis results using a visualization tool.

[0414] Specifically, visualization tools such as Tableau and Grafana are used to display the analysis results in the form of a dashboard. Graphs and charts are used to visualize the results in a format that is intuitively easy for users to understand. The input is a prioritized list of vulnerabilities and risks, and the output is a visually displayed dashboard.

[0415] Step 6:

[0416] The server proposes specific measures to the user.

[0417] Specifically, this includes suggestions for blocking specific IP addresses with a firewall, updating all terminal software with the latest patches, etc. The input is the visualized analysis results and a list of vulnerabilities, and the output is a specific action plan that the user should implement.

[0418] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures to improve security awareness and protect against cyber threats.

[0419] (Application example 1)

[0420] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0421] There is a need to efficiently and quickly analyze a company's information technology security status, identify vulnerabilities and risks in real time, and quickly implement appropriate countermeasures. However, current technology does not fully provide the means to provide analysis results in real time and enable immediate response, making it difficult for administrators to quickly implement appropriate countermeasures. In addition, there is a lack of security monitoring software for mobile devices, making it difficult for administrators to effectively monitor and respond to the situation even when they are away from the office.

[0422] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0423] In this invention, the server includes means for collecting security data, means for preprocessing the collected security data, means for using a generation system to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visualizing the identified vulnerabilities and risks, means for proposing specific countermeasures, and software for mobile terminals that provides the analysis results in real time and enables a prompt response to risks, thereby enabling efficient analysis of a company's information technology security status and a prompt and accurate response to threats.

[0424] "Security data" refers to data including operational logs, system errors, access records, and network traffic information related to a company's information technology environment.

[0425] "Preprocessing" is the process of converting collected security data into a unified format, removing unnecessary and duplicate data, and preparing the data in a format that is easy to analyze.

[0426] A "generative system" refers to an artificial intelligence or machine learning model that makes specific perceptions or predictions based on data.

[0427] A "vulnerability" is a security weakness or flaw that exists in an information system.

[0428] "Risk" refers to the potential damage or impact caused by the exploitation of a security vulnerability.

[0429] "Software for mobile devices" is a program that runs on mobile electronic devices such as smartphones and tablets and monitors, analyzes, and displays security status in real time.

[0430] "Real-time" refers to data collection, processing, and display occurring almost instantaneously.

[0431] "Visualization" refers to displaying the results of data analysis in a visual format such as a graph or chart, making it easier to understand intuitively.

[0432] "Specific measures" are action plans that prescribe remediation and defense measures for identified vulnerabilities and risks.

[0433] To implement this invention, a system for analyzing the information technology security status of a company is required. This system is composed of a server, a mobile terminal, and a network that links them.

[0434] First, the server collects security data from each company's terminals. This security data includes operation logs, system errors, access records, and network traffic information. Because this data is provided in various formats, the server collects the data in bulk and converts it into a unified format. In this preprocessing step, unnecessary and duplicate data is deleted and timestamps are standardized.

[0435] The pre-processed data is then analyzed using a generative system that uses generative artificial intelligence models that run algorithms for anomaly detection, vulnerability scanning, and intrusion detection. Specifically, a server scales the data and feeds it into the artificial intelligence models to detect anomalous patterns and vulnerabilities.

[0436] Once vulnerabilities and risks are identified from the analysis results, the server provides this information in real time to mobile device software, which runs on mobile devices such as smartphones and tablets and displays the results visually, for example, using graphs and charts to visualize vulnerabilities and risks in an intuitive format.

[0437] The server then suggests specific countermeasures, such as blocking specific IP addresses or updating all device software with the latest patches, based on the identified vulnerabilities and risks. Users can then take action quickly and accurately based on these suggestions.

[0438] As a concrete example, consider the case where a series of unauthorized access attempts are detected from a specific IP address within a company's network. The server captures and preprocesses this information in real time. Next, generative artificial intelligence analyzes the data and identifies abnormal patterns. Based on the analysis results, the server classifies communications from the specific IP address as high-risk and visualizes this risk in mobile device software. Finally, the server suggests updating the firewall settings to the user and block the suspicious traffic.

[0439] This system enables real-time monitoring and analysis of a company's information technology security status, enabling prompt and appropriate countermeasures to be taken.

[0440] Prompt Sentence Examples

[0441] "Please suggest a way to identify and block IP addresses that have consecutive failed login attempts within the corporate network."

[0442] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0443] Step 1:

[0444] The server collects security data from each company's terminals. Specifically, it centralizes operation logs, system errors, access records, and network traffic data. The input is raw data collected from each company's terminals, and the output is integrated security data.

[0445] Step 2:

[0446] It preprocesses security data collected by the server, standardizing log data in different formats, unifying timestamps, and removing unnecessary and duplicate data. The input is the collected raw data, and the output is preprocessed data that has been converted into an easy-to-analyze format.

[0447] Step 3:

[0448] The server uses a generative AI model to analyze the preprocessed data. The model runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection to perform the analysis. The input is the preprocessed data, and the output is the detection results for anomalies, vulnerabilities, and intrusions.

[0449] Step 4:

[0450] The server identifies vulnerabilities and risks from the analysis results. Specifically, it identifies unauthorized access attempts from specific IP addresses, and software versions and system settings that match known vulnerabilities. The input is the analysis results, and the output is the identified vulnerabilities and risks.

[0451] Step 5:

[0452] The server provides the identified vulnerabilities and risks to mobile device software, which runs on smartphones and tablets and visualizes the analysis results in real time. The input is the identified vulnerability and risk information, and the output is the visualized analysis results.

[0453] Step 6:

[0454] Users use software for mobile devices to check the status of vulnerabilities and risks. The input is visualized analysis results, allowing users to easily understand the situation.

[0455] Step 7:

[0456] The server then suggests specific countermeasures to the user, such as blocking specific IP addresses with a firewall or updating all device software with the latest patches. The input is the identified vulnerabilities and risks, and the output is specific actionable countermeasure suggestions.

[0457] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[0458] The present invention relates to a system that analyzes an enterprise's information technology security situation and combines it with an emotion engine that recognizes user emotions, and can be specifically implemented as follows.

[0459] The system collects corporate security data, preprocesses it, and analyzes it using generative artificial intelligence. It then identifies and visualizes vulnerabilities and risks from the analysis results. It also includes a means to adjust the priority of security reports and countermeasure proposals using an emotion engine that recognizes user emotions.

[0460] The program's processing is explained below in natural language.

[0461] Data collection

[0462] The server collects log files from each company's terminals. The log files include operation logs, system errors, and access records. In addition, the server captures network traffic data in real time through a network traffic monitor. This collected data is then centrally collected and stored for later analysis.

[0463] Data Preprocessing

[0464] The server preprocesses the collected log files and network traffic data. Specifically, it unifies log data in different formats and standardizes timestamps. It also removes unnecessary and duplicate data. This preprocessing converts the data into a format that is easy to analyze.

[0465] AI analysis

[0466] To analyze the pre-processed data, the server uses generative artificial intelligence, which runs anomaly detection, vulnerability scanning, and intrusion detection algorithms, such as detecting repeated unauthorized access attempts from a particular IP address or identifying software versions or system settings that match known vulnerabilities.

[0467] Identifying vulnerabilities and risks

[0468] The server identifies vulnerabilities and risks from the results of AI analysis. For example, if a high-risk vulnerability is discovered, it evaluates its detailed information and impact. Based on the analysis results, it ranks the risks and determines the priority of countermeasures.

[0469] visualization

[0470] The server uses a visualization tool to visually display the analysis results. This display is provided in the form of a dashboard, using graphs and charts in an intuitive and easy-to-understand format. For example, it is easy to identify which vulnerabilities pose the highest risk.

[0471] Emotion Recognition and Action Suggestion

[0472] Furthermore, the server analyzes the user's emotions using an emotion engine. The emotion engine recognizes the user's emotions in real time and evaluates their stress and anxiety levels. For example, if a user checking a security report is feeling high levels of stress, the emotion engine will detect this and suggest countermeasures that need to be prioritized. Conversely, if the user is calm, the engine can provide detailed explanations and suggest multi-step procedures.

[0473] Specific examples

[0474] For example, if a suspicious traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time. Generative AI then analyzes the data to identify anomalous patterns. Based on the analysis results, the server classifies communications from specific IP addresses as high-risk and displays that risk using a visualization tool.

[0475] The emotion engine then analyzes the user's emotions. If the user is feeling highly stressed, it will prioritize suggesting blocking specific IP addresses with a firewall as the most important measure. If the user responds quickly to this suggestion, it can minimize security risks. If the user is calm, it can recommend detailed forensic analysis and additional security hardening steps.

[0476] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures while taking into account user sentiment, thereby improving security awareness and protecting against cyber threats.

[0477] The processing flow will be explained below.

[0478] Step 1: Data collection

[0479] The server collects log files from each terminal. These log files include operation logs, system errors, and access records. Agent software installed on the terminal periodically transfers these log files from the server to the server.

[0480] The server captures network traffic data in real time through a network traffic monitor, which is then stored for analysis.

[0481] Step 2: Data Preprocessing

[0482] The server preprocesses the collected log files and network traffic data to unify the data format and standardize timestamps.

[0483] The server removes unnecessary and duplicated data during the preprocessing process, which improves analysis accuracy.

[0484] Step 3: AI analysis

[0485] The server analyzes the pre-processed data using generative artificial intelligence, which runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection.

[0486] Specifically, the server detects repeated unauthorized access attempts from a specific IP address, or identifies software versions or system settings that match known vulnerabilities.

[0487] Step 4: Identifying vulnerabilities and risks

[0488] The server identifies vulnerabilities and risks based on the results of AI analysis. For example, if a high-risk vulnerability is discovered, it provides detailed information and evaluates its impact.

[0489] Rank risks and prioritize responses.

[0490] Step 5: Visualization

[0491] The server visually displays the analysis results using a visualization tool, presenting the results in a dashboard format using graphs and charts for easy user understanding.

[0492] For example, it allows you to identify at a glance which vulnerabilities pose the highest risk.

[0493] Step 6: Emotion Recognition

[0494] The server analyzes the user's emotions using an emotion engine, which recognizes emotions in real time from the user's facial expressions, voice, and input content, and evaluates the level of stress and anxiety.

[0495] For example, if a user is feeling high stress, emotional data about that feeling is collected and reflected in subsequent countermeasure proposals.

[0496] Step 7: Action proposals

[0497] The server then suggests specific measures to the user, such as blocking specific IP addresses with a firewall or instructing them to update all device software to the latest patches.

[0498] If the user feels high stress based on the emotion engine, the server will prioritize important countermeasures, while if the user feels calm, it will also suggest detailed explanations and additional steps.

[0499] Step 8: Implement and Reassess

[0500] The user implements the suggested measures, for example, updating firewall rules to block suspicious traffic.

[0501] In order to reassess the system status after the server has implemented countermeasures, data is collected and analyzed again to reconfirm vulnerabilities and risks.

[0502] Example 2

[0503] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0504] Conventional security analysis systems collect, preprocess, and visualize the analysis results of security data, but they are unable to propose countermeasures that take the user's emotional state into account. This means that they are forced to respond without considering the user's stress and anxiety, making it difficult to quickly and effectively address security risks. Furthermore, because there is no way to adjust the priority of specific countermeasures based on the user's emotional state, it is not always possible to obtain user acceptance or cooperation in implementing countermeasures.

[0505] The specific processing by the specific processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means.

[0506] In this invention, the server includes means for collecting security data, means for preprocessing the collected security data, means for using generative artificial intelligence to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visualizing the identified vulnerabilities and risks, means for detecting the emotional state of the user, means for adjusting the priority of countermeasures based on the emotional state, and means for proposing specific countermeasures. This makes it possible to propose effective countermeasures taking the user's emotional state into consideration, thereby realizing a prompt and optimal response to security risks.

[0507] "Security data" refers to data such as log files and network traffic collected to analyze a company's information technology security status.

[0508] "Preprocessing" refers to processes such as standardizing formats, standardizing timestamps, and deleting unnecessary and duplicate data in order to convert collected data into a format that is easier to analyze.

[0509] "Generative AI" is AI that analyzes data using algorithms and machine learning models for anomaly detection, vulnerability scanning, and intrusion detection.

[0510] A "vulnerability" is a security flaw or weakness that exists in a system or software.

[0511] "Risk" is an assessment of the extent to which a particular vulnerability or abnormal activity could affect systems and data.

[0512] "Visualization" means visually displaying analysis results and risks in an easy-to-understand format (e.g., graphs and charts).

[0513] "Emotional state" refers to the user's emotional response to checking the security report and the proposed measures, such as stress or anxiety.

[0514] "Countermeasure priority" refers to the ordering of countermeasures to be implemented for identified vulnerabilities and risks based on urgency and importance.

