System

Abstract

A system is provided.SOLUTION: A system comprising: means for analyzing a suspicious email in real-time using a generative AI model; means for analyzing a phishing website in real-time using the generative AI model; and means for alerting a user if the suspicious email and the phishing website are detected.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] Currently, many users are facing security problems such as password theft, unauthorized logins, and credit card information theft. Understanding and setting up the latest security systems requires technical knowledge, and education on information security measures is also important. The challenge is to solve these problems and provide a system that allows even general users to easily ensure a safe Internet usage environment. [Means for solving the problem]

[0005] To solve the above problems, the present invention provides the following means. Specifically, the system includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, and means for issuing a warning to users when the suspicious emails and phishing websites are detected. Furthermore, the generative AI model periodically learns and updates new phishing patterns, allowing the system to constantly respond to the latest threats. Furthermore, by analyzing suspicious emails and phishing websites based on specific keywords, URL structures, and image patterns, user safety can be ensured with high accuracy.

[0006] A "generative AI model" is an algorithm that uses technologies such as machine learning and deep learning to learn the characteristics of phishing and suspicious content, and then uses that information to identify and classify suspicious emails and websites in real time.

[0007] "Suspicious email" is email that is deemed to have a high probability of having a fraudulent intent that differs from normal communication activities, and that may include phishing scams, spam, or malware distribution intended to harm users.

[0008] A "phishing website" is a malicious website designed to deceive internet users into revealing their personal information and credentials, usually by pretending to be a legitimate site and tricking them into entering sensitive information.

[0009] "Real-time analysis" is a process in which data is analyzed and evaluated immediately upon receipt, and the results are output promptly. This technology allows for a warning to be issued the moment a user attempts to access a suspicious email or website.

[0010] "Means of warning users" refers to any method used to notify users of the existence of detected suspicious emails or phishing sites and to draw their attention to them, including pop-up notifications, email notifications, alert messages, etc.

[0011] "Regularly learning and updating new phishing patterns" means that the generative AI model collects the latest threat information and modifies and adds analysis patterns based on existing datasets, thereby always maintaining its analysis capabilities in line with the latest security environment.

[0012] "Specific keywords" are words or phrases that tend to indicate phishing or fraudulent activity, such as "free," "urgent," "click here," and "login."

[0013] "URL structure" refers to the pattern of characters and formats contained within a website's URL, and is the basis for determining whether a domain name or path is suspicious.

[0014] "Image patterns" are characteristics of the visual content contained in emails and websites, and are attributes used to identify anomalies or imitation when compared to trusted sites. [Brief explanation of the drawings]

[0015] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5]FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 11] FIG. 3 is a sequence diagram showing a processing flow of the data processing system according to the first embodiment. [Figure 12] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 1. [Figure 13] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system according to the second embodiment when an emotion engine is combined. [Figure 14] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 2 when an emotion engine is combined. DETAILED DESCRIPTION OF THE INVENTION

[0016] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0017] First, the terms used in the following description will be explained.

[0018] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, a processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), and an APU (Accelerated Processing Unit).

[0019] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0020] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0021] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), Bluetooth (registered trademark), etc.

[0022] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0023] [First embodiment]

[0024] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0025] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0026] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0027] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0028] The reception device 38 includes a touch panel 38A, a microphone 38B, and the like, and receives user input. The touch panel 38A detects contact with an indicator (for example, a pen or a finger) to receive user input by the touch of the indicator. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0029] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form of expression that the user 20 can perceive (for example, audio and / or text). The display 40A displays visible information such as text and images in accordance with instructions from the processor 46. The speaker 40B outputs audio in accordance with instructions from the processor 46. The camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0030] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0031] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0032] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0033] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0034] In the smart device 14, the processor 46 performs the reception output process. The storage 50 stores a reception output program 60. The reception output program 60 is used in conjunction with the specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0035] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0036] The present invention is a system that utilizes generative AI models to detect suspicious emails and phishing websites in real time and alert users.

[0037] The server initializes the generative AI model, which periodically learns and updates new phishing patterns. The generative AI model learns the characteristics of phishing and fraudulent content and uses them to identify and classify suspicious emails and websites in real time.

[0038] When a user receives an email, the device provides the email content to the program. The device then sends the provided email content to the generative AI model, which analyzes it using the is_phishing_email method. This method uses regular expressions to search for suspicious keywords (e.g., "free," "urgent," "click here," "login"), and then evaluates the content using the generative AI model. If the email is determined to be suspicious, the device will issue a warning to the user saying, "Warning: This email looks suspicious."

[0039] When a user attempts to visit a website, the device provides the URL to the program. The device then sends the URL to the generative AI model, where it is analyzed using the is_phishing_website method. This method checks whether the URL contains suspicious keywords (e.g., "login," "verify," "secure") and whether the URL structure and patterns match the characteristics of a phishing site. The generative AI model then evaluates the URL, and if it is determined to be a suspicious site, the device issues a warning to the user saying, "Warning: This website looks suspicious."

[0040] The generative AI model continuously learns new phishing patterns, allowing it to stay current with the latest security threats. It also performs highly accurate analysis based on specific keywords, URL structures, and image patterns.

[0041] Specific examples are shown below.

[0042] Example 1: If a user receives an email with the content "Urgent: Your account has been compromised, click here to verify your login details," the device will send the email content to the generative AI model for analysis. Based on the analysis results, the email is deemed suspicious, and the device will display a warning saying "Warning: This email looks suspicious."

[0043] Example 2: If the URL the user is trying to visit is "http: / / secure-login.example.com," the device will send the URL to the AI ​​model for analysis. Based on the analysis results, the model determines that the URL is likely to be a phishing site, and will display a warning saying, "Warning: This website looks suspicious."

[0044] In this way, by using generative AI models, users can be protected from suspicious emails and websites and use the Internet safely.

[0045] The processing flow will be explained below.

[0046] Suspicious email detection process

[0047] Step 1:

[0048] The server initializes the generative AI model, which creates an instance of the generative AI model and prepares it to learn the characteristics of phishing and fraudulent content.

[0049] Step 2:

[0050] The server initializes the phishing detector with the generative AI model, which then performs real-time analysis of emails and websites.

[0051] Step 3:

[0052] The server updates the training data for the generated AI model, allowing the AI ​​model to learn new phishing patterns and respond to the latest threats.

[0053] Step 4:

[0054] A user opens the email they received and types the contents into their terminal. For example, the email may say, "Urgent: Your account has been compromised, click here to verify your login details."

[0055] Step 5:

[0056] The device sends the entered email content to the phishing detector.

[0057] Step 6:

[0058] The phishing detector analyzes the content of the email sent. First, it checks the content of the email using regular expressions to see if it contains predetermined suspicious keywords (e.g., "free," "urgent," "click here," "login").

[0059] Step 7:

[0060] Based on the results of the keyword check, the phishing detector uses a generative AI model to perform a more detailed content analysis, and then uses the classify method of the generative AI model to determine whether the email content is phishing.

[0061] Step 8:

[0062] If the device receives the phishing detection results and determines that the email is suspicious, it will display a warning to the user saying, "Warning: This email looks suspicious."

[0063] Phishing website detection process

[0064] Step 1:

[0065] The user enters the URL of the website they are trying to visit into the terminal. For example, the URL might be "http: / / secure-login.example.com."

[0066] Step 2:

[0067] The device sends the entered URL to the phishing detector.

[0068] Step 3:

[0069] The phishing detector analyzes the submitted URL, checking its structure and whether it contains any suspicious keywords (e.g. "login", "verify", "secure").

[0070] Step 4:

[0071] Based on the results of URL analysis, the phishing detector uses a generative AI model to perform further detailed URL analysis, and uses the classify method of the generative AI model to determine whether the URL corresponds to a phishing site.

[0072] Step 5:

[0073] If the device receives the phishing detection results and determines the site to be suspicious, it will display a warning to the user saying, "Warning: This website looks suspicious."

[0074] Through the above processing steps, users are protected in real time from suspicious emails and phishing sites, allowing them to use the Internet safely.

[0075] Example 1

[0076] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0077] With the spread of the Internet, the number of phishing scams and suspicious emails is increasing, increasing the risk of users being exposed to these threats. To address this issue, a system that can detect suspicious emails and phishing websites in real time and issue warnings to users is needed. However, conventional methods have difficulty responding to new phishing patterns, and regular expressions and simple keyword detection in particular have limitations. There is a need to develop a system that utilizes generative AI models to effectively detect threats in real time.

[0078] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0079] In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing a warning to a user when the suspicious emails and phishing websites are detected, means for initializing the generative AI model and performing periodic learning and updating for analyzing suspicious emails and phishing websites, means for detecting suspicious keywords and URL structures using regular expressions, and means for obtaining the analysis results via the user's terminal and displaying a warning. This makes it possible to detect suspicious emails and phishing websites with high accuracy in real time and protect users from these threats.

[0080] A "generative AI model" is an algorithm or system that uses artificial intelligence technology to learn patterns and features from data and then generate and analyze them.

[0081] "Suspicious email" refers to email that is likely to be malicious, such as phishing or spam, and is an electronic message sent to deceive users and steal their personal information.

[0082] A "phishing website" is a malicious web page that masquerades as a legitimate website and is designed to trick users into entering personal or authentication information.

[0083] "Real-time analysis" refers to processing and analyzing data instantly and providing the results immediately.

[0084] "Issuing a warning" means that the system displays a message to the user to warn them or notify them of a danger.

[0085] A "regular expression" is a notation used to specify text patterns and to manipulate and search strings, and is used to efficiently search for specific strings or patterns.

[0086] A "URL structure" is the shape and format of a string of characters used to point to resources on the Internet.

[0087] "Obtaining analysis results" refers to obtaining the conclusions and judgments generated after the system analyzes the data.

[0088] "Initializing" means setting a system or model to a state before it starts operating and loading the necessary data and parameters.

[0089] "Periodic learning and updating" is the process of incorporating new data at regular intervals to maintain or improve the performance and accuracy of a model.

[0090] This invention is a system that uses generative AI models to detect suspicious emails and phishing websites in real time and issue warnings to users. This system is mainly composed of three elements: a server, a terminal, and a user.

[0091] Server configuration and operation

[0092] The server runs on Google Cloud Platform or other cloud infrastructure and is responsible for initializing and running the generative AI model. Specifically, the server builds and operates the AI ​​model using the Transformers library from TENSORFLOW or Hugging Face. The server periodically collects data on the latest phishing emails and phishing sites and updates the generative AI model based on that data.

[0093] Terminal configuration and operation

[0094] The user's device (e.g., a PC or smartphone) is responsible for sending emails and website URLs to the server for analysis, providing an interface for accessing the generative AI model, and issuing warnings to the user based on the analysis results.

[0095] The specific software used by the device includes a program that uses regular expressions in Python's re library to search for suspicious keywords, and an API client for calling the generative AI model.

[0096] User operations

[0097] When a user receives an email, the content of the email is sent by the device to the generative AI model. Similarly, when a user attempts to visit a website, the URL is sent by the device to the generative AI model.

[0098] Analysis and Warning Flow

[0099] The analysis uses the is_phishing_email and is_phishing_website methods. These methods detect suspicious keywords and URL structures and evaluate the overall content using a generative AI model. If the analysis results indicate that the email or website is suspicious, the device will warn the user with the message "Warning: This email looks suspicious" or "Warning: This website looks suspicious."

[0100] Specific examples

[0101] Example 1: If a user receives an email with the content "Urgent: Your account has been compromised, click here to verify your login details," the device sends the email content to the generative AI model for analysis. This email contains suspicious keywords such as "Urgent," "click here," and "verify," so the is_phishing_email method uses regular expressions to detect these keywords, and the generative AI model determines the email to be suspicious. As a result, the device displays a warning to the user saying, "Warning: This email looks suspicious."

[0102] Example 2: If the URL a user is trying to visit is "http: / / secure-login.example.com," the device sends the URL to the generated AI model for analysis. This URL contains suspicious keywords such as "secure" and "login," so the is_phishing_website method uses regular expressions to detect these keywords, and the generated AI model determines that the URL is suspicious. As a result, the device displays a warning to the user: "Warning: This website looks suspicious."

[0103] This system protects users from suspicious emails and websites, allowing them to use the Internet safely.

[0104] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0105] Step 1:

[0106] The server initializes the generative AI model. During this initialization process, the server retrieves the latest dataset of phishing emails and phishing sites and trains the generative AI model based on this. The model is built using TensorFlow on Google Cloud Platform and the Hugging Face Transformers library. It receives the dataset as input and obtains a trained generative AI model as output.