[0515] "Countermeasure proposals" are proposals for specific actions or procedures to be taken to address identified vulnerabilities or risks.

[0516] MODE FOR CARRYING OUT THE INVENTION

[0517] The present invention relates to a system that analyzes the information technology security status of an enterprise and combines it with an emotion engine that recognizes the emotions of users. Specific embodiments of the system will be described below.

[0518] Data collection

[0519] The server collects log files from each company's terminals. These log files include operation logs, system errors, and access records. In addition, the server uses a network traffic monitor to capture network traffic data in real time. This data is stored in a database. This method aggregates basic data to grasp the overall picture of the company's security status.

[0520] Data Preprocessing

[0521] The server preprocesses the collected log files and network traffic data. Specifically, it unifies log data in different formats, standardizes timestamps, and removes unnecessary and duplicate data. This preprocessing converts the data into a format that is easy to analyze.

[0522] AI analysis

[0523] The server uses generative artificial intelligence (AI) to analyze the pre-processed data. This AI runs anomaly detection, vulnerability scanning, and intrusion detection algorithms. For example, it can detect repeated unauthorized access attempts from a specific IP address or identify software versions or system configurations that match known vulnerabilities. This analysis reveals potential threats present on the system.

[0524] Identifying vulnerabilities and risks

[0525] The server identifies vulnerabilities and risks from the results of AI analysis. Specifically, it evaluates the detailed information and impact of high-risk vulnerabilities discovered. Based on the analysis results, it ranks the identified risks and determines the priority of countermeasures. This allows effective security measures to be implemented quickly.

[0526] visualization

[0527] The server visually displays the analysis results using a visualization tool. The results are presented in a dashboard format, using graphs and charts in an intuitive and easy-to-understand format, making it easy to identify the highest-risk vulnerabilities.

[0528] Emotion Recognition and Action Suggestion

[0529] The server analyzes the user's emotions using an emotion engine, which evaluates in real time the stress and anxiety the user feels when using the system. For example, if a user feels high levels of stress while reviewing a security report, the emotion engine will detect this and prioritize suggesting the most important countermeasures. Conversely, if the user is calm, the engine will suggest countermeasures that include detailed explanations and multi-step procedures.

[0530] Specific examples

[0531] For example, if a suspicious traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time. Generative AI then analyzes the data to identify abnormal patterns. Based on the analysis results, the server classifies communications from a specific IP address as high risk and displays that risk using a visualization tool.

[0532] The emotion engine then analyzes the user's emotions. If the user is feeling highly stressed, the most important countermeasure will be prioritized, suggesting blocking specific IP addresses with a firewall. If the user responds quickly to this suggestion, security risks will be minimized. Conversely, if the user is calm, detailed forensic analysis and additional security hardening steps will be suggested.

[0533] Prompt Sentence Examples

[0534] Here are some example prompts to input to a generative AI model:

[0535] "Please provide details of a system that detects, analyzes, and provides user-sensitive suggestions on how to address suspicious traffic patterns on a corporate network."

[0536] In this way, the present invention efficiently analyzes a company's information technology security situation and takes appropriate measures while taking into account user sentiment, thereby improving security awareness and protecting against cyber threats.

[0537] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0538] Step 1: Data collection

[0539] The server collects log files from each terminal in the company. As input, it reads operation logs, system errors, and access records from each terminal. The server also uses a network traffic monitor to capture network traffic data in real time. This data includes specific IP addresses, port information, and the contents of data packets. As output, all collected data is stored in a database, forming the basis for analyzing the company's security status. It is desirable for this collection work to be performed periodically or continuously.

[0540] Step 2: Data Preprocessing

[0541] The server preprocesses the collected log files and network traffic data. The inputs are raw log files and network traffic data stored in a database. Specific operations include unifying log data in different formats and standardizing timestamps. It also removes unnecessary and duplicate data. After the data cleaning is complete, the output is a unified dataset in an easy-to-analyze format. This dataset is ready for use in the next step, AI analysis.

[0542] Step 3: AI analysis

[0543] The server uses generative artificial intelligence (AI) to analyze the preprocessed data set. The preprocessed data is passed as input. Specifically, the AI ​​runs anomaly detection, vulnerability scanning, and intrusion detection algorithms. For example, it might detect repeated unauthorized access attempts from a specific IP address and check whether software versions and system configurations match known vulnerabilities. The output is an analysis result, which generates a list of potential system vulnerabilities and anomalous activity.

[0544] Step 4: Identifying vulnerabilities and risks

[0545] The server identifies vulnerabilities and risks from the results of the AI ​​analysis. The AI ​​analysis results are used as input. Specifically, it evaluates the details and impact of discovered high-risk vulnerabilities, including which system part the vulnerability affects, the scope of impact, and how frequently it occurs. The output is a list of vulnerabilities with a risk ranking and the prioritization of countermeasures. This information is passed to the next visualization step.

[0546] Step 5: Visualization

[0547] The server visualizes vulnerability and risk data. The input is the list of vulnerabilities with risk rankings identified in the previous step. Specifically, it uses a visualization tool to generate graphs and charts in a dashboard format. The output is provided in a visually easy-to-understand format, allowing users to easily identify high-risk vulnerabilities and their countermeasure status, helping users make decisions.

[0548] Step 6: Emotion recognition and action suggestions

[0549] The server uses an emotion engine to analyze the user's emotions. Inputs include reaction data regarding security report confirmation and countermeasure proposals when the user operates the system. Specifically, the emotion engine evaluates the user's stress and anxiety in real time and adjusts the priority of countermeasures based on this. The output generates countermeasure proposals according to the user's emotional state. For example, when the user is highly stressed, it prioritizes quick countermeasures, and when the user is relaxed, it provides detailed explanations. This output is presented to the user, encouraging them to take appropriate action.

[0550] (Application example 2)

[0551] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0552] Modern companies face many information technology security risks and are required to quickly and effectively identify these risks and implement appropriate countermeasures. However, conventional systems suggest countermeasures without considering the user's emotions, which can lead to users overlooking important information or failing to implement appropriate countermeasures. These problems are particularly pronounced when users are experiencing high levels of stress or anxiety. Therefore, a new system is needed that can efficiently and effectively analyze a company's information technology security situation and suggest appropriate countermeasures based on the user's emotions.

[0553] The identification processing by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for collecting security data, means for preprocessing the collected security data, means for using generative artificial intelligence to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visualizing the identified vulnerabilities and risks, means for recognizing user emotions, and means for dynamically proposing specific countermeasures based on the user emotions. This enables companies to effectively monitor and analyze the information technology security status in real time and take appropriate countermeasures that take into account the user's emotional state.

[0554] "Security data" refers to operation logs, system errors, access records, and network traffic data collected from each terminal and server within the company.

[0555] "Preprocessing" refers to data processing such as standardizing formats to convert collected security data into a format that is easier to analyze, standardizing timestamps, and deleting unnecessary data.

[0556] "Generative AI" refers to advanced AI techniques for analyzing large amounts of data and performing anomaly detection, vulnerability scanning, and intrusion detection.

[0557] "Vulnerability" refers to security holes and potential risks that exist in a system or network.

[0558] "Risk" refers to the potential security issues and impacts that may occur if a particular vulnerability is exploited.

[0559] "Visualization" refers to visually displaying analysis results in the form of graphs or charts so that users can intuitively understand them.

[0560] "Emotion recognition" refers to technology that analyzes a user's emotional state in real time.

[0561] "Dynamic suggestion" refers to changing the priority and specific content of measures according to the user's emotional state and instantly presenting the most appropriate measures.

[0562] "System" refers to a technical framework that encompasses an integrated set of means for collecting, pre-processing, analyzing, visualizing, recognizing emotions, and proposing countermeasures for security data.

[0563] The present invention relates to a system for efficiently and effectively analyzing the information technology security situation of a company and providing appropriate countermeasures taking into account user sentiment. This system is implemented by the following steps.

[0564] First, the server collects security data from each company's terminals and network devices, including operation logs, system errors, access records, and network traffic data, and then aggregates the collected data in one place and stores it for later analysis.

[0565] The server then pre-processes the collected data, which includes unifying log data in different formats, standardizing timestamps, and removing unnecessary and duplicate data, converting the data into a format that is easy to analyze.

[0566] The pre-processed data is then analyzed using generative artificial intelligence, which runs anomaly detection, vulnerability scanning, and intrusion detection algorithms to, for example, detect repeated unauthorized access attempts from a particular IP address or identify software versions or system configurations that match known vulnerabilities.

[0567] The server identifies vulnerabilities and risks from the analysis results. Specifically, if a high-risk vulnerability is discovered, it evaluates its detailed information and impact and assigns a risk ranking.

[0568] The identified vulnerabilities and risks are then visually displayed using a visualization tool. The display is presented in a dashboard format, with graphs and charts in an intuitive, easy-to-understand format, allowing users to easily identify the highest-risk vulnerabilities.

[0569] The server also uses an emotion recognition engine to analyze the user's emotions. This engine recognizes the user's emotions in real time and evaluates their stress and anxiety levels. For example, if the user feels high levels of stress while reviewing a security report, the emotion engine will detect this and suggest the necessary countermeasures as a priority. Conversely, if the user is calm, the server can provide detailed explanations and multi-step procedures.

[0570] A concrete example of this system is when a suspicious traffic pattern is detected from a specific device within a company's network. The server captures the information in real time and performs preprocessing. After that, the generative AI analyzes the data to identify abnormal patterns. Based on the analysis results, the server classifies communications from specific IP addresses as high risk and displays that risk using a visualization tool. The emotion engine then analyzes the user's emotions, and if the user is experiencing high stress, it prioritizes suggesting blocking the specific IP address via a firewall.

[0571] Example prompt sentence:

[0572] "Please describe what you do when a user feels frustrated while reviewing a security report. Please provide detailed instructions on how to quickly suggest blocking high-risk IP addresses."

[0573] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0574] Step 1:

[0575] The server collects security data from each company's terminals and network devices, specifically operation logs, system errors, access records, and network traffic data.

[0576] Input: Security data from each company's endpoints and network devices

[0577] Output: A consolidated collection of collected security data.

[0578] Step 2:

[0579] The server preprocesses the collected data, specifically by unifying log data in different formats, standardizing timestamps, and removing unnecessary and duplicate data.

[0580] Input: Security data collected in step 1

[0581] Output: Preprocessed security data

[0582] Step 3:

[0583] The server analyzes the pre-processed data using generative artificial intelligence, which runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection.

[0584] Input: Security data preprocessed in step 2

[0585] Output: Analysis results (anomaly detection results, vulnerability list, intrusion detection results)

[0586] Step 4:

[0587] The server identifies vulnerabilities and risks from the analysis results. Specifically, it ranks the risks based on the analysis results and identifies high-risk vulnerabilities.

[0588] Input: Analysis results obtained in step 3

[0589] Output: List of vulnerabilities and risks

[0590] Step 5:

[0591] The vulnerabilities and risks identified for a server are visually displayed using a visualization tool, presented in a dashboard format using graphs and charts for an intuitive understanding.

[0592] Input: List of vulnerabilities and risks obtained in step 4

[0593] Output: Visualized dashboard

[0594] Step 6:

[0595] The server analyzes the user's emotions using an emotion recognition engine, which recognizes the user's emotions in real time and assesses their stress and anxiety levels.

[0596] Input: Real-time user emotion data

[0597] Output: Evaluation result of the user's emotional state

[0598] Step 7:

[0599] The server dynamically suggests specific measures based on the user's emotional state. For example, if the user is feeling highly stressed, the server will prioritize the most important measures. Conversely, if the user is calm, the server will suggest detailed explanations and multi-step procedures.

[0600] Input: The evaluation result of the user's emotional state obtained in step 6, and the list of vulnerabilities and risks obtained in step 4

[0601] Output: Specific measures suggested to the user

[0602] Through these steps, the system can effectively monitor and analyze a company's information technology security situation in real time and provide appropriate countermeasures that take into account the user's emotional state.

[0603] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0604] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0605] In the above embodiment, an example in which the specific processing is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the smart glasses 214.

[0606] [Third embodiment]

[0607] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[0608] 5, the data processing system 310 includes the data processing device 12 and a headset terminal 314. An example of the data processing device 12 is a server.

[0609] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0610] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[0611] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0612] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0613] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0614] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0615] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0616] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0617] In the headset type terminal 314, a reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0618] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the headset type terminal 314 will be referred to as the "terminal."

[0619] The present invention relates to a system for analyzing the information technology security status of an enterprise, and can be specifically implemented as follows.

[0620] This system collects corporate security data, preprocesses it, and analyzes it using generative artificial intelligence. It then identifies and visualizes vulnerabilities and risks from the analysis results. The system also includes a means to propose specific countermeasures.

[0621] The program's processing is explained below in natural language.

[0622] Data collection

[0623] The server collects log files from each company's terminals. The log files include operation logs, system errors, and access records. In addition, the server captures network traffic data in real time through a network traffic monitor. This collected data is then centrally collected and stored for later analysis.

[0624] Data Preprocessing

[0625] The server preprocesses the collected log files and network traffic data. Specifically, it unifies log data in different formats and standardizes timestamps. It also removes unnecessary and duplicate data. This preprocessing converts the data into a format that is easy to analyze.

[0626] AI analysis

[0627] To analyze the pre-processed data, the server uses generative artificial intelligence, which runs anomaly detection, vulnerability scanning, and intrusion detection algorithms, such as detecting repeated unauthorized access attempts from a particular IP address or identifying software versions or system settings that match known vulnerabilities.

[0628] Identifying vulnerabilities and risks

[0629] The server identifies vulnerabilities and risks based on the results of AI analysis. For example, if high-risk vulnerabilities are identified, they are prioritized accordingly and their potential impact on the company is assessed.

[0630] visualization

[0631] The server uses a visualization tool to visually display the analysis results. This display is provided in the form of a dashboard, using graphs and charts in an intuitive and easy-to-understand format. For example, it is easy to identify which vulnerabilities pose the highest risk.

[0632] Action proposals

[0633] The server then suggests specific measures to the user, such as blocking specific IP addresses with a firewall or updating all device software with the latest patches. Users can then take action quickly and accurately based on these suggestions.

[0634] Specific examples

[0635] For example, if a suspicious traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time. Next, generative AI analyzes the data and identifies the abnormal pattern. Based on the analysis results, the server classifies communications from a specific IP address as high-risk and displays that risk using a visualization tool. Finally, the server suggests updating the firewall settings to block the suspicious traffic.

[0636] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures to improve security awareness and protect against cyber threats.

[0637] The processing flow will be explained below.

[0638] Step 1: Data collection

[0639] The server collects log files from each terminal. Agent software is installed on the terminal and configured to transfer operation logs, system errors, access records, etc. to the server.

[0640] The server uses a network traffic monitor to monitor network traffic, capturing data packets in real time, which are then temporarily stored for later analysis.

[0641] Step 2: Data Preprocessing

[0642] Normalizing log file and network traffic data collected by the server, for example, converting timestamps from different time zones into a uniform format.

[0643] Remove unnecessary and redundant information from the data pre-processed by the server, especially removing irrelevant system backup logs and redundantly logged events.

[0644] Step 3: AI analysis

[0645] The server analyzes the pre-processed data with raw artificial intelligence, which runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection.

[0646] Specifically, the server detects repeated unauthorized access attempts from a specific IP address and identifies software versions and system settings that match known vulnerabilities.

[0647] Step 4: Identifying vulnerabilities and risks

[0648] The server identifies vulnerabilities and risks based on the results of AI analysis. For example, if a high-risk vulnerability is discovered, it will provide detailed information and assess its impact.

[0649] Based on the analysis results, risks are ranked and the priority of countermeasures is determined.

[0650] Step 5: Visualization

[0651] The server visually displays the analysis results using a visualization tool, presenting the results in a dashboard format using graphs and charts for easy user understanding.

[0652] For example, it allows you to identify at a glance which vulnerabilities pose the highest risk.

[0653] Step 6: Action proposals

[0654] The server then suggests specific measures to the user, such as blocking specific IP addresses with a firewall or instructing them to update all device software to the latest patches.

[0655] Users can act quickly and intelligently based on these suggestions, for example, updating firewall rules to block suspicious traffic.

[0656] Example 1

[0657] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0658] It is important to efficiently and effectively analyze a company's information technology security status and quickly identify potential vulnerabilities and risks. However, conventional systems require complex and time-consuming data collection, preprocessing, and analysis methods, making it difficult to respond in real time. Furthermore, the lack of visualization of analysis results and the lack of specific countermeasure proposals makes it difficult for security personnel to take appropriate action.

[0659] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0660] In this invention, the server includes means for collecting record data from each device in the company, means for preprocessing the collected record data, means for using generative AI to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visually displaying the identified vulnerabilities and risks, and means for proposing specific countermeasures. This enables fast and efficient collection and preprocessing of record data, advanced analysis using a generative AI model, and the proposal of specific countermeasures based on the visualized analysis results.

[0661] "Each device of the company" refers to all computers, servers, routers, switches, and other network devices located within the company.

[0662] "Recorded data" refers to any data collected for security analysis, such as operation logs, system errors, access records, and network traffic data.

[0663] "Preprocessing" refers to processes such as standardizing the data format, standardizing timestamps, and deleting unnecessary and duplicate data in order to prepare the collected recorded data in an analyzable format.

[0664] "Generative AI" refers to AI technology used to analyze collected data and perform functions such as anomaly detection, vulnerability scanning, and intrusion detection.

[0665] "Analysis results" refers to the output obtained when generative AI analyzes preprocessed data, and refers to data that contains potential vulnerabilities and risks.

[0666] "Vulnerability" refers to security holes, defects, and parts of information systems and networks that may be subject to attack.

[0667] "Risk" refers to the potential security incidents that may occur if a particular vulnerability is exploited, and the scope of their impact.

[0668] "Visual display" refers to displaying the analysis results in the form of graphs, charts, or dashboards so that users can intuitively understand them.

[0669] "Specific measures" refer to the countermeasures and course of action that should be taken in response to identified vulnerabilities and risks, such as updating firewall settings and applying software patches.

[0670] The present invention relates to a system for analyzing the information technology security status of an enterprise, which can be implemented in the following specific configurations.

[0671] This system collects recorded data from each device in a company, preprocesses it, and analyzes it using generative artificial intelligence. It then identifies vulnerabilities and risks from the analysis results and visually displays them. It also includes a means to propose specific countermeasures.

[0672] Data collection

[0673] The server collects recorded data such as operation logs, system errors, and access records from each company's terminals. In addition, the server captures network traffic data in real time through a network traffic monitor. This data is then centrally stored in the server's database. Specifically, network traffic is captured using tools such as "Wireshark."

[0674] Data Preprocessing

[0675] The log files and network traffic data collected by the server are preprocessed. Specifically, the data format is unified using the "Pandas" library, and timestamps are standardized. Also, unnecessary and duplicate data is removed to make the data easier to analyze. This preprocessing converts the data into a format that is easy to analyze.

[0676] AI analysis

[0677] To analyze the preprocessed data, the server uses a generative AI model built using TensorFlow and PyTorch to perform anomaly detection, vulnerability scanning, and intrusion detection algorithms, identifying successive unauthorized access attempts from specific IP addresses and software versions and system configurations that match known vulnerabilities.

[0678] Identifying vulnerabilities and risks

[0679] The server identifies vulnerabilities and risks based on the results of AI analysis. To do this, it scores vulnerabilities using evaluation criteria such as the Common Vulnerability Scoring System (CVSS). Vulnerabilities are sorted in descending order and their impact is assessed.

[0680] visualization

[0681] The server uses visualization tools to visually display the analysis results. This display is provided in the form of a dashboard using tools such as Tableau or Grafana. Graphs and charts are used to display the results in a format that is intuitive and easy for users to understand. For example, it makes it easy to identify high-risk vulnerabilities.

[0682] Action proposals

[0683] The server then suggests specific countermeasures to the user, such as blocking specific IP addresses with a firewall or updating all device software with the latest patches.The user can then take prompt and appropriate action based on these suggestions.

[0684] Specific examples

[0685] For example, if an abnormal traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time using tools such as Wireshark. Next, generative artificial intelligence using TensorFlow analyzes the data and identifies the abnormal pattern. Based on the analysis results, the server classifies communications from specific IP addresses as high risk and visually displays that risk in Tableau. Finally, the server suggests updating the firewall settings to block the suspicious traffic.

[0686] Example prompt sentence:

[0687] Create a system that automatically collects data when an abnormal traffic pattern occurs from a specific device within the company's network, preprocesses the data using Python's Pandas and Datetime, and then uses TensorFlow to detect the anomaly. Create a system that visualizes the results in Tableau and suggests necessary measures to the user.

[0688] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures to improve security awareness and protect against cyber threats.

[0689] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0690] Step 1:

[0691] The server collects recorded data from each device in the company.

[0692] Specifically, the system collects operation logs, system errors, and access records generated by the terminals in real time and sends them to the server. In addition, the server uses a network traffic monitor such as Wireshark to capture network traffic data in real time. The input includes operation logs, system errors, access records, and network traffic data, and the output stores this data in a centralized database on the server.

[0693] Step 2:

[0694] The server preprocesses the collected recording data.

[0695] Specifically, the server uses the Pandas library to unify data from multiple different formats, standardizes timestamps using the Datetime module, and removes unnecessary and duplicate data using functions such as drop_duplicates. Inputs include raw operation logs, system errors, access records, and network traffic data extracted from a centralized database, and output provides preprocessed data in a format that can be analyzed.

[0696] Step 3:

[0697] The server uses the generative AI model to analyze the preprocessed data.

[0698] Specifically, the server uses frameworks such as TensorFlow and PyTorch to run algorithms for anomaly detection, vulnerability scanning, and intrusion detection. It extracts specific features and performs analysis based on those features. The input includes preprocessed data, and the output is analysis results related to identified anomaly patterns, vulnerabilities, and risks.

[0699] Step 4:

[0700] The server identifies vulnerabilities and risks from the analysis results.

[0701] Specifically, the server scores vulnerabilities using evaluation criteria such as CVSS based on the analysis result data. Vulnerabilities are prioritized in descending order and their impact is assessed. The input is the analysis result data obtained from the generative AI model, and the output is a prioritized list of vulnerabilities and risks.

[0702] Step 5:

[0703] The server visually displays the analysis results using a visualization tool.

[0704] Specifically, visualization tools such as Tableau and Grafana are used to display the analysis results in the form of a dashboard. Graphs and charts are used to visualize the results in a format that is intuitively easy for users to understand. The input is a prioritized list of vulnerabilities and risks, and the output is a visually displayed dashboard.

[0705] Step 6:

[0706] The server proposes specific measures to the user.

[0707] Specifically, this includes suggestions for blocking specific IP addresses with a firewall, updating all terminal software with the latest patches, etc. The input is the visualized analysis results and a list of vulnerabilities, and the output is a specific action plan that the user should implement.

[0708] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures to improve security awareness and protect against cyber threats.

[0709] (Application example 1)

[0710] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0711] There is a need to efficiently and quickly analyze a company's information technology security status, identify vulnerabilities and risks in real time, and quickly implement appropriate countermeasures. However, current technology does not fully provide the means to provide analysis results in real time and enable immediate response, making it difficult for administrators to quickly implement appropriate countermeasures. In addition, there is a lack of security monitoring software for mobile devices, making it difficult for administrators to effectively monitor and respond to the situation even when they are away from the office.

[0712] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0713] In this invention, the server includes means for collecting security data, means for preprocessing the collected security data, means for using a generation system to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visualizing the identified vulnerabilities and risks, means for proposing specific countermeasures, and software for mobile terminals that provides the analysis results in real time and enables a prompt response to risks, thereby enabling efficient analysis of a company's information technology security status and a prompt and accurate response to threats.

[0714] "Security data" refers to data including operational logs, system errors, access records, and network traffic information related to a company's information technology environment.

[0715] "Preprocessing" is the process of converting collected security data into a unified format, removing unnecessary and duplicate data, and preparing the data in a format that is easy to analyze.

[0716] A "generative system" refers to an artificial intelligence or machine learning model that makes specific perceptions or predictions based on data.

[0717] A "vulnerability" is a security weakness or flaw that exists in an information system.

[0718] "Risk" refers to the potential damage or impact caused by the exploitation of a security vulnerability.

[0719] "Software for mobile devices" is a program that runs on mobile electronic devices such as smartphones and tablets and monitors, analyzes, and displays security status in real time.

[0720] "Real-time" refers to data collection, processing, and display occurring almost instantaneously.

[0721] "Visualization" refers to displaying the results of data analysis in a visual format such as a graph or chart, making it easier to understand intuitively.

[0722] "Specific measures" are action plans that prescribe remediation and defense measures for identified vulnerabilities and risks.

[0723] To implement this invention, a system for analyzing the information technology security status of a company is required. This system is composed of a server, a mobile terminal, and a network that links them.

[0724] First, the server collects security data from each company's terminals. This security data includes operation logs, system errors, access records, and network traffic information. Because this data is provided in various formats, the server collects the data in bulk and converts it into a unified format. In this preprocessing step, unnecessary and duplicate data is deleted and timestamps are standardized.