[0107] What it does: The server downloads the dataset, runs the process of training the model using the TensorFlow library, and saves the trained model after completion.

[0108] Step 2:

[0109] The user receives an email. At this point, the user's device retrieves the email content and prepares it for sending to the generative AI model. The received email is taken as input and converted into a data format for sending as output to the generative AI model.

[0110] Specific operation: The contents of the received email are obtained via API and the necessary data (e.g., email body, subject, sender information, etc.) is extracted.

[0111] Step 3:

[0112] The device sends preprocessed emails to the server to be sent to the generative AI model. At this time, the is_phishing_email method is used to analyze suspicious keywords and patterns. The preprocessed email data is received as input, and the analysis result indicating the likelihood of the email being suspicious is obtained as output.

[0113] Specific operation: Search for suspicious keywords using Python's re library, execute the process of sending the data to the generative AI model, receive the analysis results, and evaluate their reliability.

[0114] Step 4:

[0115] The terminal displays a warning to the user based on the analysis results. If the email is judged to be suspicious, it will warn the user with "Warning: This email looks suspicious." It receives the analysis results as input and displays a warning message to the user as output.

[0116] What it does: Displays a warning message to the user as a popup or notification banner. Uses the email client interface to visually indicate the warning.

[0117] Step 5:

[0118] When a user attempts to visit a website, the device retrieves the URL and prepares it for sending to the generative AI model. It takes the URL being visited as input and converts it into a data format to send to the generative AI model as output.

[0119] Specific operation: Uses a browser extension to catch the URL and extract the necessary data (e.g., the entire URL, domain information, etc.).

[0120] Step 6:

[0121] The device sends the preprocessed URL to the server to be sent to the generative AI model. At this time, the is_phishing_website method is used to analyze suspicious keywords and structures. The preprocessed URL data is received as input, and the analysis result indicating the possibility of the website being suspicious is obtained as output.

[0122] Specific operation: Search for suspicious keywords using Python's re library, execute the process of sending the data to the generative AI model, receive the analysis results, and evaluate their reliability.

[0123] Step 7:

[0124] The device displays a warning to the user based on the analysis results. If the URL is determined to be suspicious, it will warn the user with "Warning: This website looks suspicious." It receives the analysis results as input and displays a warning message to the user as output.

[0125] What it does: Displays a warning message to the user as a popup or notification banner. Uses the browser interface to visually indicate the warning.

[0126] Through the above processing steps, users can be effectively protected from suspicious emails and phishing websites.

[0127] (Application example 1)

[0128] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0129] In recent years, phishing attacks and fraudulent emails have been increasing, making it difficult for users to take appropriate measures against them. In particular, phishing websites and emails have become more sophisticated, making it difficult to detect them using conventional security measures, hindering safe Internet use. In addition, new phishing patterns are constantly emerging, requiring technology to respond quickly to these attacks.

[0130] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0131] In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing an alert to a communication device when the suspicious emails and phishing websites are detected, and means for controlling the generative AI model and detecting suspicious content using application software. This allows users to quickly respond to the latest phishing patterns, is protected from suspicious emails and websites, and enables safe Internet use.

[0132] A "generative AI model" is a model trained using machine learning techniques that has the ability to detect and classify suspicious emails and phishing websites.

[0133] "Suspicious email" refers to email containing suspicious content sent with the intent of phishing or unauthorized access.

[0134] A "phishing website" is a website that is disguised with the intent of fraudulently obtaining users' personal information and authentication information.

[0135] "Real-time analysis measures" are mechanisms for instantly evaluating the content of emails and websites to detect suspicious elements.

[0136] The "means for issuing a warning to a communication device" has the function of notifying the user of information about detected suspicious emails or websites and displaying a warning.

[0137] "Application software" refers to programs installed on smartphones and other devices that detect suspicious content and respond based on the analysis results.

[0138] This invention is a system that uses a generative AI model to detect suspicious emails and phishing websites in real time and issue a warning to the user. Specifically, a server manages the generative AI model, and the device provides email and website URLs, which are then forwarded to the generative AI model for analysis. Based on the analysis results, the device issues a warning if suspicious content is detected.

[0139] The server initializes the generative AI model using the transformers library provided by Hugging Face. The generative AI model periodically learns and updates new phishing patterns. This model continues to learn suspicious features, allowing it to adapt to the latest security threats.

[0140] The device is primarily a smartphone, and the program works in conjunction with an email client and a browser extension.

[0141] For example:

[0142] 1. Suspicious email analysis:

[0143] If a user receives an email with the message "Urgent: Your account has been compromised, click here to verify your login details," the device forwards the email content to the generative AI model.

[0144] The generative AI model analyzes email content to detect suspicious keywords and patterns, in this case keywords like "urgent" and "click here" that are identified as risk factors.

[0145] After analysis, the email is determined to be highly likely to be phishing, so the device displays a warning to the user saying, "Warning: This email looks suspicious."

[0146] 2. Phishing website analysis:

[0147] When a user attempts to access the URL "http: / / secure-login.example.com", the device forwards the URL to the generative AI model.

[0148] The generative AI model analyzes the structure of the URL and the keywords it contains, in this case keywords like "secure" and "login" that match the characteristics of a phishing site.

[0149] After analysis, the URL is determined to be a likely phishing site, so the device displays a warning to the user saying, "Warning: This website looks suspicious."

[0150] Example prompts to input to a generative AI model:

[0151] For email content: Classify this email content: Urgent: Your account has been compromised, click here to verify your login details.

[0152] For a URL: Is this a phishing website? URL: http: / / secure-login.example.com

[0153] This protects users from suspicious emails and websites, allowing them to use the Internet safely.

[0154] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0155] Step 1:

[0156] When a user receives an email or accesses a website, the device acquires the content of the received email or the URL of the website the user is trying to access. This input data is the email body or URL.

[0157] Step 2:

[0158] The device provides the retrieved email content or URL to the generative AI model, which process includes the device communicating with the generative AI model and forwarding the email content or URL for analysis.

[0159] Step 3:

[0160] The generative AI model on the server analyzes the provided email content and URLs. This analysis includes keyword detection using regular expressions and an overall evaluation by the AI ​​model. For example, the regular expressions are used to search for whether the email content contains keywords such as "urgent" or "click here," and then the generative AI model evaluates the content. Similarly, in the case of URLs, the URL structure and keywords (e.g., "secure," "login") are analyzed. The output of this step is an evaluation result of whether the email or URL is suspicious.

[0161] Step 4:

[0162] Based on the analysis results of the generative AI model, the device generates a warning message for suspicious emails and websites, such as "Warning: This email looks suspicious" or "Warning: This website looks suspicious."

[0163] Step 5:

[0164] The device will then display the generated warning message to the user via a pop-up notification or alert dialog, protecting the user from phishing attacks and unauthorized access.

[0165] Furthermore, an emotion engine that estimates the user's emotion may be combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0166] The present invention combines a system that uses generative AI models to detect suspicious emails and phishing websites in real time and alert users to them, with an emotion engine that recognizes user emotions.

[0167] The server initializes the generative AI model, learning the characteristics of phishing and fraudulent content so that it can identify and classify them in real time. The generative AI model is constantly updated to learn new phishing patterns, ensuring it can always keep up with the latest threats.

[0168] When a user receives an email, the device provides the email content to the program. If the email content is something like "Urgent: Your account has been compromised, click here to verify your login details," the device sends the email to the generative AI model for analysis. The generative AI model analyzes the email body using the is_phishing_email method. This method checks whether the email contains suspicious keywords (e.g., "free," "urgent," "click here," "login") and then evaluates the content using the model.

[0169] After the device receives the phishing detection result, if the email is deemed suspicious, it displays a warning to the user saying, "Warning: This email looks suspicious." At this time, the emotion engine also detects the user's reaction.

[0170] When a user receives a warning, the emotion engine analyzes the user's facial expressions, voice, text input, etc. to recognize their emotions. The emotion engine obtains this data in real time and recognizes the emotional reaction the user had to the warning.

[0171] After the emotion engine recognizes the user's emotions, the device will adjust the warning content and notification method based on the results. For example, if the user reacts with fear, the warning message will be changed to a calmer tone and provide more detailed countermeasures.

[0172] When a user attempts to visit a website, they enter the URL into their device. For example, if the URL is "http: / / secure-login.example.com," the device sends this information to the generative AI model for analysis. The generative AI model evaluates the URL using the is_phishing_website method, checking for suspicious keywords (e.g., "login," "verify," "secure") and the URL structure, and determines that it is a phishing site.

[0173] After the device receives the phishing detection results, if the site is deemed suspicious, it will display a warning to the user saying, "Warning: This website looks suspicious." In this case, the emotion engine will also analyze the user's reaction and adjust the notification method to encourage appropriate action.

[0174] As a concrete example, the system details the process when a user provides email content and when a user provides a URL. In the case of email, if the system detects that the email is suspicious and detects that the user's reaction is "surprise" or "anxiety," it adjusts the warning message accordingly. Similarly, in the case of URLs, if the system detects that the site is suspicious and detects that the user's reaction is "fear" or "suspicious," it provides a response method appropriate to that emotion.

[0175] Through the above process, users are protected in real time from suspicious emails and phishing sites, and can receive more appropriate warnings and responses through the emotion engine.

[0176] The processing flow will be explained below.

[0177] Suspicious email detection and user emotion recognition processing

[0178] Step 1:

[0179] The server initializes the generative AI model, which creates an instance of the generative AI model and prepares it to learn the characteristics of phishing and fraudulent content.

[0180] Step 2:

[0181] The server initializes the phishing detector with the generative AI model, which then performs real-time analysis of emails and websites.

[0182] Step 3:

[0183] The server updates the training data for the generated AI model, allowing the AI ​​model to learn new phishing patterns and respond to the latest threats.

[0184] Step 4:

[0185] A user opens the email they received and types the contents into their terminal. For example, the email may say, "Urgent: Your account has been compromised, click here to verify your login details."

[0186] Step 5:

[0187] The device sends the entered email content to the phishing detector.

[0188] Step 6:

[0189] The phishing detector analyzes the content of the email sent. First, it checks the content of the email using regular expressions to see if it contains predetermined suspicious keywords (e.g., "free," "urgent," "click here," "login").

[0190] Step 7:

[0191] Based on the results of the keyword check, the phishing detector uses a generative AI model to perform a more detailed content analysis, and then uses the classify method of the generative AI model to determine whether the email content is phishing.

[0192] Step 8:

[0193] If the device receives the phishing detection results and determines that the email is suspicious, it will display a warning to the user saying, "Warning: This email looks suspicious."

[0194] Step 9:

[0195] When the device issues a warning, it uses an emotion engine to detect the user's reaction. The emotion engine analyzes the user's facial expressions, voice, and text input to recognize the user's emotional reaction to the warning.

[0196] Step 10:

[0197] After the emotion engine recognizes the user's emotions, the device will adjust the warning content and notification method based on the results. For example, if the user reacts with fear, the warning message will be changed to a calmer tone and provide more detailed countermeasures.

[0198] Phishing website detection and user emotion recognition processing

[0199] Step 1:

[0200] The user enters the URL of the website they are trying to visit into the terminal. For example, the URL might be "http: / / secure-login.example.com."

[0201] Step 2:

[0202] The device sends the entered URL to the phishing detector.

[0203] Step 3:

[0204] The phishing detector analyzes the submitted URL, checking its structure and whether it contains any suspicious keywords (e.g. "login", "verify", "secure").

[0205] Step 4:

[0206] Based on the results of URL analysis, the phishing detector uses a generative AI model to perform further detailed URL analysis, and uses the classify method of the generative AI model to determine whether the URL corresponds to a phishing site.

[0207] Step 5:

[0208] If the device receives the phishing detection results and determines the site to be suspicious, it will display a warning to the user saying, "Warning: This website looks suspicious."

[0209] Step 6:

[0210] When the device issues a warning, it uses an emotion engine to detect the user's reaction. The emotion engine analyzes the user's facial expressions, voice, and text input to recognize the user's emotional reaction to the warning.

[0211] Step 7:

[0212] After the emotion engine recognizes the user's emotions, the device will adjust the alerts and notification methods based on the results. For example, if the user expresses fear or doubt, the device will provide a response method according to that emotion.