[0725] The pre-processed data is then analyzed using a generative system that uses generative artificial intelligence models that run algorithms for anomaly detection, vulnerability scanning, and intrusion detection. Specifically, a server scales the data and feeds it into the artificial intelligence models to detect anomalous patterns and vulnerabilities.

[0726] Once vulnerabilities and risks are identified from the analysis results, the server provides this information in real time to mobile device software, which runs on mobile devices such as smartphones and tablets and displays the results visually, for example, using graphs and charts to visualize vulnerabilities and risks in an intuitive format.

[0727] The server then suggests specific countermeasures, such as blocking specific IP addresses or updating all device software with the latest patches, based on the identified vulnerabilities and risks. Users can then take action quickly and accurately based on these suggestions.

[0728] As a concrete example, consider the case where a series of unauthorized access attempts are detected from a specific IP address within a company's network. The server captures and preprocesses this information in real time. Next, generative artificial intelligence analyzes the data and identifies abnormal patterns. Based on the analysis results, the server classifies communications from the specific IP address as high-risk and visualizes this risk in mobile device software. Finally, the server suggests updating the firewall settings to the user and block the suspicious traffic.

[0729] This system enables real-time monitoring and analysis of a company's information technology security status, enabling prompt and appropriate countermeasures to be taken.

[0730] Prompt Sentence Examples

[0731] "Please suggest a way to identify and block IP addresses that have consecutive failed login attempts within the corporate network."

[0732] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0733] Step 1:

[0734] The server collects security data from each company's terminals. Specifically, it centralizes operation logs, system errors, access records, and network traffic data. The input is raw data collected from each company's terminals, and the output is integrated security data.

[0735] Step 2:

[0736] It preprocesses security data collected by the server, standardizing log data in different formats, unifying timestamps, and removing unnecessary and duplicate data. The input is the collected raw data, and the output is preprocessed data that has been converted into an easy-to-analyze format.

[0737] Step 3:

[0738] The server uses a generative AI model to analyze the preprocessed data. The model runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection to perform the analysis. The input is the preprocessed data, and the output is the detection results for anomalies, vulnerabilities, and intrusions.

[0739] Step 4:

[0740] The server identifies vulnerabilities and risks from the analysis results. Specifically, it identifies unauthorized access attempts from specific IP addresses, and software versions and system settings that match known vulnerabilities. The input is the analysis results, and the output is the identified vulnerabilities and risks.

[0741] Step 5:

[0742] The server provides the identified vulnerabilities and risks to mobile device software, which runs on smartphones and tablets and visualizes the analysis results in real time. The input is the identified vulnerability and risk information, and the output is the visualized analysis results.

[0743] Step 6:

[0744] Users use software for mobile devices to check the status of vulnerabilities and risks. The input is visualized analysis results, allowing users to easily understand the situation.

[0745] Step 7:

[0746] The server then suggests specific countermeasures to the user, such as blocking specific IP addresses with a firewall or updating all device software with the latest patches. The input is the identified vulnerabilities and risks, and the output is specific actionable countermeasure suggestions.

[0747] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[0748] The present invention relates to a system that analyzes an enterprise's information technology security situation and combines it with an emotion engine that recognizes user emotions, and can be specifically implemented as follows.

[0749] The system collects corporate security data, preprocesses it, and analyzes it using generative artificial intelligence. It then identifies and visualizes vulnerabilities and risks from the analysis results. It also includes a means to adjust the priority of security reports and countermeasure proposals using an emotion engine that recognizes user emotions.

[0750] The program's processing is explained below in natural language.

[0751] Data collection

[0752] The server collects log files from each company's terminals. The log files include operation logs, system errors, and access records. In addition, the server captures network traffic data in real time through a network traffic monitor. This collected data is then centrally collected and stored for later analysis.

[0753] Data Preprocessing

[0754] The server preprocesses the collected log files and network traffic data. Specifically, it unifies log data in different formats and standardizes timestamps. It also removes unnecessary and duplicate data. This preprocessing converts the data into a format that is easy to analyze.

[0755] AI analysis

[0756] To analyze the pre-processed data, the server uses generative artificial intelligence, which runs anomaly detection, vulnerability scanning, and intrusion detection algorithms, such as detecting repeated unauthorized access attempts from a particular IP address or identifying software versions or system settings that match known vulnerabilities.

[0757] Identifying vulnerabilities and risks

[0758] The server identifies vulnerabilities and risks from the results of AI analysis. For example, if a high-risk vulnerability is discovered, it evaluates its detailed information and impact. Based on the analysis results, it ranks the risks and determines the priority of countermeasures.

[0759] visualization

[0760] The server uses a visualization tool to visually display the analysis results. This display is provided in the form of a dashboard, using graphs and charts in an intuitive and easy-to-understand format. For example, it is easy to identify which vulnerabilities pose the highest risk.

[0761] Emotion Recognition and Action Suggestion

[0762] Furthermore, the server analyzes the user's emotions using an emotion engine. The emotion engine recognizes the user's emotions in real time and evaluates their stress and anxiety levels. For example, if a user checking a security report is feeling high levels of stress, the emotion engine will detect this and suggest countermeasures that need to be prioritized. Conversely, if the user is calm, the engine can provide detailed explanations and suggest multi-step procedures.

[0763] Specific examples

[0764] For example, if a suspicious traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time. Generative AI then analyzes the data to identify anomalous patterns. Based on the analysis results, the server classifies communications from specific IP addresses as high-risk and displays that risk using a visualization tool.

[0765] The emotion engine then analyzes the user's emotions. If the user is feeling highly stressed, it will prioritize suggesting blocking specific IP addresses with a firewall as the most important measure. If the user responds quickly to this suggestion, it can minimize security risks. If the user is calm, it can recommend detailed forensic analysis and additional security hardening steps.

[0766] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures while taking into account user sentiment, thereby improving security awareness and protecting against cyber threats.

[0767] The processing flow will be explained below.

[0768] Step 1: Data collection

[0769] The server collects log files from each terminal. These log files include operation logs, system errors, and access records. Agent software installed on the terminal periodically transfers these log files from the server to the server.

[0770] The server captures network traffic data in real time through a network traffic monitor, which is then stored for analysis.

[0771] Step 2: Data Preprocessing

[0772] The server preprocesses the collected log files and network traffic data to unify the data format and standardize timestamps.

[0773] The server removes unnecessary and duplicated data during the preprocessing process, which improves analysis accuracy.

[0774] Step 3: AI analysis

[0775] The server analyzes the pre-processed data using generative artificial intelligence, which runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection.

[0776] Specifically, the server detects repeated unauthorized access attempts from a specific IP address, or identifies software versions or system settings that match known vulnerabilities.

[0777] Step 4: Identifying vulnerabilities and risks

[0778] The server identifies vulnerabilities and risks based on the results of AI analysis. For example, if a high-risk vulnerability is discovered, it provides detailed information and evaluates its impact.

[0779] Rank risks and prioritize responses.

[0780] Step 5: Visualization

[0781] The server visually displays the analysis results using a visualization tool, presenting the results in a dashboard format using graphs and charts for easy user understanding.

[0782] For example, it allows you to identify at a glance which vulnerabilities pose the highest risk.

[0783] Step 6: Emotion Recognition

[0784] The server analyzes the user's emotions using an emotion engine, which recognizes emotions in real time from the user's facial expressions, voice, and input content, and evaluates the level of stress and anxiety.

[0785] For example, if a user is feeling high stress, emotional data about that feeling is collected and reflected in subsequent countermeasure proposals.

[0786] Step 7: Action proposals

[0787] The server then suggests specific measures to the user, such as blocking specific IP addresses with a firewall or instructing them to update all device software to the latest patches.

[0788] If the user feels high stress based on the emotion engine, the server will prioritize important countermeasures, while if the user feels calm, it will also suggest detailed explanations and additional steps.

[0789] Step 8: Implement and Reassess

[0790] The user implements the suggested measures, for example, updating firewall rules to block suspicious traffic.

[0791] In order to reassess the system status after the server has implemented countermeasures, data is collected and analyzed again to reconfirm vulnerabilities and risks.

[0792] Example 2

[0793] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0794] Conventional security analysis systems collect, preprocess, and visualize the analysis results of security data, but they are unable to propose countermeasures that take the user's emotional state into account. This means that they are forced to respond without considering the user's stress and anxiety, making it difficult to quickly and effectively address security risks. Furthermore, because there is no way to adjust the priority of specific countermeasures based on the user's emotional state, it is not always possible to obtain user acceptance or cooperation in implementing countermeasures.

[0795] The specific processing by the specific processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means.

[0796] In this invention, the server includes means for collecting security data, means for preprocessing the collected security data, means for using generative artificial intelligence to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visualizing the identified vulnerabilities and risks, means for detecting the emotional state of the user, means for adjusting the priority of countermeasures based on the emotional state, and means for proposing specific countermeasures. This makes it possible to propose effective countermeasures taking the user's emotional state into consideration, thereby realizing a prompt and optimal response to security risks.

[0797] "Security data" refers to data such as log files and network traffic collected to analyze a company's information technology security status.

[0798] "Preprocessing" refers to processes such as standardizing formats, standardizing timestamps, and deleting unnecessary and duplicate data in order to convert collected data into a format that is easier to analyze.

[0799] "Generative AI" is AI that analyzes data using algorithms and machine learning models for anomaly detection, vulnerability scanning, and intrusion detection.

[0800] A "vulnerability" is a security flaw or weakness that exists in a system or software.

[0801] "Risk" is an assessment of the extent to which a particular vulnerability or abnormal activity could affect systems and data.

[0802] "Visualization" means visually displaying analysis results and risks in an easy-to-understand format (e.g., graphs and charts).

[0803] "Emotional state" refers to the user's emotional response to checking the security report and the proposed measures, such as stress or anxiety.

[0804] "Countermeasure priority" refers to the ordering of countermeasures to be implemented for identified vulnerabilities and risks based on urgency and importance.

[0805] "Countermeasure proposals" are proposals for specific actions or procedures to be taken to address identified vulnerabilities or risks.

[0806] MODE FOR CARRYING OUT THE INVENTION

[0807] The present invention relates to a system that analyzes the information technology security status of an enterprise and combines it with an emotion engine that recognizes the emotions of users. Specific embodiments of the system will be described below.

[0808] Data collection

[0809] The server collects log files from each company's terminals. These log files include operation logs, system errors, and access records. In addition, the server uses a network traffic monitor to capture network traffic data in real time. This data is stored in a database. This method aggregates basic data to grasp the overall picture of the company's security status.

[0810] Data Preprocessing

[0811] The server preprocesses the collected log files and network traffic data. Specifically, it unifies log data in different formats, standardizes timestamps, and removes unnecessary and duplicate data. This preprocessing converts the data into a format that is easy to analyze.

[0812] AI analysis

[0813] The server uses generative artificial intelligence (AI) to analyze the pre-processed data. This AI runs anomaly detection, vulnerability scanning, and intrusion detection algorithms. For example, it can detect repeated unauthorized access attempts from a specific IP address or identify software versions or system configurations that match known vulnerabilities. This analysis reveals potential threats present on the system.

[0814] Identifying vulnerabilities and risks

[0815] The server identifies vulnerabilities and risks from the results of AI analysis. Specifically, it evaluates the detailed information and impact of high-risk vulnerabilities discovered. Based on the analysis results, it ranks the identified risks and determines the priority of countermeasures. This allows effective security measures to be implemented quickly.

[0816] visualization

[0817] The server visually displays the analysis results using a visualization tool. The results are presented in a dashboard format, using graphs and charts in an intuitive and easy-to-understand format, making it easy to identify the highest-risk vulnerabilities.

[0818] Emotion Recognition and Action Suggestion

[0819] The server analyzes the user's emotions using an emotion engine, which evaluates in real time the stress and anxiety the user feels when using the system. For example, if a user feels high levels of stress while reviewing a security report, the emotion engine will detect this and prioritize suggesting the most important countermeasures. Conversely, if the user is calm, the engine will suggest countermeasures that include detailed explanations and multi-step procedures.

[0820] Specific examples

[0821] For example, if a suspicious traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time. Generative AI then analyzes the data to identify abnormal patterns. Based on the analysis results, the server classifies communications from a specific IP address as high risk and displays that risk using a visualization tool.

[0822] The emotion engine then analyzes the user's emotions. If the user is feeling highly stressed, the most important countermeasure will be prioritized, suggesting blocking specific IP addresses with a firewall. If the user responds quickly to this suggestion, security risks will be minimized. Conversely, if the user is calm, detailed forensic analysis and additional security hardening steps will be suggested.

[0823] Prompt Sentence Examples

[0824] Here are some example prompts to input to a generative AI model:

[0825] "Please provide details of a system that detects, analyzes, and provides user-sensitive suggestions on how to address suspicious traffic patterns on a corporate network."