[0213] Through these processing steps, users are protected in real time from suspicious emails and phishing sites, and can receive more appropriate warnings and responses through the emotion engine.

[0214] Example 2

[0215] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0216] While conventional phishing detection systems have the ability to detect suspicious emails and phishing websites, they have a problem in that they are unable to provide flexible warnings and notifications that reflect the user's emotions. In particular, when users are frightened or confused by the warning, they often do not take appropriate action. Another problem is that they are slow to learn and apply new phishing patterns.

[0217] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing a warning to a user when the suspicious emails and phishing websites are detected, and means for adjusting the warning content and notification method using an emotion engine that recognizes the user's emotions. This enables flexible and appropriate warnings and notifications that correspond to the user's emotions.

[0218] A "generative AI model" is an artificial intelligence algorithm trained to detect phishing emails and suspicious websites.

[0219] A "prompt" is an instruction entered into a generative AI model to make it perform a specific task.

[0220] "Suspicious email" refers to emails intended to phish or spread malware, with the intent to deceive users and steal their personal information.

[0221] A "phishing website" is a webpage that masquerades as a legitimate website and is intended to fraudulently obtain users' personal information.

[0222] "Warning measures" are mechanisms that notify users when they encounter suspicious emails or phishing websites.

[0223] The "emotion engine" is a technology that recognizes and analyzes the user's emotions, enabling appropriate measures and notifications to be taken based on the user's reaction.

[0224] This invention combines a system that uses generative AI models to detect suspicious emails and phishing websites in real time and warns users, with an emotion engine that recognizes user emotions. This system protects users from suspicious emails and websites in real time and enables appropriate responses based on their emotions.

[0225] System Configuration

[0226] server

[0227] The server loads and initializes the generative AI model. This model learns the characteristics of phishing and fraudulent content and identifies and classifies them in real time. For example, OpenAI's GPT-3 model is used. The server also periodically learns new phishing patterns and processes data to update the model, allowing it to respond to the latest threats.

[0228] Terminal

[0229] The device is responsible for analyzing the content of emails received by the user and the URLs of websites the user attempts to access. The device provides the analysis data to the generative AI model, and after receiving the results, displays appropriate warnings to the user. Furthermore, the device uses an emotion engine to recognize the user's emotions in real time and adjust the content of the warning and notification method.

[0230] When a user receives an email

[0231] When a user receives an email, the device provides the email content to the generative AI model. For example, it sends the following prompt:

[0232] "Analyze the following email content and determine if it is a phishing email: 'Urgent: Your account has been compromised, click here to verify your login details.'"

[0233] The generative AI model checks the email body for suspicious keywords (e.g., "free," "urgent," "click here," "login") and then evaluates the overall content. The device receives the analysis results, and if it determines the email is suspicious, it displays a warning to the user saying, "Warning: This email looks suspicious."

[0234] Recognizing user emotions

[0235] The emotion engine analyzes the user's facial expressions, voice, and text input to recognize emotions. Specifically, it uses a webcam and microphone to capture data in real time and determine the user's emotional reaction to the warning. Based on this, the device can adjust the content of the warning message and notification method.

[0236] When a user visits a website

[0237] When a user wants to visit a website, they enter its URL into their device, for example "http: / / secure-login.example.com", which the device sends to a generative AI model for analysis, using a prompt like this:

[0238] "Analyze the following URL and determine if it is a phishing website: 'http: / / secure-login.example.com'"

[0239] The generative AI model analyzes the URL and evaluates suspicious keywords, URL structure, etc. If the device determines it is a phishing site, it displays a warning to the user saying, "Warning: This website looks suspicious."

[0240] As described above, by combining a generative AI model with an emotion engine, the present invention detects suspicious emails and phishing websites in real time and provides users with appropriate warnings and emotional responses.

[0241] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0242] Step 1:

[0243] The server initializes the generative AI model. In this step, the model is loaded with pre-trained features of phishing and fraudulent content, and made ready for use. Specifically, the server loads the libraries and data required for the generative AI model and performs initial settings to run the model. The inputs include pre-prepared model files and configuration scripts. The output is an initialized generative AI model.

[0244] Step 2:

[0245] A user receives an email. In this step, the user's mail client receives the new email and displays it. Specifically, it downloads the new email from the mail server and adds it to the user's inbox. The input is the new email sent from the mail server. The output is the new email displayed in the inbox.

[0246] Step 3:

[0247] The terminal provides the content of the email received to the generative AI model. Specifically, it extracts the body of the received email for analysis and creates a prompt to send to the generative AI model. The input is the content of the email received by the user. For example, the following prompt is sent to the generative AI model:

[0248] "Analyze the following email content and determine if it is a phishing email: 'Urgent: Your account has been compromised, click here to verify your login details.'"

[0249] The output is a prompt sentence for analysis, which is sent to the generative AI model.

[0250] Step 4:

[0251] The generative AI model analyzes the email using the is_phishing_email method. Specifically, the generative AI model checks for suspicious keywords (e.g., "free", "urgent", "click here", "login") in the email body and evaluates the overall content. The input is the prompt provided in step 3. The output is a judgment result on whether the email is phishing.

[0252] Step 5:

[0253] The device receives the analysis results and displays a warning to the user if the email is deemed suspicious. Specifically, it receives the analysis results from the generative AI model, generates a warning message, and displays it to the user. The input is the analysis results provided by the generative AI model. The output is the warning message "Warning: This email looks suspicious." that is displayed to the user.

[0254] Step 6:

[0255] The emotion engine analyzes the user's emotional response. Specifically, it captures the user's facial expressions and voice in real time using a webcam and microphone connected to the device, and analyzes this data to recognize emotions. The input is the user's facial expression and voice data. The output is the user's emotional data (e.g., surprise, anxiety).

[0256] Step 7:

[0257] The device adjusts the warning content and notification method based on the emotional data provided by the emotion engine. Specifically, if the user expresses surprise or anxiety, the tone of the warning message is changed to a calmer one and specific countermeasures are provided. The input is the user's emotional data recognized by the emotion engine. The output is a revised warning message.

[0258] Step 8:

[0259] When a user visits a website, they enter the URL into their device. Specifically, they enter the URL into the address bar of their browser. The input is the URL the user is trying to access (e.g., "http: / / secure-login.example.com"). The output is the URL information the user entered, which is provided to the device.

[0260] Step 9:

[0261] The device sends the URL to the generated AI model, which analyzes it using the is_phishing_website method. Specifically, it checks the URL structure and keywords it contains to evaluate whether it is a phishing website. The input is a URL provided by the user. For example, use the following prompt:

[0262] "Analyze the following URL and determine if it is a phishing website: 'http: / / secure-login.example.com'"

[0263] The output is a determination of whether the URL is a phishing site.

[0264] Step 10:

[0265] The device receives the judgment result and displays a warning to the user if the site is deemed suspicious. The input is the analysis result provided by the generative AI model. The output is the warning message displayed to the user: "Warning: This website looks suspicious."

[0266] The above are the specific processing steps of this system.

[0267] (Application example 2)

[0268] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0269] In recent years, cyber attacks using suspicious emails and phishing websites have been increasing, and many users have fallen victim to them. These attacks are evolving daily, with new patterns and techniques constantly emerging, making traditional methods often insufficient to deal with. Furthermore, rather than simply issuing a warning, it is necessary to encourage appropriate responses while taking into consideration the user's emotions. Therefore, there is a need for a system that can detect suspicious content in real time and issue warnings based on the user's emotions.

[0270] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing a warning to the user when the suspicious emails and phishing websites are detected, and means for analyzing the user's reaction using an emotion engine that recognizes the user's emotions and adjusting the warning content and notification method. This makes it possible to protect users from suspicious emails and phishing websites and to issue appropriate warnings and responses according to the user's emotions.

[0271] A "generative AI model" is a type of artificial intelligence, a technology that has the ability to generate new data based on large amounts of data.

[0272] "Suspicious email" refers to email sent with malicious purposes, such as phishing or spam, that may cause harm to users.

[0273] A "phishing website" is a malicious website designed to steal users' personal or confidential information; it looks like a legitimate website but is actually a disguised version.

[0274] "Means of warning users" refers to the means of informing users of the existence of suspicious emails or phishing websites, and can be various methods such as audio, visual, or text.

[0275] An "emotion engine" is a technology for recognizing a user's emotions, and determines the user's emotional state based on data such as facial expressions, voice, and text.

[0276] "Regularly learning and updating new phishing patterns" means that the generative AI model continuously learns about newly discovered phishing techniques and patterns and automatically updates its knowledge.

[0277] "Analysis based on specific keywords, URL structures, and image patterns" is a detection method that uses keywords, URL structures, and image patterns to identify the characteristics of suspicious emails and phishing websites.

[0278] System configuration

[0279] This invention combines a system that uses generative AI models to detect suspicious emails and phishing websites in real time and warns users, with an emotion engine that recognizes user emotions. The system has three main components: a server, a device, and a user.

[0280] Program implementation example

[0281] Detailed Description

[0282] 1. Initializing and training the generative AI model

[0283] The server keeps email and website data up to date by regularly learning and updating new phishing patterns using generative AI models, such as OpenAI's GPT model.

[0284] 2. Email Analysis

[0285] When a user receives an email, the device sends the email content to the server, where the generative AI model analyzes it to determine whether it is suspicious. For example, if the email content is something like "Urgent: Your account has been compromised, click here to verify your login details," the server will have the generative AI model analyze the email. This analysis checks for specific keywords and phrases (e.g., "free," "urgent," "click here," "login"), and the AI ​​evaluates the content.

[0286] 3. User Warning

[0287] If the server determines the email is suspicious, the device will display a warning to the user saying, "Warning: This email looks suspicious."

[0288] 4. Emotion Recognition by Emotion Engine

[0289] An emotion engine is also used at this time. The emotion engine recognizes emotions from the user's facial expressions, voice, text input, etc. For example, it analyzes the user's reactions in real time using a camera or microphone. This analysis is performed using emotion analysis libraries such as Affectiva and Google Cloud Natural Language.

[0290] 5. Adjust warning messages based on emotions

[0291] After the emotion engine recognizes the user's emotions, the device will adjust the warning message and notification method based on that reaction. For example, if the user expresses emotions such as "surprise" or "anxiety," the device will adjust the warning message to something like "Warning: This email contains suspicious content. Please remain calm and check how to deal with it."

[0292] 6. Website Analytics

[0293] Similarly, if a user enters a URL, the device sends it to the server, and the generative AI model analyzes the website. An example of a suspicious URL would be "http: / / secure-login.example.com." If the URL is deemed suspicious, the device will display a warning saying, "Warning: This website looks suspicious."

[0294] Specific examples

[0295] Prompt Sentence Examples

[0296] An example of a prompt to input to a generative AI model is as follows:

[0297] Check if this email is a phishing attempt: Urgent: Your account has been compromised, click here to verify your login details.

[0298] This prompt is sent to a generative AI model to determine whether the email is phishing.

[0299] These processes not only protect users from suspicious emails and phishing websites in real time, but also allow them to receive more appropriate warnings and responses through the emotion engine, which has a significant effect on keeping users safe.

[0300] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0301] Step 1: User receives email

[0302] The user receives an email on their device. The device then provides the content of the received email to the program. Specifically, the program extracts the email body, subject, sender information, etc. This content becomes the input data for subsequent analysis.

[0303] Step 2: Email analysis with a generative AI model

[0304] The device sends the extracted email content to the server. The server inputs the email content into the generative AI model and analyzes whether the email is phishing. At this time, the generative AI model is given the following prompt as input:

[0305] "Check if this email is a phishing attempt: Urgent: Your account has been compromised, click here to verify your login details."

[0306] The server receives the output of the generative AI model and determines whether the email is phishing.

[0307] Step 3: Display a warning message to the user

[0308] The server sends the analysis results back to the device. If the device determines that the email is phishing, it displays a warning message to the user saying, "Warning: This email looks suspicious." The warning message is displayed to alert the user to the danger before they take action.

[0309] Step 4: Emotion Recognition with the Emotion Engine

[0310] When a warning message is displayed, the device captures the user's reaction. Specifically, it takes a picture of the user's facial expression with a camera and records the user's voice with a microphone. The emotion engine recognizes the user's emotions based on this data. For example, if the user shows a surprised expression, that emotional data is input into the emotion engine.

[0311] Step 5: Tailor warning messages according to emotions

[0312] The emotion engine analyzes the user's emotional data and sends the results back to the device. The device then adjusts the warning message based on the analysis results. For example, if the emotion engine detects "surprise" or "anxiety," the device will adjust the warning message to something like "Warning: This email contains suspicious content. Please remain calm and check how to deal with it."

[0313] Step 6: User visits your website

[0314] When a user tries to visit a website by entering a URL, the device sends the URL to the server. For example, the user enters the URL "http: / / secure-login.example.com." This URL becomes the input data for analysis.

[0315] Step 7: Analyze the website with a generative AI model

[0316] The server inputs the received URL into the generative AI model to analyze whether the website is a phishing site. The generative AI model analyzes specific keywords, URL structure, and image patterns to determine whether it is a phishing site. The analysis results are then sent from the server to the device.

[0317] Step 8: Display a warning message for visiting the website

[0318] Based on the analysis results, the device will display a warning message to the user saying, "Warning: This website looks suspicious." The message is displayed to inform the user of the dangers of visiting the website.

[0319] Step 9: Emotion recognition again by the emotion engine

[0320] When a website visit warning message appears, the device will again use the emotion engine to capture the user's reaction and recognize their emotion. For example, if the user shows a look of fear, that data will be input into the emotion engine.

[0321] Step 10: Recalibrate your warning messages based on emotions

[0322] Based on the analysis results of the emotion engine, the device will then adjust the warning message accordingly. For example, if emotions such as "fear" or "suspiciousness" are detected, the warning message will be changed to "Warning: This website is highly suspicious. Do not visit."

[0323] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0324] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (registered trademark) (Internet search engine).<URL: https: / / openai.com / blog / chatgpt> ), Gemini (registered trademark) (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0325] In the above embodiment, an example in which the specific process is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific process may be performed by the smart device 14.

[0326] [Second embodiment]

[0327] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0328] 3, the data processing system 210 includes the data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0329] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0330] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0331] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0332] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0333] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0334] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0335] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0336] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0337] In the smart glasses 214, the reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0338] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal."

[0339] The present invention is a system that utilizes generative AI models to detect suspicious emails and phishing websites in real time and alert users.

[0340] The server initializes the generative AI model, which periodically learns and updates new phishing patterns. The generative AI model learns the characteristics of phishing and fraudulent content and uses them to identify and classify suspicious emails and websites in real time.

[0341] When a user receives an email, the device provides the email content to the program. The device then sends the provided email content to the generative AI model, which analyzes it using the is_phishing_email method. This method uses regular expressions to search for suspicious keywords (e.g., "free," "urgent," "click here," "login"), and then evaluates the content using the generative AI model. If the email is determined to be suspicious, the device will issue a warning to the user saying, "Warning: This email looks suspicious."

[0342] When a user attempts to visit a website, the device provides the URL to the program. The device then sends the URL to the generative AI model, where it is analyzed using the is_phishing_website method. This method checks whether the URL contains suspicious keywords (e.g., "login," "verify," "secure") and whether the URL structure and patterns match the characteristics of a phishing site. The generative AI model then evaluates the URL, and if it is determined to be a suspicious site, the device issues a warning to the user saying, "Warning: This website looks suspicious."

[0343] The generative AI model continuously learns new phishing patterns, allowing it to stay current with the latest security threats. It also performs highly accurate analysis based on specific keywords, URL structures, and image patterns.

[0344] Specific examples are shown below.

[0345] Example 1: If a user receives an email with the content "Urgent: Your account has been compromised, click here to verify your login details," the device will send the email content to the generative AI model for analysis. Based on the analysis results, the email is deemed suspicious, and the device will display a warning saying "Warning: This email looks suspicious."

[0346] Example 2: If the URL the user is trying to visit is "http: / / secure-login.example.com," the device will send the URL to the AI ​​model for analysis. Based on the analysis results, the model determines that the URL is likely to be a phishing site, and will display a warning saying, "Warning: This website looks suspicious."

[0347] In this way, by using generative AI models, users can be protected from suspicious emails and websites and use the Internet safely.

[0348] The processing flow will be explained below.

[0349] Suspicious email detection process

[0350] Step 1:

[0351] The server initializes the generative AI model, which creates an instance of the generative AI model and prepares it to learn the characteristics of phishing and fraudulent content.

[0352] Step 2:

[0353] The server initializes the phishing detector with the generative AI model, which then performs real-time analysis of emails and websites.

[0354] Step 3:

[0355] The server updates the training data for the generated AI model, allowing the AI ​​model to learn new phishing patterns and respond to the latest threats.

[0356] Step 4:

[0357] A user opens the email they received and types the contents into their terminal. For example, the email may say, "Urgent: Your account has been compromised, click here to verify your login details."

[0358] Step 5:

[0359] The device sends the entered email content to the phishing detector.

[0360] Step 6:

[0361] The phishing detector analyzes the content of the email sent. First, it checks the content of the email using regular expressions to see if it contains predetermined suspicious keywords (e.g., "free," "urgent," "click here," "login").

[0362] Step 7:

[0363] Based on the results of the keyword check, the phishing detector uses a generative AI model to perform a more detailed content analysis, and then uses the classify method of the generative AI model to determine whether the email content is phishing.

[0364] Step 8:

[0365] If the device receives the phishing detection results and determines that the email is suspicious, it will display a warning to the user saying, "Warning: This email looks suspicious."

[0366] Phishing website detection process

[0367] Step 1:

[0368] The user enters the URL of the website they are trying to visit into the terminal. For example, the URL might be "http: / / secure-login.example.com."

[0369] Step 2:

[0370] The device sends the entered URL to the phishing detector.

[0371] Step 3:

[0372] The phishing detector analyzes the submitted URL, checking its structure and whether it contains any suspicious keywords (e.g. "login", "verify", "secure").

[0373] Step 4:

[0374] Based on the results of URL analysis, the phishing detector uses a generative AI model to perform further detailed URL analysis, and uses the classify method of the generative AI model to determine whether the URL corresponds to a phishing site.

[0375] Step 5:

[0376] If the device receives the phishing detection results and determines the site to be suspicious, it will display a warning to the user saying, "Warning: This website looks suspicious."

[0377] Through the above processing steps, users are protected in real time from suspicious emails and phishing sites, allowing them to use the Internet safely.

[0378] Example 1

[0379] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0380] With the spread of the Internet, the number of phishing scams and suspicious emails is increasing, increasing the risk of users being exposed to these threats. To address this issue, a system that can detect suspicious emails and phishing websites in real time and issue warnings to users is needed. However, conventional methods have difficulty responding to new phishing patterns, and regular expressions and simple keyword detection in particular have limitations. There is a need to develop a system that utilizes generative AI models to effectively detect threats in real time.

[0381] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0382] In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing a warning to a user when the suspicious emails and phishing websites are detected, means for initializing the generative AI model and performing periodic learning and updating for analyzing suspicious emails and phishing websites, means for detecting suspicious keywords and URL structures using regular expressions, and means for obtaining the analysis results via the user's terminal and displaying a warning. This makes it possible to detect suspicious emails and phishing websites with high accuracy in real time and protect users from these threats.

[0383] A "generative AI model" is an algorithm or system that uses artificial intelligence technology to learn patterns and features from data and then generate and analyze them.

[0384] "Suspicious email" refers to email that is likely to be malicious, such as phishing or spam, and is an electronic message sent to deceive users and steal their personal information.

[0385] A "phishing website" is a malicious web page that masquerades as a legitimate website and is designed to trick users into entering personal or authentication information.

[0386] "Real-time analysis" refers to processing and analyzing data instantly and providing the results immediately.

[0387] "Issuing a warning" means that the system displays a message to the user to warn them or notify them of a danger.

[0388] A "regular expression" is a notation used to specify text patterns and to manipulate and search strings, and is used to efficiently search for specific strings or patterns.

[0389] A "URL structure" is the shape and format of a string of characters used to point to resources on the Internet.

[0390] "Obtaining analysis results" refers to obtaining the conclusions and judgments generated after the system analyzes the data.

[0391] "Initializing" means setting a system or model to a state before it starts operating and loading the necessary data and parameters.

[0392] "Periodic learning and updating" is the process of incorporating new data at regular intervals to maintain or improve the performance and accuracy of a model.

[0393] This invention is a system that uses generative AI models to detect suspicious emails and phishing websites in real time and issue warnings to users. This system is mainly composed of three elements: a server, a terminal, and a user.

[0394] Server configuration and operation

[0395] The server runs on Google Cloud Platform or other cloud infrastructure and is responsible for initializing and running the generative AI model. Specifically, the server builds and operates the AI ​​model using TensorFlow and Hugging Face's Transformers library. The server periodically collects the latest phishing email and phishing site data and updates the generative AI model based on that data.

[0396] Terminal configuration and operation

[0397] The user's device (e.g., a PC or smartphone) is responsible for sending emails and website URLs to the server for analysis, providing an interface for accessing the generative AI model, and issuing warnings to the user based on the analysis results.

[0398] The specific software used by the device includes a program that uses regular expressions in Python's re library to search for suspicious keywords, and an API client for calling the generative AI model.

[0399] User operations

[0400] When a user receives an email, the content of the email is sent by the device to the generative AI model. Similarly, when a user attempts to visit a website, the URL is sent by the device to the generative AI model.

[0401] Analysis and Warning Flow

[0402] The analysis uses the is_phishing_email and is_phishing_website methods. These methods detect suspicious keywords and URL structures and evaluate the overall content using a generative AI model. If the analysis results indicate that the email or website is suspicious, the device will warn the user with the message "Warning: This email looks suspicious" or "Warning: This website looks suspicious."

[0403] Specific examples

[0404] Example 1: If a user receives an email with the content "Urgent: Your account has been compromised, click here to verify your login details," the device sends the email content to the generative AI model for analysis. This email contains suspicious keywords such as "Urgent," "click here," and "verify," so the is_phishing_email method uses regular expressions to detect these keywords, and the generative AI model determines the email to be suspicious. As a result, the device displays a warning to the user saying, "Warning: This email looks suspicious."

[0405] Example 2: If the URL a user is trying to visit is "http: / / secure-login.example.com," the device sends the URL to the generated AI model for analysis. This URL contains suspicious keywords such as "secure" and "login," so the is_phishing_website method uses regular expressions to detect these keywords, and the generated AI model determines that the URL is suspicious. As a result, the device displays a warning to the user: "Warning: This website looks suspicious."

[0406] This system protects users from suspicious emails and websites, allowing them to use the Internet safely.

[0407] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0408] Step 1:

[0409] The server initializes the generative AI model. During this initialization process, the server retrieves the latest dataset of phishing emails and phishing sites and trains the generative AI model based on this. The model is built using TensorFlow on Google Cloud Platform and the Hugging Face Transformers library. It receives the dataset as input and obtains a trained generative AI model as output.

[0410] What it does: The server downloads the dataset, runs the process of training the model using the TensorFlow library, and saves the trained model after completion.

[0411] Step 2:

[0412] The user receives an email. At this point, the user's device retrieves the email content and prepares it for sending to the generative AI model. The received email is taken as input and converted into a data format for sending as output to the generative AI model.

[0413] Specific operation: The contents of the received email are obtained via API and the necessary data (e.g., email body, subject, sender information, etc.) is extracted.

[0414] Step 3:

[0415] The device sends preprocessed emails to the server to be sent to the generative AI model. At this time, the is_phishing_email method is used to analyze suspicious keywords and patterns. The preprocessed email data is received as input, and the analysis result indicating the likelihood of the email being suspicious is obtained as output.

[0416] Specific operation: Search for suspicious keywords using Python's re library, execute the process of sending the data to the generative AI model, receive the analysis results, and evaluate their reliability.

[0417] Step 4:

[0418] The terminal displays a warning to the user based on the analysis results. If the email is judged to be suspicious, it will warn the user with "Warning: This email looks suspicious." It receives the analysis results as input and displays a warning message to the user as output.

[0419] What it does: Displays a warning message to the user as a popup or notification banner. Uses the email client interface to visually indicate the warning.

[0420] Step 5:

[0421] When a user attempts to visit a website, the device retrieves the URL and prepares it for sending to the generative AI model. It takes the URL being visited as input and converts it into a data format to send to the generative AI model as output.

[0422] Specific operation: Uses a browser extension to catch the URL and extract the necessary data (e.g., the entire URL, domain information, etc.).

[0423] Step 6:

[0424] The device sends the preprocessed URL to the server to be sent to the generative AI model. At this time, the is_phishing_website method is used to analyze suspicious keywords and structures. The preprocessed URL data is received as input, and the analysis result indicating the possibility of the website being suspicious is obtained as output.