[0826] In this way, the present invention efficiently analyzes a company's information technology security situation and takes appropriate measures while taking into account user sentiment, thereby improving security awareness and protecting against cyber threats.

[0827] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0828] Step 1: Data collection

[0829] The server collects log files from each terminal in the company. As input, it reads operation logs, system errors, and access records from each terminal. The server also uses a network traffic monitor to capture network traffic data in real time. This data includes specific IP addresses, port information, and the contents of data packets. As output, all collected data is stored in a database, forming the basis for analyzing the company's security status. It is desirable for this collection work to be performed periodically or continuously.

[0830] Step 2: Data Preprocessing

[0831] The server preprocesses the collected log files and network traffic data. The inputs are raw log files and network traffic data stored in a database. Specific operations include unifying log data in different formats and standardizing timestamps. It also removes unnecessary and duplicate data. After the data cleaning is complete, the output is a unified dataset in an easy-to-analyze format. This dataset is ready for use in the next step, AI analysis.

[0832] Step 3: AI analysis

[0833] The server uses generative artificial intelligence (AI) to analyze the preprocessed data set. The preprocessed data is passed as input. Specifically, the AI ​​runs anomaly detection, vulnerability scanning, and intrusion detection algorithms. For example, it might detect repeated unauthorized access attempts from a specific IP address and check whether software versions and system configurations match known vulnerabilities. The output is an analysis result, which generates a list of potential system vulnerabilities and anomalous activity.

[0834] Step 4: Identifying vulnerabilities and risks

[0835] The server identifies vulnerabilities and risks from the results of the AI ​​analysis. The AI ​​analysis results are used as input. Specifically, it evaluates the details and impact of discovered high-risk vulnerabilities, including which system part the vulnerability affects, the scope of impact, and how frequently it occurs. The output is a list of vulnerabilities with a risk ranking and the prioritization of countermeasures. This information is passed to the next visualization step.

[0836] Step 5: Visualization

[0837] The server visualizes vulnerability and risk data. The input is the list of vulnerabilities with risk rankings identified in the previous step. Specifically, it uses a visualization tool to generate graphs and charts in a dashboard format. The output is provided in a visually easy-to-understand format, allowing users to easily identify high-risk vulnerabilities and their countermeasure status, helping users make decisions.

[0838] Step 6: Emotion recognition and action suggestions

[0839] The server uses an emotion engine to analyze the user's emotions. Inputs include reaction data regarding security report confirmation and countermeasure proposals when the user operates the system. Specifically, the emotion engine evaluates the user's stress and anxiety in real time and adjusts the priority of countermeasures based on this. The output generates countermeasure proposals according to the user's emotional state. For example, when the user is highly stressed, it prioritizes quick countermeasures, and when the user is relaxed, it provides detailed explanations. This output is presented to the user, encouraging them to take appropriate action.

[0840] (Application example 2)

[0841] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0842] Modern companies face many information technology security risks and are required to quickly and effectively identify these risks and implement appropriate countermeasures. However, conventional systems suggest countermeasures without considering the user's emotions, which can lead to users overlooking important information or failing to implement appropriate countermeasures. These problems are particularly pronounced when users are experiencing high levels of stress or anxiety. Therefore, a new system is needed that can efficiently and effectively analyze a company's information technology security situation and suggest appropriate countermeasures based on the user's emotions.

[0843] The identification processing by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for collecting security data, means for preprocessing the collected security data, means for using generative artificial intelligence to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visualizing the identified vulnerabilities and risks, means for recognizing user emotions, and means for dynamically proposing specific countermeasures based on the user emotions. This enables companies to effectively monitor and analyze the information technology security status in real time and take appropriate countermeasures that take into account the user's emotional state.

[0844] "Security data" refers to operation logs, system errors, access records, and network traffic data collected from each terminal and server within the company.

[0845] "Preprocessing" refers to data processing such as standardizing formats to convert collected security data into a format that is easier to analyze, standardizing timestamps, and deleting unnecessary data.

[0846] "Generative AI" refers to advanced AI techniques for analyzing large amounts of data and performing anomaly detection, vulnerability scanning, and intrusion detection.

[0847] "Vulnerability" refers to security holes and potential risks that exist in a system or network.

[0848] "Risk" refers to the potential security issues and impacts that may occur if a particular vulnerability is exploited.

[0849] "Visualization" refers to visually displaying analysis results in the form of graphs or charts so that users can intuitively understand them.

[0850] "Emotion recognition" refers to technology that analyzes a user's emotional state in real time.

[0851] "Dynamic suggestion" refers to changing the priority and specific content of measures according to the user's emotional state and instantly presenting the most appropriate measures.

[0852] "System" refers to a technical framework that encompasses an integrated set of means for collecting, pre-processing, analyzing, visualizing, recognizing emotions, and proposing countermeasures for security data.

[0853] The present invention relates to a system for efficiently and effectively analyzing the information technology security situation of a company and providing appropriate countermeasures taking into account user sentiment. This system is implemented by the following steps.

[0854] First, the server collects security data from each company's terminals and network devices, including operation logs, system errors, access records, and network traffic data, and then aggregates the collected data in one place and stores it for later analysis.

[0855] The server then pre-processes the collected data, which includes unifying log data in different formats, standardizing timestamps, and removing unnecessary and duplicate data, converting the data into a format that is easy to analyze.

[0856] The pre-processed data is then analyzed using generative artificial intelligence, which runs anomaly detection, vulnerability scanning, and intrusion detection algorithms to, for example, detect repeated unauthorized access attempts from a particular IP address or identify software versions or system configurations that match known vulnerabilities.

[0857] The server identifies vulnerabilities and risks from the analysis results. Specifically, if a high-risk vulnerability is discovered, it evaluates its detailed information and impact and assigns a risk ranking.

[0858] The identified vulnerabilities and risks are then visually displayed using a visualization tool. The display is presented in a dashboard format, with graphs and charts in an intuitive, easy-to-understand format, allowing users to easily identify the highest-risk vulnerabilities.

[0859] The server also uses an emotion recognition engine to analyze the user's emotions. This engine recognizes the user's emotions in real time and evaluates their stress and anxiety levels. For example, if the user feels high levels of stress while reviewing a security report, the emotion engine will detect this and suggest the necessary countermeasures as a priority. Conversely, if the user is calm, the server can provide detailed explanations and multi-step procedures.

[0860] A concrete example of this system is when a suspicious traffic pattern is detected from a specific device within a company's network. The server captures the information in real time and performs preprocessing. After that, the generative AI analyzes the data to identify abnormal patterns. Based on the analysis results, the server classifies communications from specific IP addresses as high risk and displays that risk using a visualization tool. The emotion engine then analyzes the user's emotions, and if the user is experiencing high stress, it prioritizes suggesting blocking the specific IP address via a firewall.

[0861] Example prompt sentence:

[0862] "Please describe what you do when a user feels frustrated while reviewing a security report. Please provide detailed instructions on how to quickly suggest blocking high-risk IP addresses."

[0863] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0864] Step 1:

[0865] The server collects security data from each company's terminals and network devices, specifically operation logs, system errors, access records, and network traffic data.

[0866] Input: Security data from each company's endpoints and network devices

[0867] Output: A consolidated collection of collected security data.

[0868] Step 2:

[0869] The server preprocesses the collected data, specifically by unifying log data in different formats, standardizing timestamps, and removing unnecessary and duplicate data.

[0870] Input: Security data collected in step 1

[0871] Output: Preprocessed security data

[0872] Step 3:

[0873] The server analyzes the pre-processed data using generative artificial intelligence, which runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection.

[0874] Input: Security data preprocessed in step 2

[0875] Output: Analysis results (anomaly detection results, vulnerability list, intrusion detection results)

[0876] Step 4:

[0877] The server identifies vulnerabilities and risks from the analysis results. Specifically, it ranks the risks based on the analysis results and identifies high-risk vulnerabilities.

[0878] Input: Analysis results obtained in step 3

[0879] Output: List of vulnerabilities and risks

[0880] Step 5:

[0881] The vulnerabilities and risks identified for a server are visually displayed using a visualization tool, presented in a dashboard format using graphs and charts for an intuitive understanding.

[0882] Input: List of vulnerabilities and risks obtained in step 4

[0883] Output: Visualized dashboard

[0884] Step 6:

[0885] The server analyzes the user's emotions using an emotion recognition engine, which recognizes the user's emotions in real time and assesses their stress and anxiety levels.

[0886] Input: Real-time user emotion data

[0887] Output: Evaluation result of the user's emotional state

[0888] Step 7:

[0889] The server dynamically suggests specific measures based on the user's emotional state. For example, if the user is feeling highly stressed, the server will prioritize the most important measures. Conversely, if the user is calm, the server will suggest detailed explanations and multi-step procedures.

[0890] Input: The evaluation result of the user's emotional state obtained in step 6, and the list of vulnerabilities and risks obtained in step 4

[0891] Output: Specific measures suggested to the user

[0892] Through these steps, the system can effectively monitor and analyze a company's information technology security situation in real time and provide appropriate countermeasures that take into account the user's emotional state.

[0893] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0894] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0895] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the headset type terminal 314.

[0896] [Fourth embodiment]

[0897] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[0898] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0899] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0900] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[0901] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0902] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0903] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0904] The control object 443 includes a display device, LEDs in the eyes, and motors for driving the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[0905] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0906] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0907] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0908] In the robot 414, the processor 46 performs the reception output process. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0909] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[0910] The present invention relates to a system for analyzing the information technology security status of an enterprise, and can be specifically implemented as follows.

[0911] This system collects corporate security data, preprocesses it, and analyzes it using generative artificial intelligence. It then identifies and visualizes vulnerabilities and risks from the analysis results. The system also includes a means to propose specific countermeasures.

[0912] The program's processing is explained below in natural language.

[0913] Data collection

[0914] The server collects log files from each company's terminals. The log files include operation logs, system errors, and access records. In addition, the server captures network traffic data in real time through a network traffic monitor. This collected data is then centrally collected and stored for later analysis.

[0915] Data Preprocessing

[0916] The server preprocesses the collected log files and network traffic data. Specifically, it unifies log data in different formats and standardizes timestamps. It also removes unnecessary and duplicate data. This preprocessing converts the data into a format that is easy to analyze.

[0917] AI analysis

[0918] To analyze the pre-processed data, the server uses generative artificial intelligence, which runs anomaly detection, vulnerability scanning, and intrusion detection algorithms, such as detecting repeated unauthorized access attempts from a particular IP address or identifying software versions or system settings that match known vulnerabilities.

[0919] Identifying vulnerabilities and risks

[0920] The server identifies vulnerabilities and risks based on the results of AI analysis. For example, if high-risk vulnerabilities are identified, they are prioritized accordingly and their potential impact on the company is assessed.

[0921] visualization

[0922] The server uses a visualization tool to visually display the analysis results. This display is provided in the form of a dashboard, using graphs and charts in an intuitive and easy-to-understand format. For example, it is easy to identify which vulnerabilities pose the highest risk.

[0923] Action proposals

[0924] The server then suggests specific measures to the user, such as blocking specific IP addresses with a firewall or updating all device software with the latest patches. Users can then take action quickly and accurately based on these suggestions.

[0925] Specific examples

[0926] For example, if a suspicious traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time. Next, generative AI analyzes the data and identifies the abnormal pattern. Based on the analysis results, the server classifies communications from a specific IP address as high-risk and displays that risk using a visualization tool. Finally, the server suggests updating the firewall settings to block the suspicious traffic.

[0927] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures to improve security awareness and protect against cyber threats.

[0928] The processing flow will be explained below.

[0929] Step 1: Data collection

[0930] The server collects log files from each terminal. Agent software is installed on the terminal and configured to transfer operation logs, system errors, access records, etc. to the server.

[0931] The server uses a network traffic monitor to monitor network traffic, capturing data packets in real time, which are then temporarily stored for later analysis.

[0932] Step 2: Data Preprocessing

[0933] Normalizing log file and network traffic data collected by the server, for example, converting timestamps from different time zones into a uniform format.

[0934] Remove unnecessary and redundant information from the data pre-processed by the server, especially removing irrelevant system backup logs and redundantly logged events.

[0935] Step 3: AI analysis

[0936] The server analyzes the pre-processed data with raw artificial intelligence, which runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection.

[0937] Specifically, the server detects repeated unauthorized access attempts from a specific IP address and identifies software versions and system settings that match known vulnerabilities.

[0938] Step 4: Identifying vulnerabilities and risks

[0939] The server identifies vulnerabilities and risks based on the results of AI analysis. For example, if a high-risk vulnerability is discovered, it will provide detailed information and assess its impact.