[0425] Specific operation: Search for suspicious keywords using Python's re library, execute the process of sending the data to the generative AI model, receive the analysis results, and evaluate their reliability.

[0426] Step 7:

[0427] The device displays a warning to the user based on the analysis results. If the URL is determined to be suspicious, it will warn the user with "Warning: This website looks suspicious." It receives the analysis results as input and displays a warning message to the user as output.

[0428] What it does: Displays a warning message to the user as a popup or notification banner. Uses the browser interface to visually indicate the warning.

[0429] Through the above processing steps, users can be effectively protected from suspicious emails and phishing websites.

[0430] (Application example 1)

[0431] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0432] In recent years, phishing attacks and fraudulent emails have been increasing, making it difficult for users to take appropriate measures against them. In particular, phishing websites and emails have become more sophisticated, making it difficult to detect them using conventional security measures, hindering safe Internet use. In addition, new phishing patterns are constantly emerging, requiring technology to respond quickly to these attacks.

[0433] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0434] In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing an alert to a communication device when the suspicious emails and phishing websites are detected, and means for controlling the generative AI model and detecting suspicious content using application software. This allows users to quickly respond to the latest phishing patterns, is protected from suspicious emails and websites, and enables safe Internet use.

[0435] A "generative AI model" is a model trained using machine learning techniques that has the ability to detect and classify suspicious emails and phishing websites.

[0436] "Suspicious email" refers to email containing suspicious content sent with the intent of phishing or unauthorized access.

[0437] A "phishing website" is a website that is disguised with the intent of fraudulently obtaining users' personal information and authentication information.

[0438] "Real-time analysis measures" are mechanisms for instantly evaluating the content of emails and websites to detect suspicious elements.

[0439] The "means for issuing a warning to a communication device" has the function of notifying the user of information about detected suspicious emails or websites and displaying a warning.

[0440] "Application software" refers to programs installed on smartphones and other devices that detect suspicious content and respond based on the analysis results.

[0441] This invention is a system that uses a generative AI model to detect suspicious emails and phishing websites in real time and issue a warning to the user. Specifically, a server manages the generative AI model, and the device provides email and website URLs, which are then forwarded to the generative AI model for analysis. Based on the analysis results, the device issues a warning if suspicious content is detected.

[0442] The server initializes the generative AI model using the transformers library provided by Hugging Face. The generative AI model periodically learns and updates new phishing patterns. This model continues to learn suspicious features, allowing it to adapt to the latest security threats.

[0443] The device is primarily a smartphone, and the program works in conjunction with an email client and a browser extension.

[0444] For example:

[0445] 1. Suspicious email analysis:

[0446] If a user receives an email with the message "Urgent: Your account has been compromised, click here to verify your login details," the device forwards the email content to the generative AI model.

[0447] The generative AI model analyzes email content to detect suspicious keywords and patterns, in this case keywords like "urgent" and "click here" that are identified as risk factors.

[0448] After analysis, the email is determined to be highly likely to be phishing, so the device displays a warning to the user saying, "Warning: This email looks suspicious."

[0449] 2. Phishing website analysis:

[0450] When a user attempts to access the URL "http: / / secure-login.example.com", the device forwards the URL to the generative AI model.

[0451] The generative AI model analyzes the structure of the URL and the keywords it contains, in this case keywords like "secure" and "login" that match the characteristics of a phishing site.

[0452] After analysis, the URL is determined to be a likely phishing site, so the device displays a warning to the user saying, "Warning: This website looks suspicious."

[0453] Example prompts to input to a generative AI model:

[0454] For email content: Classify this email content: Urgent: Your account has been compromised, click here to verify your login details.

[0455] For a URL: Is this a phishing website? URL: http: / / secure-login.example.com

[0456] This protects users from suspicious emails and websites, allowing them to use the Internet safely.

[0457] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0458] Step 1:

[0459] When a user receives an email or accesses a website, the device acquires the content of the received email or the URL of the website the user is trying to access. This input data is the email body or URL.

[0460] Step 2:

[0461] The device provides the retrieved email content or URL to the generative AI model, which process includes the device communicating with the generative AI model and forwarding the email content or URL for analysis.

[0462] Step 3:

[0463] The generative AI model on the server analyzes the provided email content and URLs. This analysis includes keyword detection using regular expressions and an overall evaluation by the AI ​​model. For example, the regular expressions are used to search for whether the email content contains keywords such as "urgent" or "click here," and then the generative AI model evaluates the content. Similarly, in the case of URLs, the URL structure and keywords (e.g., "secure," "login") are analyzed. The output of this step is an evaluation result of whether the email or URL is suspicious.

[0464] Step 4:

[0465] Based on the analysis results of the generative AI model, the device generates a warning message for suspicious emails and websites, such as "Warning: This email looks suspicious" or "Warning: This website looks suspicious."

[0466] Step 5:

[0467] The device will then display the generated warning message to the user via a pop-up notification or alert dialog, protecting the user from phishing attacks and unauthorized access.

[0468] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[0469] The present invention combines a system that uses generative AI models to detect suspicious emails and phishing websites in real time and alert users to them, with an emotion engine that recognizes user emotions.

[0470] The server initializes the generative AI model, learning the characteristics of phishing and fraudulent content so that it can identify and classify them in real time. The generative AI model is constantly updated to learn new phishing patterns, ensuring it can always keep up with the latest threats.

[0471] When a user receives an email, the device provides the email content to the program. If the email content is something like "Urgent: Your account has been compromised, click here to verify your login details," the device sends the email to the generative AI model for analysis. The generative AI model analyzes the email body using the is_phishing_email method. This method checks whether the email contains suspicious keywords (e.g., "free," "urgent," "click here," "login") and then evaluates the content using the model.

[0472] After the device receives the phishing detection result, if the email is deemed suspicious, it displays a warning to the user saying, "Warning: This email looks suspicious." At this time, the emotion engine also detects the user's reaction.

[0473] When a user receives a warning, the emotion engine analyzes the user's facial expressions, voice, text input, etc. to recognize their emotions. The emotion engine obtains this data in real time and recognizes the emotional reaction the user had to the warning.

[0474] After the emotion engine recognizes the user's emotions, the device will adjust the warning content and notification method based on the results. For example, if the user reacts with fear, the warning message will be changed to a calmer tone and provide more detailed countermeasures.

[0475] When a user attempts to visit a website, they enter the URL into their device. For example, if the URL is "http: / / secure-login.example.com," the device sends this information to the generative AI model for analysis. The generative AI model evaluates the URL using the is_phishing_website method, checking for suspicious keywords (e.g., "login," "verify," "secure") and the URL structure, and determines that it is a phishing site.

[0476] After the device receives the phishing detection results, if the site is deemed suspicious, it will display a warning to the user saying, "Warning: This website looks suspicious." In this case, the emotion engine will also analyze the user's reaction and adjust the notification method to encourage appropriate action.

[0477] As a concrete example, the system details the process when a user provides email content and when a user provides a URL. In the case of email, if the system detects that the email is suspicious and detects that the user's reaction is "surprise" or "anxiety," it adjusts the warning message accordingly. Similarly, in the case of URLs, if the system detects that the site is suspicious and detects that the user's reaction is "fear" or "suspicious," it provides a response method appropriate to that emotion.

[0478] Through the above process, users are protected in real time from suspicious emails and phishing sites, and can receive more appropriate warnings and responses through the emotion engine.

[0479] The processing flow will be explained below.

[0480] Suspicious email detection and user emotion recognition processing

[0481] Step 1:

[0482] The server initializes the generative AI model, which creates an instance of the generative AI model and prepares it to learn the characteristics of phishing and fraudulent content.

[0483] Step 2:

[0484] The server initializes the phishing detector with the generative AI model, which then performs real-time analysis of emails and websites.

[0485] Step 3:

[0486] The server updates the training data for the generated AI model, allowing the AI ​​model to learn new phishing patterns and respond to the latest threats.

[0487] Step 4:

[0488] A user opens the email they received and types the contents into their terminal. For example, the email may say, "Urgent: Your account has been compromised, click here to verify your login details."

[0489] Step 5:

[0490] The device sends the entered email content to the phishing detector.

[0491] Step 6:

[0492] The phishing detector analyzes the content of the email sent. First, it checks the content of the email using regular expressions to see if it contains predetermined suspicious keywords (e.g., "free," "urgent," "click here," "login").

[0493] Step 7:

[0494] Based on the results of the keyword check, the phishing detector uses a generative AI model to perform a more detailed content analysis, and then uses the classify method of the generative AI model to determine whether the email content is phishing.

[0495] Step 8:

[0496] If the device receives the phishing detection results and determines that the email is suspicious, it will display a warning to the user saying, "Warning: This email looks suspicious."

[0497] Step 9:

[0498] When the device issues a warning, it uses an emotion engine to detect the user's reaction. The emotion engine analyzes the user's facial expressions, voice, and text input to recognize the user's emotional reaction to the warning.

[0499] Step 10:

[0500] After the emotion engine recognizes the user's emotions, the device will adjust the warning content and notification method based on the results. For example, if the user reacts with fear, the warning message will be changed to a calmer tone and provide more detailed countermeasures.

[0501] Phishing website detection and user emotion recognition processing

[0502] Step 1:

[0503] The user enters the URL of the website they are trying to visit into the terminal. For example, the URL might be "http: / / secure-login.example.com."

[0504] Step 2:

[0505] The device sends the entered URL to the phishing detector.

[0506] Step 3:

[0507] The phishing detector analyzes the submitted URL, checking its structure and whether it contains any suspicious keywords (e.g. "login", "verify", "secure").

[0508] Step 4:

[0509] Based on the results of URL analysis, the phishing detector uses a generative AI model to perform further detailed URL analysis, and uses the classify method of the generative AI model to determine whether the URL corresponds to a phishing site.

[0510] Step 5:

[0511] If the device receives the phishing detection results and determines the site to be suspicious, it will display a warning to the user saying, "Warning: This website looks suspicious."

[0512] Step 6:

[0513] When the device issues a warning, it uses an emotion engine to detect the user's reaction. The emotion engine analyzes the user's facial expressions, voice, and text input to recognize the user's emotional reaction to the warning.

[0514] Step 7:

[0515] After the emotion engine recognizes the user's emotions, the device will adjust the alerts and notification methods based on the results. For example, if the user expresses fear or doubt, the device will provide a response method according to that emotion.

[0516] Through these processing steps, users are protected in real time from suspicious emails and phishing sites, and can receive more appropriate warnings and responses through the emotion engine.

[0517] Example 2

[0518] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0519] While conventional phishing detection systems have the ability to detect suspicious emails and phishing websites, they have a problem in that they are unable to provide flexible warnings and notifications that reflect the user's emotions. In particular, when users are frightened or confused by the warning, they often do not take appropriate action. Another problem is that they are slow to learn and apply new phishing patterns.

[0520] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing a warning to a user when the suspicious emails and phishing websites are detected, and means for adjusting the warning content and notification method using an emotion engine that recognizes the user's emotions. This enables flexible and appropriate warnings and notifications that correspond to the user's emotions.

[0521] A "generative AI model" is an artificial intelligence algorithm trained to detect phishing emails and suspicious websites.

[0522] A "prompt" is an instruction entered into a generative AI model to make it perform a specific task.

[0523] "Suspicious email" refers to emails intended to phish or spread malware, with the intent to deceive users and steal their personal information.

[0524] A "phishing website" is a webpage that masquerades as a legitimate website and is intended to fraudulently obtain users' personal information.

[0525] "Warning measures" are mechanisms that notify users when they encounter suspicious emails or phishing websites.

[0526] The "emotion engine" is a technology that recognizes and analyzes the user's emotions, enabling appropriate measures and notifications to be taken based on the user's reaction.

[0527] This invention combines a system that uses generative AI models to detect suspicious emails and phishing websites in real time and warns users, with an emotion engine that recognizes user emotions. This system protects users from suspicious emails and websites in real time and enables appropriate responses based on their emotions.

[0528] System Configuration

[0529] server

[0530] The server loads and initializes the generative AI model. This model learns the characteristics of phishing and fraudulent content and identifies and classifies them in real time. For example, we use OpenAI's GPT-3 model. The server also periodically learns new phishing patterns and processes data to update the model, allowing it to respond to the latest threats.

[0531] Terminal

[0532] The device is responsible for analyzing the content of emails received by the user and the URLs of websites the user attempts to access. The device provides the analysis data to the generative AI model, and after receiving the results, displays appropriate warnings to the user. Furthermore, the device uses an emotion engine to recognize the user's emotions in real time and adjust the content of the warning and notification method.

[0533] When a user receives an email

[0534] When a user receives an email, the device provides the email content to the generative AI model. For example, it sends the following prompt:

[0535] "Analyze the following email content and determine if it is a phishing email: 'Urgent: Your account has been compromised, click here to verify your login details.'"

[0536] The generative AI model checks the email body for suspicious keywords (e.g., "free," "urgent," "click here," "login") and then evaluates the overall content. The device receives the analysis results, and if it determines the email is suspicious, it displays a warning to the user saying, "Warning: This email looks suspicious."

[0537] Recognizing user emotions

[0538] The emotion engine analyzes the user's facial expressions, voice, and text input to recognize emotions. Specifically, it uses a webcam and microphone to capture data in real time and determine the user's emotional reaction to the warning. Based on this, the device can adjust the content of the warning message and notification method.

[0539] When a user visits a website

[0540] When a user wants to visit a website, they enter its URL into their device, for example "http: / / secure-login.example.com", which the device sends to a generative AI model for analysis, using a prompt like this:

[0541] "Analyze the following URL and determine if it is a phishing website: 'http: / / secure-login.example.com'"

[0542] The generative AI model analyzes the URL and evaluates suspicious keywords, URL structure, etc. If the device determines it is a phishing site, it displays a warning to the user saying, "Warning: This website looks suspicious."

[0543] As described above, by combining a generative AI model with an emotion engine, the present invention detects suspicious emails and phishing websites in real time and provides users with appropriate warnings and emotional responses.

[0544] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0545] Step 1:

[0546] The server initializes the generative AI model. In this step, the model is loaded with pre-trained features of phishing and fraudulent content, and made ready for use. Specifically, the server loads the libraries and data required for the generative AI model and performs initial settings to run the model. The inputs include pre-prepared model files and configuration scripts. The output is an initialized generative AI model.

[0547] Step 2:

[0548] A user receives an email. In this step, the user's mail client receives the new email and displays it. Specifically, it downloads the new email from the mail server and adds it to the user's inbox. The input is the new email sent from the mail server. The output is the new email displayed in the inbox.

[0549] Step 3:

[0550] The terminal provides the content of the email received to the generative AI model. Specifically, it extracts the body of the received email for analysis and creates a prompt to send to the generative AI model. The input is the content of the email received by the user. For example, the following prompt is sent to the generative AI model:

[0551] "Analyze the following email content and determine if it is a phishing email: 'Urgent: Your account has been compromised, click here to verify your login details.'"

[0552] The output is a prompt sentence for analysis, which is sent to the generative AI model.

[0553] Step 4:

[0554] The generative AI model analyzes the email using the is_phishing_email method. Specifically, the generative AI model checks for suspicious keywords (e.g., "free", "urgent", "click here", "login") in the email body and evaluates the overall content. The input is the prompt provided in step 3. The output is a judgment result on whether the email is phishing.

[0555] Step 5:

[0556] The device receives the analysis results and displays a warning to the user if the email is deemed suspicious. Specifically, it receives the analysis results from the generative AI model, generates a warning message, and displays it to the user. The input is the analysis results provided by the generative AI model. The output is the warning message "Warning: This email looks suspicious." that is displayed to the user.

[0557] Step 6:

[0558] The emotion engine analyzes the user's emotional response. Specifically, it captures the user's facial expressions and voice in real time using a webcam and microphone connected to the device, and analyzes this data to recognize emotions. The input is the user's facial expression and voice data. The output is the user's emotional data (e.g., surprise, anxiety).

[0559] Step 7:

[0560] The device adjusts the warning content and notification method based on the emotional data provided by the emotion engine. Specifically, if the user expresses surprise or anxiety, the tone of the warning message is changed to a calmer one and specific countermeasures are provided. The input is the user's emotional data recognized by the emotion engine. The output is a revised warning message.

[0561] Step 8:

[0562] When a user visits a website, they enter the URL into their device. Specifically, they enter the URL into the address bar of their browser. The input is the URL the user is trying to access (e.g., "http: / / secure-login.example.com"). The output is the URL information the user entered, which is provided to the device.

[0563] Step 9:

[0564] The device sends the URL to the generated AI model, which analyzes it using the is_phishing_website method. Specifically, it checks the URL structure and keywords it contains to evaluate whether it is a phishing website. The input is a URL provided by the user. For example, use the following prompt:

[0565] "Analyze the following URL and determine if it is a phishing website: 'http: / / secure-login.example.com'"

[0566] The output is a determination of whether the URL is a phishing site.

[0567] Step 10:

[0568] The device receives the judgment result and displays a warning to the user if the site is deemed suspicious. The input is the analysis result provided by the generative AI model. The output is the warning message displayed to the user: "Warning: This website looks suspicious."

[0569] The above are the specific processing steps of this system.

[0570] (Application example 2)

[0571] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0572] In recent years, cyber attacks using suspicious emails and phishing websites have been increasing, and many users have fallen victim to them. These attacks are evolving daily, with new patterns and techniques constantly emerging, making traditional methods often insufficient to deal with. Furthermore, rather than simply issuing a warning, it is necessary to encourage appropriate responses while taking into consideration the user's emotions. Therefore, there is a need for a system that can detect suspicious content in real time and issue warnings based on the user's emotions.

[0573] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing a warning to the user when the suspicious emails and phishing websites are detected, and means for analyzing the user's reaction using an emotion engine that recognizes the user's emotions and adjusting the warning content and notification method. This makes it possible to protect users from suspicious emails and phishing websites and to issue appropriate warnings and responses according to the user's emotions.

[0574] A "generative AI model" is a type of artificial intelligence, a technology that has the ability to generate new data based on large amounts of data.

[0575] "Suspicious email" refers to email sent with malicious purposes, such as phishing or spam, that may cause harm to users.

[0576] A "phishing website" is a malicious website designed to steal users' personal or confidential information; it looks like a legitimate website but is actually a disguised version.

[0577] "Means of issuing a warning to users" refers to the means of informing users of the existence of suspicious emails or phishing websites, and can be various methods such as audio, visual, or text.

[0578] An "emotion engine" is a technology for recognizing a user's emotions, and determines the user's emotional state based on data such as facial expressions, voice, and text.

[0579] "Regularly learning and updating new phishing patterns" means that the generative AI model continuously learns about newly discovered phishing techniques and patterns and automatically updates its knowledge.

[0580] "Analysis based on specific keywords, URL structures, and image patterns" is a detection method that uses keywords, URL structures, and image patterns to identify the characteristics of suspicious emails and phishing websites.

[0581] System configuration

[0582] This invention combines a system that uses generative AI models to detect suspicious emails and phishing websites in real time and warns users, with an emotion engine that recognizes user emotions. The system has three main components: a server, a device, and a user.

[0583] Program implementation example

[0584] Detailed Description

[0585] 1. Initializing and training the generative AI model

[0586] The server keeps email and website data up to date by regularly learning and updating new phishing patterns using generative AI models, such as OpenAI's GPT model.

[0587] 2. Email Analysis

[0588] When a user receives an email, the device sends the email content to the server, where the generative AI model analyzes it to determine whether it is suspicious. For example, if the email content is something like "Urgent: Your account has been compromised, click here to verify your login details," the server will have the generative AI model analyze the email. This analysis checks for specific keywords and phrases (e.g., "free," "urgent," "click here," "login"), and the AI ​​evaluates the content.

[0589] 3. User Warning

[0590] If the server determines the email is suspicious, the device will display a warning to the user saying, "Warning: This email looks suspicious."

[0591] 4. Emotion Recognition by Emotion Engine

[0592] An emotion engine is also used at this time. The emotion engine recognizes emotions from the user's facial expressions, voice, text input, etc. For example, it analyzes the user's reactions in real time using a camera or microphone. This analysis is performed using emotion analysis libraries such as Affectiva and Google Cloud Natural Language.

[0593] 5. Adjust warning messages based on emotions

[0594] After the emotion engine recognizes the user's emotions, the device will adjust the warning message and notification method based on that reaction. For example, if the user expresses emotions such as "surprise" or "anxiety," the device will adjust the warning message to something like "Warning: This email contains suspicious content. Please remain calm and check how to deal with it."

[0595] 6. Website Analytics

[0596] Similarly, if a user enters a URL, the device sends it to the server, and the generative AI model analyzes the website. An example of a suspicious URL would be "http: / / secure-login.example.com." If the URL is deemed suspicious, the device will display a warning saying, "Warning: This website looks suspicious."

[0597] Specific examples

[0598] Prompt Sentence Examples

[0599] An example of a prompt to input to a generative AI model is as follows:

[0600] Check if this email is a phishing attempt: Urgent: Your account has been compromised, click here to verify your login details.

[0601] This prompt is sent to a generative AI model to determine whether the email is phishing.

[0602] These processes not only protect users from suspicious emails and phishing websites in real time, but also allow them to receive more appropriate warnings and responses through the emotion engine, which has a significant effect on keeping users safe.

[0603] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0604] Step 1: User receives email

[0605] The user receives an email on their device. The device then provides the content of the received email to the program. Specifically, the program extracts the email body, subject, sender information, etc. This content becomes the input data for subsequent analysis.

[0606] Step 2: Email analysis with a generative AI model

[0607] The device sends the extracted email content to the server. The server inputs the email content into the generative AI model and analyzes whether the email is phishing. At this time, the generative AI model is given the following prompt as input:

[0608] "Check if this email is a phishing attempt: Urgent: Your account has been compromised, click here to verify your login details."

[0609] The server receives the output of the generative AI model and determines whether the email is phishing.

[0610] Step 3: Display a warning message to the user

[0611] The server sends the analysis results back to the device. If the device determines that the email is phishing, it displays a warning message to the user saying, "Warning: This email looks suspicious." The warning message is displayed to alert the user to the danger before they take action.

[0612] Step 4: Emotion Recognition with the Emotion Engine

[0613] When a warning message is displayed, the device captures the user's reaction. Specifically, it takes a picture of the user's facial expression with a camera and records the user's voice with a microphone. The emotion engine recognizes the user's emotions based on this data. For example, if the user shows a surprised expression, that emotional data is input into the emotion engine.

[0614] Step 5: Tailor warning messages according to emotions

[0615] The emotion engine analyzes the user's emotional data and sends the results back to the device. The device then adjusts the warning message based on the analysis results. For example, if the emotion engine detects "surprise" or "anxiety," the device will adjust the warning message to something like "Warning: This email contains suspicious content. Please remain calm and check how to deal with it."

[0616] Step 6: User visits your website

[0617] When a user tries to visit a website by entering a URL, the device sends the URL to the server. For example, the user enters the URL "http: / / secure-login.example.com." This URL becomes the input data for analysis.

[0618] Step 7: Analyze the website with a generative AI model

[0619] The server inputs the received URL into the generative AI model to analyze whether the website is a phishing site. The generative AI model analyzes specific keywords, URL structure, and image patterns to determine whether it is a phishing site. The analysis results are then sent from the server to the device.

[0620] Step 8: Display a warning message for visiting the website

[0621] Based on the analysis results, the device will display a warning message to the user saying, "Warning: This website looks suspicious." The message is displayed to inform the user of the dangers of visiting the website.

[0622] Step 9: Emotion recognition again by the emotion engine

[0623] When a website visit warning message appears, the device will again use the emotion engine to capture the user's reaction and recognize their emotion. For example, if the user shows a look of fear, that data will be input into the emotion engine.

[0624] Step 10: Recalibrate your warning messages based on emotions

[0625] Based on the analysis results of the emotion engine, the device will then adjust the warning message accordingly. For example, if emotions such as "fear" or "suspiciousness" are detected, the warning message will be changed to "Warning: This website is highly suspicious. Do not visit."

[0626] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0627] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0628] In the above embodiment, an example in which the specific processing is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the smart glasses 214.

[0629] [Third embodiment]

[0630] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[0631] 5, the data processing system 310 includes the data processing device 12 and a headset type terminal 314. An example of the data processing device 12 is a server.

[0632] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0633] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[0634] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0635] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0636] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0637] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0638] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0639] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0640] In the headset type terminal 314, a reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0641] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the headset type terminal 314 will be referred to as the "terminal."