[0940] Based on the analysis results, risks are ranked and the priority of countermeasures is determined.

[0941] Step 5: Visualization

[0942] The server visually displays the analysis results using a visualization tool, presenting the results in a dashboard format using graphs and charts for easy user understanding.

[0943] For example, it allows you to identify at a glance which vulnerabilities pose the highest risk.

[0944] Step 6: Action proposals

[0945] The server then suggests specific measures to the user, such as blocking specific IP addresses with a firewall or instructing them to update all device software to the latest patches.

[0946] Users can act quickly and intelligently based on these suggestions, for example, updating firewall rules to block suspicious traffic.

[0947] Example 1

[0948] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[0949] It is important to efficiently and effectively analyze a company's information technology security status and quickly identify potential vulnerabilities and risks. However, conventional systems require complex and time-consuming data collection, preprocessing, and analysis methods, making it difficult to respond in real time. Furthermore, the lack of visualization of analysis results and the lack of specific countermeasure proposals makes it difficult for security personnel to take appropriate action.

[0950] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0951] In this invention, the server includes means for collecting record data from each device in the company, means for preprocessing the collected record data, means for using generative AI to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visually displaying the identified vulnerabilities and risks, and means for proposing specific countermeasures. This enables fast and efficient collection and preprocessing of record data, advanced analysis using a generative AI model, and the proposal of specific countermeasures based on the visualized analysis results.

[0952] "Each device of the company" refers to all computers, servers, routers, switches, and other network devices located within the company.

[0953] "Recorded data" refers to any data collected for security analysis, such as operation logs, system errors, access records, and network traffic data.

[0954] "Preprocessing" refers to processes such as standardizing the data format, standardizing timestamps, and deleting unnecessary and duplicate data in order to prepare the collected recorded data in an analyzable format.

[0955] "Generative AI" refers to AI technology used to analyze collected data and perform functions such as anomaly detection, vulnerability scanning, and intrusion detection.

[0956] "Analysis results" refers to the output obtained when generative AI analyzes preprocessed data, and refers to data that contains potential vulnerabilities and risks.

[0957] "Vulnerability" refers to security holes, defects, and parts of information systems and networks that may be subject to attack.

[0958] "Risk" refers to the potential security incidents that may occur if a particular vulnerability is exploited, and the scope of their impact.

[0959] "Visual display" refers to displaying the analysis results in the form of graphs, charts, or dashboards so that users can intuitively understand them.

[0960] "Specific measures" refer to the countermeasures and course of action that should be taken in response to identified vulnerabilities and risks, such as updating firewall settings and applying software patches.

[0961] The present invention relates to a system for analyzing the information technology security status of an enterprise, which can be implemented in the following specific configurations.

[0962] This system collects recorded data from each device in a company, preprocesses it, and analyzes it using generative artificial intelligence. It then identifies vulnerabilities and risks from the analysis results and visually displays them. It also includes a means to propose specific countermeasures.

[0963] Data collection

[0964] The server collects recorded data such as operation logs, system errors, and access records from each company's terminals. In addition, the server captures network traffic data in real time through a network traffic monitor. This data is then centrally stored in the server's database. Specifically, network traffic is captured using tools such as "Wireshark."

[0965] Data Preprocessing

[0966] The log files and network traffic data collected by the server are preprocessed. Specifically, the data format is unified using the "Pandas" library, and timestamps are standardized. Also, unnecessary and duplicate data is removed to make the data easier to analyze. This preprocessing converts the data into a format that is easy to analyze.

[0967] AI analysis

[0968] To analyze the preprocessed data, the server uses a generative AI model built using TensorFlow and PyTorch to perform anomaly detection, vulnerability scanning, and intrusion detection algorithms, identifying successive unauthorized access attempts from specific IP addresses and software versions and system configurations that match known vulnerabilities.

[0969] Identifying vulnerabilities and risks

[0970] The server identifies vulnerabilities and risks based on the results of AI analysis. To do this, it scores vulnerabilities using evaluation criteria such as the Common Vulnerability Scoring System (CVSS). Vulnerabilities are sorted in descending order and their impact is assessed.

[0971] visualization

[0972] The server uses visualization tools to visually display the analysis results. This display is provided in the form of a dashboard using tools such as Tableau or Grafana. Graphs and charts are used to display the results in a format that is intuitive and easy for users to understand. For example, it makes it easy to identify high-risk vulnerabilities.

[0973] Action proposals

[0974] The server then suggests specific countermeasures to the user, such as blocking specific IP addresses with a firewall or updating all device software with the latest patches.The user can then take prompt and appropriate action based on these suggestions.

[0975] Specific examples

[0976] For example, if an abnormal traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time using tools such as Wireshark. Next, generative artificial intelligence using TensorFlow analyzes the data and identifies the abnormal pattern. Based on the analysis results, the server classifies communications from specific IP addresses as high risk and visually displays that risk in Tableau. Finally, the server suggests updating the firewall settings to block the suspicious traffic.

[0977] Example prompt sentence:

[0978] Create a system that automatically collects data when an abnormal traffic pattern occurs from a specific device within the company's network, preprocesses the data using Python's Pandas and Datetime, and then uses TensorFlow to detect the anomaly. Create a system that visualizes the results in Tableau and suggests necessary measures to the user.

[0979] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures to improve security awareness and protect against cyber threats.

[0980] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0981] Step 1:

[0982] The server collects recorded data from each device in the company.

[0983] Specifically, the system collects operation logs, system errors, and access records generated by the terminals in real time and sends them to the server. In addition, the server uses a network traffic monitor such as Wireshark to capture network traffic data in real time. The input includes operation logs, system errors, access records, and network traffic data, and the output stores this data in a centralized database on the server.

[0984] Step 2:

[0985] The server preprocesses the collected recording data.

[0986] Specifically, the server uses the Pandas library to unify data from multiple different formats, standardizes timestamps using the Datetime module, and removes unnecessary and duplicate data using functions such as drop_duplicates. Inputs include raw operation logs, system errors, access records, and network traffic data extracted from a centralized database, and output provides preprocessed data in a format that can be analyzed.

[0987] Step 3:

[0988] The server uses the generative AI model to analyze the preprocessed data.

[0989] Specifically, the server uses frameworks such as TensorFlow and PyTorch to run algorithms for anomaly detection, vulnerability scanning, and intrusion detection. It extracts specific features and performs analysis based on those features. The input includes preprocessed data, and the output is analysis results related to identified anomaly patterns, vulnerabilities, and risks.

[0990] Step 4:

[0991] The server identifies vulnerabilities and risks from the analysis results.

[0992] Specifically, the server scores vulnerabilities using evaluation criteria such as CVSS based on the analysis result data. Vulnerabilities are prioritized in descending order and their impact is assessed. The input is the analysis result data obtained from the generative AI model, and the output is a prioritized list of vulnerabilities and risks.

[0993] Step 5:

[0994] The server visually displays the analysis results using a visualization tool.

[0995] Specifically, visualization tools such as Tableau and Grafana are used to display the analysis results in the form of a dashboard. Graphs and charts are used to visualize the results in a format that is intuitively easy for users to understand. The input is a prioritized list of vulnerabilities and risks, and the output is a visually displayed dashboard.

[0996] Step 6:

[0997] The server proposes specific measures to the user.

[0998] Specifically, this includes suggestions for blocking specific IP addresses with a firewall, updating all terminal software with the latest patches, etc. The input is the visualized analysis results and a list of vulnerabilities, and the output is a specific action plan that the user should implement.

[0999] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures to improve security awareness and protect against cyber threats.

[1000] (Application example 1)

[1001] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1002] There is a need to efficiently and quickly analyze a company's information technology security status, identify vulnerabilities and risks in real time, and quickly implement appropriate countermeasures. However, current technology does not fully provide the means to provide analysis results in real time and enable immediate response, making it difficult for administrators to quickly implement appropriate countermeasures. In addition, there is a lack of security monitoring software for mobile devices, making it difficult for administrators to effectively monitor and respond to the situation even when they are away from the office.

[1003] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[1004] In this invention, the server includes means for collecting security data, means for preprocessing the collected security data, means for using a generation system to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visualizing the identified vulnerabilities and risks, means for proposing specific countermeasures, and software for mobile terminals that provides the analysis results in real time and enables a prompt response to risks, thereby enabling efficient analysis of a company's information technology security status and a prompt and accurate response to threats.

[1005] "Security data" refers to data including operational logs, system errors, access records, and network traffic information related to a company's information technology environment.

[1006] "Preprocessing" is the process of converting collected security data into a unified format, removing unnecessary and duplicate data, and preparing the data in a format that is easy to analyze.

[1007] A "generative system" refers to an artificial intelligence or machine learning model that makes specific perceptions or predictions based on data.

[1008] A "vulnerability" is a security weakness or flaw that exists in an information system.

[1009] "Risk" refers to the potential damage or impact caused by the exploitation of a security vulnerability.

[1010] "Software for mobile devices" is a program that runs on mobile electronic devices such as smartphones and tablets and monitors, analyzes, and displays security status in real time.

[1011] "Real-time" refers to data collection, processing, and display occurring almost instantaneously.

[1012] "Visualization" refers to displaying the results of data analysis in a visual format such as a graph or chart, making it easier to understand intuitively.

[1013] "Specific measures" are action plans that prescribe remediation and defense measures for identified vulnerabilities and risks.

[1014] To implement this invention, a system for analyzing the information technology security status of a company is required. This system is composed of a server, a mobile terminal, and a network that links them.

[1015] First, the server collects security data from each company's terminals. This security data includes operation logs, system errors, access records, and network traffic information. Because this data is provided in various formats, the server collects the data in bulk and converts it into a unified format. In this preprocessing step, unnecessary and duplicate data is deleted and timestamps are standardized.

[1016] The pre-processed data is then analyzed using a generative system that uses generative artificial intelligence models that run algorithms for anomaly detection, vulnerability scanning, and intrusion detection. Specifically, a server scales the data and feeds it into the artificial intelligence models to detect anomalous patterns and vulnerabilities.

[1017] Once vulnerabilities and risks are identified from the analysis results, the server provides this information in real time to mobile device software, which runs on mobile devices such as smartphones and tablets and displays the results visually, for example, using graphs and charts to visualize vulnerabilities and risks in an intuitive format.

[1018] The server then suggests specific countermeasures, such as blocking specific IP addresses or updating all device software with the latest patches, based on the identified vulnerabilities and risks. Users can then take action quickly and accurately based on these suggestions.

[1019] As a concrete example, consider the case where a series of unauthorized access attempts are detected from a specific IP address within a company's network. The server captures and preprocesses this information in real time. Next, generative artificial intelligence analyzes the data and identifies abnormal patterns. Based on the analysis results, the server classifies communications from the specific IP address as high-risk and visualizes this risk in mobile device software. Finally, the server suggests updating the firewall settings to the user and block the suspicious traffic.

[1020] This system enables real-time monitoring and analysis of a company's information technology security status, enabling prompt and appropriate countermeasures to be taken.

[1021] Prompt Sentence Examples

[1022] "Please suggest a way to identify and block IP addresses that have consecutive failed login attempts within the corporate network."

[1023] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[1024] Step 1:

[1025] The server collects security data from each company's terminals. Specifically, it centralizes operation logs, system errors, access records, and network traffic data. The input is raw data collected from each company's terminals, and the output is integrated security data.

[1026] Step 2:

[1027] It preprocesses security data collected by the server, standardizing log data in different formats, unifying timestamps, and removing unnecessary and duplicate data. The input is the collected raw data, and the output is preprocessed data that has been converted into an easy-to-analyze format.

[1028] Step 3:

[1029] The server uses a generative AI model to analyze the preprocessed data. The model runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection to perform the analysis. The input is the preprocessed data, and the output is the detection results for anomalies, vulnerabilities, and intrusions.

[1030] Step 4:

[1031] The server identifies vulnerabilities and risks from the analysis results. Specifically, it identifies unauthorized access attempts from specific IP addresses, and software versions and system settings that match known vulnerabilities. The input is the analysis results, and the output is the identified vulnerabilities and risks.

[1032] Step 5:

[1033] The server provides the identified vulnerabilities and risks to mobile device software, which runs on smartphones and tablets and visualizes the analysis results in real time. The input is the identified vulnerability and risk information, and the output is the visualized analysis results.

[1034] Step 6:

[1035] Users use software for mobile devices to check the status of vulnerabilities and risks. The input is visualized analysis results, allowing users to easily understand the situation.

[1036] Step 7:

[1037] The server then suggests specific countermeasures to the user, such as blocking specific IP addresses with a firewall or updating all device software with the latest patches. The input is the identified vulnerabilities and risks, and the output is specific actionable countermeasure suggestions.