[0642] The present invention is a system that utilizes generative AI models to detect suspicious emails and phishing websites in real time and alert users.

[0643] The server initializes the generative AI model, which periodically learns and updates new phishing patterns. The generative AI model learns the characteristics of phishing and fraudulent content and uses them to identify and classify suspicious emails and websites in real time.

[0644] When a user receives an email, the device provides the email content to the program. The device then sends the provided email content to the generative AI model, which analyzes it using the is_phishing_email method. This method uses regular expressions to search for suspicious keywords (e.g., "free," "urgent," "click here," "login"), and then evaluates the content using the generative AI model. If the email is determined to be suspicious, the device will issue a warning to the user saying, "Warning: This email looks suspicious."

[0645] When a user attempts to visit a website, the device provides the URL to the program. The device then sends the URL to the generative AI model, where it is analyzed using the is_phishing_website method. This method checks whether the URL contains suspicious keywords (e.g., "login," "verify," "secure") and whether the URL structure and patterns match the characteristics of a phishing site. The generative AI model then evaluates the URL, and if it is determined to be a suspicious site, the device issues a warning to the user saying, "Warning: This website looks suspicious."

[0646] The generative AI model continuously learns new phishing patterns, allowing it to stay current with the latest security threats. It also performs highly accurate analysis based on specific keywords, URL structures, and image patterns.

[0647] Specific examples are shown below.

[0648] Example 1: If a user receives an email with the content "Urgent: Your account has been compromised, click here to verify your login details," the device will send the email content to the generative AI model for analysis. Based on the analysis results, the email is deemed suspicious, and the device will display a warning saying "Warning: This email looks suspicious."

[0649] Example 2: If the URL the user is trying to visit is "http: / / secure-login.example.com," the device will send the URL to the AI ​​model for analysis. Based on the analysis results, the model determines that the URL is likely to be a phishing site, and will display a warning saying, "Warning: This website looks suspicious."

[0650] In this way, by using generative AI models, users can be protected from suspicious emails and websites and use the Internet safely.

[0651] The processing flow will be explained below.

[0652] Suspicious email detection process

[0653] Step 1:

[0654] The server initializes the generative AI model, which creates an instance of the generative AI model and prepares it to learn the characteristics of phishing and fraudulent content.

[0655] Step 2:

[0656] The server initializes the phishing detector with the generative AI model, which then performs real-time analysis of emails and websites.

[0657] Step 3:

[0658] The server updates the training data for the generated AI model, allowing the AI ​​model to learn new phishing patterns and respond to the latest threats.

[0659] Step 4:

[0660] A user opens the email they received and types the contents into their terminal. For example, the email may say, "Urgent: Your account has been compromised, click here to verify your login details."

[0661] Step 5:

[0662] The device sends the entered email content to the phishing detector.

[0663] Step 6:

[0664] The phishing detector analyzes the content of the email sent. First, it checks the content of the email using regular expressions to see if it contains predetermined suspicious keywords (e.g., "free," "urgent," "click here," "login").

[0665] Step 7:

[0666] Based on the results of the keyword check, the phishing detector uses a generative AI model to perform a more detailed content analysis, and then uses the classify method of the generative AI model to determine whether the email content is phishing.

[0667] Step 8:

[0668] If the device receives the phishing detection results and determines that the email is suspicious, it will display a warning to the user saying, "Warning: This email looks suspicious."

[0669] Phishing website detection process

[0670] Step 1:

[0671] The user enters the URL of the website they are trying to visit into the terminal. For example, the URL might be "http: / / secure-login.example.com."

[0672] Step 2:

[0673] The device sends the entered URL to the phishing detector.

[0674] Step 3:

[0675] The phishing detector analyzes the submitted URL, checking its structure and whether it contains any suspicious keywords (e.g. "login", "verify", "secure").

[0676] Step 4:

[0677] Based on the results of URL analysis, the phishing detector uses a generative AI model to perform further detailed URL analysis, and uses the classify method of the generative AI model to determine whether the URL corresponds to a phishing site.

[0678] Step 5:

[0679] If the device receives the phishing detection results and determines the site to be suspicious, it will display a warning to the user saying, "Warning: This website looks suspicious."

[0680] Through the above processing steps, users are protected in real time from suspicious emails and phishing sites, allowing them to use the Internet safely.

[0681] Example 1

[0682] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0683] With the spread of the Internet, the number of phishing scams and suspicious emails is increasing, increasing the risk of users being exposed to these threats. To address this issue, a system that can detect suspicious emails and phishing websites in real time and issue warnings to users is needed. However, conventional methods have difficulty responding to new phishing patterns, and regular expressions and simple keyword detection in particular have limitations. There is a need to develop a system that utilizes generative AI models to effectively detect threats in real time.

[0684] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0685] In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing a warning to a user when the suspicious emails and phishing websites are detected, means for initializing the generative AI model and performing periodic learning and updating for analyzing suspicious emails and phishing websites, means for detecting suspicious keywords and URL structures using regular expressions, and means for obtaining the analysis results via the user's terminal and displaying a warning. This makes it possible to detect suspicious emails and phishing websites with high accuracy in real time and protect users from these threats.

[0686] A "generative AI model" is an algorithm or system that uses artificial intelligence technology to learn patterns and features from data and then generate and analyze them.

[0687] "Suspicious email" refers to email that is likely to be malicious, such as phishing or spam, and is an electronic message sent to deceive users and steal their personal information.

[0688] A "phishing website" is a malicious web page that masquerades as a legitimate website and is designed to trick users into entering personal or authentication information.

[0689] "Real-time analysis" refers to processing and analyzing data instantly and providing the results immediately.

[0690] "Issuing a warning" means that the system displays a message to the user to warn them or notify them of a danger.

[0691] A "regular expression" is a notation used to specify text patterns and to manipulate and search strings, and is used to efficiently search for specific strings or patterns.

[0692] A "URL structure" is the shape and format of a string of characters used to point to resources on the Internet.

[0693] "Obtaining analysis results" refers to obtaining the conclusions and judgments generated after the system analyzes the data.

[0694] "Initializing" means setting a system or model to a state before it starts operating and loading the necessary data and parameters.

[0695] "Periodic learning and updating" is the process of incorporating new data at regular intervals to maintain or improve the performance and accuracy of a model.

[0696] This invention is a system that uses generative AI models to detect suspicious emails and phishing websites in real time and issue warnings to users. This system is mainly composed of three elements: a server, a terminal, and a user.

[0697] Server configuration and operation

[0698] The server runs on Google Cloud Platform or other cloud infrastructure and is responsible for initializing and running the generative AI model. Specifically, the server builds and operates the AI ​​model using TensorFlow and Hugging Face's Transformers library. The server periodically collects the latest phishing email and phishing site data and updates the generative AI model based on that data.

[0699] Terminal configuration and operation

[0700] The user's device (e.g., a PC or smartphone) is responsible for sending emails and website URLs to the server for analysis, providing an interface for accessing the generative AI model, and issuing warnings to the user based on the analysis results.

[0701] The specific software used by the device includes a program that uses regular expressions in Python's re library to search for suspicious keywords, and an API client for calling the generative AI model.

[0702] User operations

[0703] When a user receives an email, the content of the email is sent by the device to the generative AI model. Similarly, when a user attempts to visit a website, the URL is sent by the device to the generative AI model.

[0704] Analysis and Warning Flow

[0705] The analysis uses the is_phishing_email and is_phishing_website methods. These methods detect suspicious keywords and URL structures and evaluate the overall content using a generative AI model. If the analysis results indicate that the email or website is suspicious, the device will warn the user with the message "Warning: This email looks suspicious" or "Warning: This website looks suspicious."

[0706] Specific examples

[0707] Example 1: If a user receives an email with the content "Urgent: Your account has been compromised, click here to verify your login details," the device sends the email content to the generative AI model for analysis. This email contains suspicious keywords such as "Urgent," "click here," and "verify," so the is_phishing_email method uses regular expressions to detect these keywords, and the generative AI model determines the email to be suspicious. As a result, the device displays a warning to the user saying, "Warning: This email looks suspicious."

[0708] Example 2: If the URL a user is trying to visit is "http: / / secure-login.example.com," the device sends the URL to the generated AI model for analysis. This URL contains suspicious keywords such as "secure" and "login," so the is_phishing_website method uses regular expressions to detect these keywords, and the generated AI model determines that the URL is suspicious. As a result, the device displays a warning to the user: "Warning: This website looks suspicious."

[0709] This system protects users from suspicious emails and websites, allowing them to use the Internet safely.

[0710] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0711] Step 1:

[0712] The server initializes the generative AI model. During this initialization process, the server retrieves the latest dataset of phishing emails and phishing sites and trains the generative AI model based on this. The model is built using TensorFlow on Google Cloud Platform and the Hugging Face Transformers library. It receives the dataset as input and obtains a trained generative AI model as output.

[0713] What it does: The server downloads the dataset, runs the process of training the model using the TensorFlow library, and saves the trained model after completion.

[0714] Step 2:

[0715] The user receives an email. At this point, the user's device retrieves the email content and prepares it for sending to the generative AI model. The received email is taken as input and converted into a data format for sending as output to the generative AI model.

[0716] Specific operation: The contents of the received email are obtained via API and the necessary data (e.g., email body, subject, sender information, etc.) is extracted.

[0717] Step 3:

[0718] The device sends preprocessed emails to the server to be sent to the generative AI model. At this time, the is_phishing_email method is used to analyze suspicious keywords and patterns. The preprocessed email data is received as input, and the analysis result indicating the likelihood of the email being suspicious is obtained as output.

[0719] Specific operation: Search for suspicious keywords using Python's re library, execute the process of sending the data to the generative AI model, receive the analysis results, and evaluate their reliability.

[0720] Step 4:

[0721] The terminal displays a warning to the user based on the analysis results. If the email is judged to be suspicious, it will warn the user with "Warning: This email looks suspicious." It receives the analysis results as input and displays a warning message to the user as output.

[0722] What it does: Displays a warning message to the user as a popup or notification banner. Uses the email client interface to visually indicate the warning.

[0723] Step 5:

[0724] When a user attempts to visit a website, the device retrieves the URL and prepares it for sending to the generative AI model. It takes the URL being visited as input and converts it into a data format to send to the generative AI model as output.

[0725] Specific operation: Uses a browser extension to catch the URL and extract the necessary data (e.g., the entire URL, domain information, etc.).

[0726] Step 6:

[0727] The device sends the preprocessed URL to the server to be sent to the generative AI model. At this time, the is_phishing_website method is used to analyze suspicious keywords and structures. The preprocessed URL data is received as input, and the analysis result indicating the possibility of the website being suspicious is obtained as output.

[0728] Specific operation: Search for suspicious keywords using Python's re library, execute the process of sending the data to the generative AI model, receive the analysis results, and evaluate their reliability.

[0729] Step 7:

[0730] The device displays a warning to the user based on the analysis results. If the URL is determined to be suspicious, it will warn the user with "Warning: This website looks suspicious." It receives the analysis results as input and displays a warning message to the user as output.

[0731] What it does: Displays a warning message to the user as a popup or notification banner. Uses the browser interface to visually indicate the warning.

[0732] Through the above processing steps, users can be effectively protected from suspicious emails and phishing websites.

[0733] (Application example 1)

[0734] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0735] In recent years, phishing attacks and fraudulent emails have been increasing, making it difficult for users to take appropriate measures against them. In particular, phishing websites and emails have become more sophisticated, making it difficult to detect them using conventional security measures, hindering safe Internet use. In addition, new phishing patterns are constantly emerging, requiring technology to respond quickly to these attacks.

[0736] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0737] In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing an alert to a communication device when the suspicious emails and phishing websites are detected, and means for controlling the generative AI model and detecting suspicious content using application software. This allows users to quickly respond to the latest phishing patterns, is protected from suspicious emails and websites, and enables safe Internet use.

[0738] A "generative AI model" is a model trained using machine learning techniques that has the ability to detect and classify suspicious emails and phishing websites.

[0739] "Suspicious email" refers to email containing suspicious content sent with the intent of phishing or unauthorized access.

[0740] A "phishing website" is a website that is disguised with the intent of fraudulently obtaining users' personal information and authentication information.

[0741] "Real-time analysis measures" are mechanisms for instantly evaluating the content of emails and websites to detect suspicious elements.

[0742] The "means for issuing a warning to a communication device" has the function of notifying the user of information about detected suspicious emails or websites and displaying a warning.