[1038] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[1039] The present invention relates to a system that analyzes an enterprise's information technology security situation and combines it with an emotion engine that recognizes user emotions, and can be specifically implemented as follows.

[1040] The system collects corporate security data, preprocesses it, and analyzes it using generative artificial intelligence. It then identifies and visualizes vulnerabilities and risks from the analysis results. It also includes a means to adjust the priority of security reports and countermeasure proposals using an emotion engine that recognizes user emotions.

[1041] The program's processing is explained below in natural language.

[1042] Data collection

[1043] The server collects log files from each company's terminals. The log files include operation logs, system errors, and access records. In addition, the server captures network traffic data in real time through a network traffic monitor. This collected data is then centrally collected and stored for later analysis.

[1044] Data Preprocessing

[1045] The server preprocesses the collected log files and network traffic data. Specifically, it unifies log data in different formats and standardizes timestamps. It also removes unnecessary and duplicate data. This preprocessing converts the data into a format that is easy to analyze.

[1046] AI analysis

[1047] To analyze the pre-processed data, the server uses generative artificial intelligence, which runs anomaly detection, vulnerability scanning, and intrusion detection algorithms, such as detecting repeated unauthorized access attempts from a particular IP address or identifying software versions or system settings that match known vulnerabilities.

[1048] Identifying vulnerabilities and risks

[1049] The server identifies vulnerabilities and risks from the results of AI analysis. For example, if a high-risk vulnerability is discovered, it evaluates its detailed information and impact. Based on the analysis results, it ranks the risks and determines the priority of countermeasures.

[1050] visualization

[1051] The server uses a visualization tool to visually display the analysis results. This display is provided in the form of a dashboard, using graphs and charts in an intuitive and easy-to-understand format. For example, it is easy to identify which vulnerabilities pose the highest risk.

[1052] Emotion Recognition and Action Suggestion

[1053] Furthermore, the server analyzes the user's emotions using an emotion engine. The emotion engine recognizes the user's emotions in real time and evaluates their stress and anxiety levels. For example, if a user checking a security report is feeling high levels of stress, the emotion engine will detect this and suggest countermeasures that need to be prioritized. Conversely, if the user is calm, the engine can provide detailed explanations and suggest multi-step procedures.

[1054] Specific examples

[1055] For example, if a suspicious traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time. Generative AI then analyzes the data to identify anomalous patterns. Based on the analysis results, the server classifies communications from specific IP addresses as high-risk and displays that risk using a visualization tool.

[1056] The emotion engine then analyzes the user's emotions. If the user is feeling highly stressed, it will prioritize suggesting blocking specific IP addresses with a firewall as the most important measure. If the user responds quickly to this suggestion, it can minimize security risks. If the user is calm, it can recommend detailed forensic analysis and additional security hardening steps.

[1057] In this way, the present invention efficiently and effectively analyzes a company's information technology security situation and takes appropriate measures while taking into account user sentiment, thereby improving security awareness and protecting against cyber threats.

[1058] The processing flow will be explained below.

[1059] Step 1: Data collection

[1060] The server collects log files from each terminal. These log files include operation logs, system errors, and access records. Agent software installed on the terminal periodically transfers these log files from the server to the server.

[1061] The server captures network traffic data in real time through a network traffic monitor, which is then stored for analysis.

[1062] Step 2: Data Preprocessing

[1063] The server preprocesses the collected log files and network traffic data to unify the data format and standardize timestamps.

[1064] The server removes unnecessary and duplicated data during the preprocessing process, which improves analysis accuracy.

[1065] Step 3: AI analysis

[1066] The server analyzes the pre-processed data using generative artificial intelligence, which runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection.

[1067] Specifically, the server detects repeated unauthorized access attempts from a specific IP address, or identifies software versions or system settings that match known vulnerabilities.

[1068] Step 4: Identifying vulnerabilities and risks

[1069] The server identifies vulnerabilities and risks based on the results of AI analysis. For example, if a high-risk vulnerability is discovered, it provides detailed information and evaluates its impact.

[1070] Rank risks and prioritize responses.

[1071] Step 5: Visualization

[1072] The server visually displays the analysis results using a visualization tool, presenting the results in a dashboard format using graphs and charts for easy user understanding.

[1073] For example, it allows you to identify at a glance which vulnerabilities pose the highest risk.

[1074] Step 6: Emotion Recognition

[1075] The server analyzes the user's emotions using an emotion engine, which recognizes emotions in real time from the user's facial expressions, voice, and input content, and evaluates the level of stress and anxiety.

[1076] For example, if a user is feeling high stress, emotional data about that feeling is collected and reflected in subsequent countermeasure proposals.

[1077] Step 7: Action proposals

[1078] The server then suggests specific measures to the user, such as blocking specific IP addresses with a firewall or instructing them to update all device software to the latest patches.

[1079] If the user feels high stress based on the emotion engine, the server will prioritize important countermeasures, while if the user feels calm, it will also suggest detailed explanations and additional steps.

[1080] Step 8: Implement and Reassess

[1081] The user implements the suggested measures, for example, updating firewall rules to block suspicious traffic.

[1082] In order to reassess the system status after the server has implemented countermeasures, data is collected and analyzed again to reconfirm vulnerabilities and risks.

[1083] Example 2

[1084] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1085] Conventional security analysis systems collect, preprocess, and visualize the analysis results of security data, but they are unable to propose countermeasures that take the user's emotional state into account. This means that they are forced to respond without considering the user's stress and anxiety, making it difficult to quickly and effectively address security risks. Furthermore, because there is no way to adjust the priority of specific countermeasures based on the user's emotional state, it is not always possible to obtain user acceptance or cooperation in implementing countermeasures.

[1086] The specific processing by the specific processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means.

[1087] In this invention, the server includes means for collecting security data, means for preprocessing the collected security data, means for using generative artificial intelligence to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visualizing the identified vulnerabilities and risks, means for detecting the emotional state of the user, means for adjusting the priority of countermeasures based on the emotional state, and means for proposing specific countermeasures. This makes it possible to propose effective countermeasures taking the user's emotional state into consideration, thereby realizing a prompt and optimal response to security risks.

[1088] "Security data" refers to data such as log files and network traffic collected to analyze a company's information technology security status.

[1089] "Preprocessing" refers to processes such as standardizing formats, standardizing timestamps, and deleting unnecessary and duplicate data in order to convert collected data into a format that is easier to analyze.

[1090] "Generative AI" is AI that analyzes data using algorithms and machine learning models for anomaly detection, vulnerability scanning, and intrusion detection.

[1091] A "vulnerability" is a security flaw or weakness that exists in a system or software.

[1092] "Risk" is an assessment of the extent to which a particular vulnerability or abnormal activity could affect systems and data.

[1093] "Visualization" means visually displaying analysis results and risks in an easy-to-understand format (e.g., graphs and charts).

[1094] "Emotional state" refers to the user's emotional response to checking the security report and the proposed measures, such as stress or anxiety.

[1095] "Countermeasure priority" refers to the ordering of countermeasures to be implemented for identified vulnerabilities and risks based on urgency and importance.

[1096] "Countermeasure proposals" are proposals for specific actions or procedures to be taken to address identified vulnerabilities or risks.

[1097] MODE FOR CARRYING OUT THE INVENTION

[1098] The present invention relates to a system that analyzes the information technology security status of an enterprise and combines it with an emotion engine that recognizes the emotions of users. Specific embodiments of the system will be described below.

[1099] Data collection

[1100] The server collects log files from each company's terminals. These log files include operation logs, system errors, and access records. In addition, the server uses a network traffic monitor to capture network traffic data in real time. This data is stored in a database. This method aggregates basic data to grasp the overall picture of the company's security status.

[1101] Data Preprocessing

[1102] The server preprocesses the collected log files and network traffic data. Specifically, it unifies log data in different formats, standardizes timestamps, and removes unnecessary and duplicate data. This preprocessing converts the data into a format that is easy to analyze.

[1103] AI analysis

[1104] The server uses generative artificial intelligence (AI) to analyze the pre-processed data. This AI runs anomaly detection, vulnerability scanning, and intrusion detection algorithms. For example, it can detect repeated unauthorized access attempts from a specific IP address or identify software versions or system configurations that match known vulnerabilities. This analysis reveals potential threats present on the system.

[1105] Identifying vulnerabilities and risks

[1106] The server identifies vulnerabilities and risks from the results of AI analysis. Specifically, it evaluates the detailed information and impact of high-risk vulnerabilities discovered. Based on the analysis results, it ranks the identified risks and determines the priority of countermeasures. This allows effective security measures to be implemented quickly.

[1107] visualization

[1108] The server visually displays the analysis results using a visualization tool. The results are presented in a dashboard format, using graphs and charts in an intuitive and easy-to-understand format, making it easy to identify the highest-risk vulnerabilities.

[1109] Emotion Recognition and Action Suggestion

[1110] The server analyzes the user's emotions using an emotion engine, which evaluates in real time the stress and anxiety the user feels when using the system. For example, if a user feels high levels of stress while reviewing a security report, the emotion engine will detect this and prioritize suggesting the most important countermeasures. Conversely, if the user is calm, the engine will suggest countermeasures that include detailed explanations and multi-step procedures.

[1111] Specific examples

[1112] For example, if a suspicious traffic pattern is detected from a specific device within a company's network, the server captures and preprocesses the information in real time. Generative AI then analyzes the data to identify abnormal patterns. Based on the analysis results, the server classifies communications from a specific IP address as high risk and displays that risk using a visualization tool.

[1113] The emotion engine then analyzes the user's emotions. If the user is feeling highly stressed, the most important countermeasure will be prioritized, suggesting blocking specific IP addresses with a firewall. If the user responds quickly to this suggestion, security risks will be minimized. Conversely, if the user is calm, detailed forensic analysis and additional security hardening steps will be suggested.

[1114] Prompt Sentence Examples

[1115] Here are some example prompts to input to a generative AI model:

[1116] "Please provide details of a system that detects, analyzes, and provides user-sensitive suggestions on how to address suspicious traffic patterns on a corporate network."

[1117] In this way, the present invention efficiently analyzes a company's information technology security situation and takes appropriate measures while taking into account user sentiment, thereby improving security awareness and protecting against cyber threats.

[1118] The flow of the identification process in the second embodiment will be described with reference to FIG.

[1119] Step 1: Data collection

[1120] The server collects log files from each terminal in the company. As input, it reads operation logs, system errors, and access records from each terminal. The server also uses a network traffic monitor to capture network traffic data in real time. This data includes specific IP addresses, port information, and the contents of data packets. As output, all collected data is stored in a database, forming the basis for analyzing the company's security status. It is desirable for this collection work to be performed periodically or continuously.

[1121] Step 2: Data Preprocessing

[1122] The server preprocesses the collected log files and network traffic data. The inputs are raw log files and network traffic data stored in a database. Specific operations include unifying log data in different formats and standardizing timestamps. It also removes unnecessary and duplicate data. After the data cleaning is complete, the output is a unified dataset in an easy-to-analyze format. This dataset is ready for use in the next step, AI analysis.

[1123] Step 3: AI analysis

[1124] The server uses generative artificial intelligence (AI) to analyze the preprocessed data set. The preprocessed data is passed as input. Specifically, the AI ​​runs anomaly detection, vulnerability scanning, and intrusion detection algorithms. For example, it might detect repeated unauthorized access attempts from a specific IP address and check whether software versions and system configurations match known vulnerabilities. The output is an analysis result, which generates a list of potential system vulnerabilities and anomalous activity.

[1125] Step 4: Identifying vulnerabilities and risks

[1126] The server identifies vulnerabilities and risks from the results of the AI ​​analysis. The AI ​​analysis results are used as input. Specifically, it evaluates the details and impact of discovered high-risk vulnerabilities, including which system part the vulnerability affects, the scope of impact, and how frequently it occurs. The output is a list of vulnerabilities with a risk ranking and the prioritization of countermeasures. This information is passed to the next visualization step.

[1127] Step 5: Visualization

[1128] The server visualizes vulnerability and risk data. The input is the list of vulnerabilities with risk rankings identified in the previous step. Specifically, it uses a visualization tool to generate graphs and charts in a dashboard format. The output is provided in a visually easy-to-understand format, allowing users to easily identify high-risk vulnerabilities and their countermeasure status, helping users make decisions.

[1129] Step 6: Emotion recognition and action suggestions

[1130] The server uses an emotion engine to analyze the user's emotions. Inputs include reaction data regarding security report confirmation and countermeasure proposals when the user operates the system. Specifically, the emotion engine evaluates the user's stress and anxiety in real time and adjusts the priority of countermeasures based on this. The output generates countermeasure proposals according to the user's emotional state. For example, when the user is highly stressed, it prioritizes quick countermeasures, and when the user is relaxed, it provides detailed explanations. This output is presented to the user, encouraging them to take appropriate action.

[1131] (Application example 2)

[1132] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1133] Modern companies face many information technology security risks and are required to quickly and effectively identify these risks and implement appropriate countermeasures. However, conventional systems suggest countermeasures without considering the user's emotions, which can lead to users overlooking important information or failing to implement appropriate countermeasures. These problems are particularly pronounced when users are experiencing high levels of stress or anxiety. Therefore, a new system is needed that can efficiently and effectively analyze a company's information technology security situation and suggest appropriate countermeasures based on the user's emotions.

[1134] The identification processing by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for collecting security data, means for preprocessing the collected security data, means for using generative artificial intelligence to analyze the preprocessed data, means for identifying vulnerabilities and risks from the analysis results, means for visualizing the identified vulnerabilities and risks, means for recognizing user emotions, and means for dynamically proposing specific countermeasures based on the user emotions. This enables companies to effectively monitor and analyze the information technology security status in real time and take appropriate countermeasures that take into account the user's emotional state.

[1135] "Security data" refers to operation logs, system errors, access records, and network traffic data collected from each terminal and server within the company.

[1136] "Preprocessing" refers to data processing such as standardizing formats to convert collected security data into a format that is easier to analyze, standardizing timestamps, and deleting unnecessary data.

[1137] "Generative AI" refers to advanced AI techniques for analyzing large amounts of data and performing anomaly detection, vulnerability scanning, and intrusion detection.

[1138] "Vulnerability" refers to security holes and potential risks that exist in a system or network.

[1139] "Risk" refers to the potential security issues and impacts that may occur if a particular vulnerability is exploited.

[1140] "Visualization" refers to visually displaying analysis results in the form of graphs or charts so that users can intuitively understand them.

[1141] "Emotion recognition" refers to technology that analyzes a user's emotional state in real time.

[1142] "Dynamic suggestion" refers to changing the priority and specific content of measures according to the user's emotional state and instantly presenting the most appropriate measures.

[1143] "System" refers to a technical framework that encompasses an integrated set of means for collecting, pre-processing, analyzing, visualizing, recognizing emotions, and proposing countermeasures for security data.

[1144] The present invention relates to a system for efficiently and effectively analyzing the information technology security situation of a company and providing appropriate countermeasures taking into account user sentiment. This system is implemented by the following steps.

[1145] First, the server collects security data from each company's terminals and network devices, including operation logs, system errors, access records, and network traffic data, and then aggregates the collected data in one place and stores it for later analysis.

[1146] The server then pre-processes the collected data, which includes unifying log data in different formats, standardizing timestamps, and removing unnecessary and duplicate data, converting the data into a format that is easy to analyze.

[1147] The pre-processed data is then analyzed using generative artificial intelligence, which runs anomaly detection, vulnerability scanning, and intrusion detection algorithms to, for example, detect repeated unauthorized access attempts from a particular IP address or identify software versions or system configurations that match known vulnerabilities.

[1148] The server identifies vulnerabilities and risks from the analysis results. Specifically, if a high-risk vulnerability is discovered, it evaluates its detailed information and impact and assigns a risk ranking.

[1149] The identified vulnerabilities and risks are then visually displayed using a visualization tool. The display is presented in a dashboard format, with graphs and charts in an intuitive, easy-to-understand format, allowing users to easily identify the highest-risk vulnerabilities.

[1150] The server also uses an emotion recognition engine to analyze the user's emotions. This engine recognizes the user's emotions in real time and evaluates their stress and anxiety levels. For example, if the user feels high levels of stress while reviewing a security report, the emotion engine will detect this and suggest the necessary countermeasures as a priority. Conversely, if the user is calm, the server can provide detailed explanations and multi-step procedures.

[1151] A concrete example of this system is when a suspicious traffic pattern is detected from a specific device within a company's network. The server captures the information in real time and performs preprocessing. After that, the generative AI analyzes the data to identify abnormal patterns. Based on the analysis results, the server classifies communications from specific IP addresses as high risk and displays that risk using a visualization tool. The emotion engine then analyzes the user's emotions, and if the user is experiencing high stress, it prioritizes suggesting blocking the specific IP address via a firewall.

[1152] Example prompt sentence:

[1153] "Please describe what you do when a user feels frustrated while reviewing a security report. Please provide detailed instructions on how to quickly suggest blocking high-risk IP addresses."

[1154] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[1155] Step 1:

[1156] The server collects security data from each company's terminals and network devices, specifically operation logs, system errors, access records, and network traffic data.

[1157] Input: Security data from each company's endpoints and network devices

[1158] Output: A consolidated collection of collected security data.

[1159] Step 2:

[1160] The server preprocesses the collected data, specifically by unifying log data in different formats, standardizing timestamps, and removing unnecessary and duplicate data.

[1161] Input: Security data collected in step 1

[1162] Output: Preprocessed security data

[1163] Step 3:

[1164] The server analyzes the pre-processed data using generative artificial intelligence, which runs algorithms for anomaly detection, vulnerability scanning, and intrusion detection.

[1165] Input: Security data preprocessed in step 2

[1166] Output: Analysis results (anomaly detection results, vulnerability list, intrusion detection results)

[1167] Step 4:

[1168] The server identifies vulnerabilities and risks from the analysis results. Specifically, it ranks the risks based on the analysis results and identifies high-risk vulnerabilities.

[1169] Input: Analysis results obtained in step 3

[1170] Output: List of vulnerabilities and risks

[1171] Step 5:

[1172] The vulnerabilities and risks identified for a server are visually displayed using a visualization tool, presented in a dashboard format using graphs and charts for an intuitive understanding.

[1173] Input: List of vulnerabilities and risks obtained in step 4

[1174] Output: Visualized dashboard

[1175] Step 6:

[1176] The server analyzes the user's emotions using an emotion recognition engine, which recognizes the user's emotions in real time and assesses their stress and anxiety levels.

[1177] Input: Real-time user emotion data

[1178] Output: Evaluation result of the user's emotional state

[1179] Step 7:

[1180] The server dynamically suggests specific measures based on the user's emotional state. For example, if the user is feeling highly stressed, the server will prioritize the most important measures. Conversely, if the user is calm, the server will suggest detailed explanations and multi-step procedures.

[1181] Input: The evaluation result of the user's emotional state obtained in step 6, and the list of vulnerabilities and risks obtained in step 4

[1182] Output: Specific measures suggested to the user

[1183] Through these steps, the system can effectively monitor and analyze a company's information technology security situation in real time and provide appropriate countermeasures that take into account the user's emotional state.

[1184] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[1185] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1186] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the robot 414.

[1187] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[1188] FIG. 9 is a diagram illustrating an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and actions arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion includes both affect and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[1189] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[1190] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[1191] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. Emotions can also be created for robots, automobiles, and motorcycles, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on Voice Emotion Recognition and Emotional Brain Physiological Signal Analysis Systems, Tokushima University, Doctoral Dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the "reaction" domain, where sensation is dominant. The right half of the emotion map lists emotions belonging to the "situation" domain, where situational awareness is dominant.

[1192] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[1193] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[1194] The system according to the present disclosure has been described above mainly with respect to the functions of the data processing device 12, but the system according to the present disclosure is not necessarily implemented on a server. The system according to the present disclosure may be implemented as a general information processing system. The present disclosure may be implemented, for example, as a software program running on a personal computer or an application running on a smartphone, etc. The method according to the present disclosure may be provided to users in the form of SaaS (Software as a Service).

[1195] In the above embodiment, an example was given in which the specific processing is performed by one computer 22, but the technology of the present disclosure is not limited to this, and the specific processing may be distributed and performed by a plurality of computers including the computer 22. For example, the data generation model 58 may be provided in an external device of the data processing device 12, and data may be generated in the external device in accordance with input data.

[1196] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[1197] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[1198] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[1199] The hardware resource for executing a specific process can be any of the following processors: An example of a processor is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. Another example of a processor is a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[1200] The hardware resource that executes the specific processing may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific processing may be a single processor.

[1201] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[1202] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[1203] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[1204] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[1205] The following is further disclosed regarding the above embodiment.

[1206] (Claim 1)

[1207] To analyze the information technology security situation of a company,

[1208] a means for collecting security data;

[1209] a means for pre-processing the collected security data;

[1210] means for using generative artificial intelligence to analyze the pre-processed data;

[1211] A means for identifying vulnerabilities and risks from the analysis results;

[1212] A means of visualizing identified vulnerabilities and risks;

[1213] A system that includes a means of proposing specific measures.

[1214] (Claim 2)

[1215] 2. The system according to claim 1, further comprising means for collecting log files and network traffic as security data.

[1216] (Claim 3)

[1217] 2. The system of claim 1, wherein the generating artificial intelligence comprises means for performing anomaly detection, vulnerability scanning, and intrusion detection.

[1218] "Example 1"

[1219] (Claim 1)

[1220] To analyze the information technology security situation of a company,

[1221] a means for collecting recorded data from each device of the enterprise;

[1222] means for pre-processing the collected record data;

[1223] means for using generative artificial intelligence to analyze the pre-processed data;

[1224] A means for identifying vulnerabilities and risks from the analysis results;

[1225] a means for visually displaying the identified vulnerabilities and risks;

[1226] A system that includes a means of proposing specific measures.

[1227] (Claim 2)

[1228] 2. The system according to claim 1, further comprising means for collecting record files and communication traffic as security data.

[1229] (Claim 3)

[1230] 2. The system of claim 1, wherein the generating artificial intelligence comprises means for performing anomaly detection, vulnerability scanning, and intrusion detection.

[1231] "Application Example 1"

[1232] (Claim 1)

[1233] To analyze the information technology security situation of a company,

[1234] a means for collecting security data;

[1235] a means for pre-processing the collected security data;

[1236] means for using the generating system to analyze the preprocessed data;

[1237] A means for identifying vulnerabilities and risks from the analysis results;

[1238] A means of visualizing identified vulnerabilities and risks;

[1239] A means of proposing specific measures,

[1240] A system that includes software for mobile devices that provides analysis results in real time and enables rapid response to risks.

[1241] (Claim 2)

[1242] 2. The system according to claim 1, further comprising means for collecting log files and network traffic as security data.

[1243] (Claim 3)

[1244] 2. The system of claim 1, wherein the generating artificial intelligence comprises means for performing anomaly detection, vulnerability scanning, and intrusion detection.

[1245] "Example 2: Combining Emotion Engines"

[1246] (Claim 1)

[1247] To analyze the information technology security situation of a company,

[1248] a means for collecting security data;

[1249] a means for pre-processing the collected security data;

[1250] means for using generative artificial intelligence to analyze the pre-processed data;

[1251] A means for identifying vulnerabilities and risks from the analysis results;

[1252] A means of visualizing identified vulnerabilities and risks;

[1253] means for detecting an emotional state of a user;

[1254] a means of adjusting the prioritization of measures based on emotional state;

[1255] A system that includes a means of proposing specific measures.

[1256] (Claim 2)

[1257] 2. The system according to claim 1, further comprising means for collecting log files and network traffic as security data.

[1258] (Claim 3)

[1259] 2. The system of claim 1, wherein the generating artificial intelligence comprises means for performing anomaly detection, vulnerability scanning, and intrusion detection.

[1260] "Application example 2 when combining emotion engines"

[1261] (Claim 1)

[1262] To analyze the information technology security situation of a company,

[1263] a means for collecting security data;

[1264] a means for pre-processing the collected security data;

[1265] means for using generative artificial intelligence to analyze the pre-processed data;

[1266] A means for identifying vulnerabilities and risks from the analysis results;

[1267] A means of visualizing identified vulnerabilities and risks;

[1268] means for recognizing a user's emotion;

[1269] A means for dynamically proposing specific measures based on the user's emotions;

[1270] A system including:

[1271] (Claim 2)

[1272] 2. The system according to claim 1, further comprising means for collecting log files and network traffic as security data.

[1273] (Claim 3)

[1274] 2. The system of claim 1, wherein the generating artificial intelligence comprises means for performing anomaly detection, vulnerability scanning, and intrusion detection. [Explanation of symbols]

[1275] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot< / url:> < / url:> < / url:> < / url:>

Claims

1. To analyze the information technology security situation of a company, a means for collecting security data; a means for pre-processing the collected security data; means for using generative artificial intelligence to analyze the pre-processed data; A means for identifying vulnerabilities and risks from the analysis results; A means of visualizing identified vulnerabilities and risks; A system that includes a means of proposing specific measures.

2. 2. The system according to claim 1, further comprising means for collecting log files and network traffic as security data.

3. 10. The system of claim 1, wherein the generative artificial intelligence comprises means for performing anomaly detection, vulnerability scanning, and intrusion detection.

Images