[0743] "Application software" refers to programs installed on smartphones and other devices that detect suspicious content and respond based on the analysis results.

[0744] This invention is a system that uses a generative AI model to detect suspicious emails and phishing websites in real time and issue a warning to the user. Specifically, a server manages the generative AI model, and the device provides email and website URLs, which are then forwarded to the generative AI model for analysis. Based on the analysis results, the device issues a warning if suspicious content is detected.

[0745] The server initializes the generative AI model using the transformers library provided by Hugging Face. The generative AI model periodically learns and updates new phishing patterns. This model continues to learn suspicious features, allowing it to adapt to the latest security threats.

[0746] The device is primarily a smartphone, and the program works in conjunction with an email client and a browser extension.

[0747] For example:

[0748] 1. Suspicious email analysis:

[0749] If a user receives an email with the message "Urgent: Your account has been compromised, click here to verify your login details," the device forwards the email content to the generative AI model.

[0750] The generative AI model analyzes email content to detect suspicious keywords and patterns, in this case keywords like "urgent" and "click here" that are identified as risk factors.

[0751] After analysis, the email is determined to be highly likely to be phishing, so the device displays a warning to the user saying, "Warning: This email looks suspicious."

[0752] 2. Phishing website analysis:

[0753] When a user attempts to access the URL "http: / / secure-login.example.com", the device forwards the URL to the generative AI model.

[0754] The generative AI model analyzes the structure of the URL and the keywords it contains, in this case keywords like "secure" and "login" that match the characteristics of a phishing site.

[0755] After analysis, the URL is determined to be a likely phishing site, so the device displays a warning to the user saying, "Warning: This website looks suspicious."

[0756] Example prompts to input to a generative AI model:

[0757] For email content: Classify this email content: Urgent: Your account has been compromised, click here to verify your login details.

[0758] For a URL: Is this a phishing website? URL: http: / / secure-login.example.com

[0759] This protects users from suspicious emails and websites, allowing them to use the Internet safely.

[0760] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0761] Step 1:

[0762] When a user receives an email or accesses a website, the device acquires the content of the received email or the URL of the website the user is trying to access. This input data is the email body or URL.

[0763] Step 2:

[0764] The device provides the retrieved email content or URL to the generative AI model, which process includes the device communicating with the generative AI model and forwarding the email content or URL for analysis.

[0765] Step 3:

[0766] The generative AI model on the server analyzes the provided email content and URLs. This analysis includes keyword detection using regular expressions and an overall evaluation by the AI ​​model. For example, the regular expressions are used to search for whether the email content contains keywords such as "urgent" or "click here," and then the generative AI model evaluates the content. Similarly, in the case of URLs, the URL structure and keywords (e.g., "secure," "login") are analyzed. The output of this step is an evaluation result of whether the email or URL is suspicious.

[0767] Step 4:

[0768] Based on the analysis results of the generative AI model, the device generates a warning message for suspicious emails and websites, such as "Warning: This email looks suspicious" or "Warning: This website looks suspicious."

[0769] Step 5:

[0770] The device will then display the generated warning message to the user via a pop-up notification or alert dialog, protecting the user from phishing attacks and unauthorized access.

[0771] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[0772] The present invention combines a system that uses generative AI models to detect suspicious emails and phishing websites in real time and alert users to them, with an emotion engine that recognizes user emotions.

[0773] The server initializes the generative AI model, learning the characteristics of phishing and fraudulent content so that it can identify and classify them in real time. The generative AI model is constantly updated to learn new phishing patterns, ensuring it can always keep up with the latest threats.

[0774] When a user receives an email, the device provides the email content to the program. If the email content is something like "Urgent: Your account has been compromised, click here to verify your login details," the device sends the email to the generative AI model for analysis. The generative AI model analyzes the email body using the is_phishing_email method. This method checks whether the email contains suspicious keywords (e.g., "free," "urgent," "click here," "login") and then evaluates the content using the model.

[0775] After the device receives the phishing detection result, if the email is deemed suspicious, it displays a warning to the user saying, "Warning: This email looks suspicious." At this time, the emotion engine also detects the user's reaction.

[0776] When a user receives a warning, the emotion engine analyzes the user's facial expressions, voice, text input, etc. to recognize their emotions. The emotion engine obtains this data in real time and recognizes the emotional reaction the user had to the warning.

[0777] After the emotion engine recognizes the user's emotions, the device will adjust the warning content and notification method based on the results. For example, if the user reacts with fear, the warning message will be changed to a calmer tone and provide more detailed countermeasures.

[0778] When a user attempts to visit a website, they enter the URL into their device. For example, if the URL is "http: / / secure-login.example.com," the device sends this information to the generative AI model for analysis. The generative AI model evaluates the URL using the is_phishing_website method, checking for suspicious keywords (e.g., "login," "verify," "secure") and the URL structure, and determines that it is a phishing site.

[0779] After the device receives the phishing detection results, if the site is deemed suspicious, it will display a warning to the user saying, "Warning: This website looks suspicious." In this case, the emotion engine will also analyze the user's reaction and adjust the notification method to encourage appropriate action.

[0780] As a concrete example, the system details the process when a user provides email content and when a user provides a URL. In the case of email, if the system detects that the email is suspicious and detects that the user's reaction is "surprise" or "anxiety," it adjusts the warning message accordingly. Similarly, in the case of URLs, if the system detects that the site is suspicious and detects that the user's reaction is "fear" or "suspicious," it provides a response method appropriate to that emotion.

[0781] Through the above process, users are protected in real time from suspicious emails and phishing sites, and can receive more appropriate warnings and responses through the emotion engine.

[0782] The processing flow will be explained below.

[0783] Suspicious email detection and user emotion recognition processing

[0784] Step 1:

[0785] The server initializes the generative AI model, which creates an instance of the generative AI model and prepares it to learn the characteristics of phishing and fraudulent content.

[0786] Step 2:

[0787] The server initializes the phishing detector with the generative AI model, which then performs real-time analysis of emails and websites.

[0788] Step 3:

[0789] The server updates the training data for the generated AI model, allowing the AI ​​model to learn new phishing patterns and respond to the latest threats.

[0790] Step 4:

[0791] A user opens the email they received and types the contents into their terminal. For example, the email may say, "Urgent: Your account has been compromised, click here to verify your login details."

[0792] Step 5:

[0793] The device sends the entered email content to the phishing detector.

[0794] Step 6:

[0795] The phishing detector analyzes the content of the email sent. First, it checks the content of the email using regular expressions to see if it contains predetermined suspicious keywords (e.g., "free," "urgent," "click here," "login").

[0796] Step 7:

[0797] Based on the results of the keyword check, the phishing detector uses a generative AI model to perform a more detailed content analysis, and then uses the classify method of the generative AI model to determine whether the email content is phishing.

[0798] Step 8:

[0799] If the device receives the phishing detection results and determines that the email is suspicious, it will display a warning to the user saying, "Warning: This email looks suspicious."

[0800] Step 9:

[0801] When the device issues a warning, it uses an emotion engine to detect the user's reaction. The emotion engine analyzes the user's facial expressions, voice, and text input to recognize the user's emotional reaction to the warning.

[0802] Step 10:

[0803] After the emotion engine recognizes the user's emotions, the device will adjust the warning content and notification method based on the results. For example, if the user reacts with fear, the warning message will be changed to a calmer tone and provide more detailed countermeasures.

[0804] Phishing website detection and user emotion recognition processing

[0805] Step 1:

[0806] The user enters the URL of the website they are trying to visit into the terminal. For example, the URL might be "http: / / secure-login.example.com."

[0807] Step 2:

[0808] The device sends the entered URL to the phishing detector.

[0809] Step 3:

[0810] The phishing detector analyzes the submitted URL, checking its structure and whether it contains any suspicious keywords (e.g. "login", "verify", "secure").

[0811] Step 4:

[0812] Based on the results of URL analysis, the phishing detector uses a generative AI model to perform further detailed URL analysis, and uses the classify method of the generative AI model to determine whether the URL corresponds to a phishing site.

[0813] Step 5:

[0814] If the device receives the phishing detection results and determines the site to be suspicious, it will display a warning to the user saying, "Warning: This website looks suspicious."

[0815] Step 6:

[0816] When the device issues a warning, it uses an emotion engine to detect the user's reaction. The emotion engine analyzes the user's facial expressions, voice, and text input to recognize the user's emotional reaction to the warning.

[0817] Step 7:

[0818] After the emotion engine recognizes the user's emotions, the device will adjust the alerts and notification methods based on the results. For example, if the user expresses fear or doubt, the device will provide a response method according to that emotion.

[0819] Through these processing steps, users are protected in real time from suspicious emails and phishing sites, and can receive more appropriate warnings and responses through the emotion engine.

[0820] Example 2

[0821] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0822] While conventional phishing detection systems have the ability to detect suspicious emails and phishing websites, they have a problem in that they are unable to provide flexible warnings and notifications that reflect the user's emotions. In particular, when users are frightened or confused by the warning, they often do not take appropriate action. Another problem is that they are slow to learn and apply new phishing patterns.

[0823] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing a warning to a user when the suspicious emails and phishing websites are detected, and means for adjusting the warning content and notification method using an emotion engine that recognizes the user's emotions. This enables flexible and appropriate warnings and notifications that correspond to the user's emotions.

[0824] A "generative AI model" is an artificial intelligence algorithm trained to detect phishing emails and suspicious websites.

[0825] A "prompt" is an instruction entered into a generative AI model to make it perform a specific task.

[0826] "Suspicious email" refers to emails intended to phish or spread malware, with the intent to deceive users and steal their personal information.

[0827] A "phishing website" is a webpage that masquerades as a legitimate website and is intended to fraudulently obtain users' personal information.

[0828] "Warning measures" are mechanisms that notify users when they encounter suspicious emails or phishing websites.

[0829] The "emotion engine" is a technology that recognizes and analyzes the user's emotions, enabling appropriate measures and notifications to be taken based on the user's reaction.

[0830] This invention combines a system that uses generative AI models to detect suspicious emails and phishing websites in real time and warns users, with an emotion engine that recognizes user emotions. This system protects users from suspicious emails and websites in real time and enables appropriate responses based on their emotions.

[0831] System Configuration

[0832] server

[0833] The server loads and initializes the generative AI model. This model learns the characteristics of phishing and fraudulent content and identifies and classifies them in real time. For example, we use OpenAI's GPT-3 model. The server also periodically learns new phishing patterns and processes data to update the model, allowing it to respond to the latest threats.

[0834] Terminal

[0835] The device is responsible for analyzing the content of emails received by the user and the URLs of websites the user attempts to access. The device provides the analysis data to the generative AI model, and after receiving the results, displays appropriate warnings to the user. Furthermore, the device uses an emotion engine to recognize the user's emotions in real time and adjust the content of the warning and notification method.

[0836] When a user receives an email

[0837] When a user receives an email, the device provides the email content to the generative AI model. For example, it sends the following prompt:

[0838] "Analyze the following email content and determine if it is a phishing email: 'Urgent: Your account has been compromised, click here to verify your login details.'"

[0839] The generative AI model checks the email body for suspicious keywords (e.g., "free," "urgent," "click here," "login") and then evaluates the overall content. The device receives the analysis results, and if it determines the email is suspicious, it displays a warning to the user saying, "Warning: This email looks suspicious."

[0840] Recognizing user emotions

[0841] The emotion engine analyzes the user's facial expressions, voice, and text input to recognize emotions. Specifically, it uses a webcam and microphone to capture data in real time and determine the user's emotional reaction to the warning. Based on this, the device can adjust the content of the warning message and notification method.

[0842] When a user visits a website

[0843] When a user wants to visit a website, they enter its URL into their device, for example "http: / / secure-login.example.com", which the device sends to a generative AI model for analysis, using a prompt like this:

[0844] "Analyze the following URL and determine if it is a phishing website: 'http: / / secure-login.example.com'"

[0845] The generative AI model analyzes the URL and evaluates suspicious keywords, URL structure, etc. If the device determines it is a phishing site, it displays a warning to the user saying, "Warning: This website looks suspicious."

[0846] As described above, by combining a generative AI model with an emotion engine, the present invention detects suspicious emails and phishing websites in real time and provides users with appropriate warnings and emotional responses.

[0847] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0848] Step 1:

[0849] The server initializes the generative AI model. In this step, the model is loaded with pre-trained features of phishing and fraudulent content, and made ready for use. Specifically, the server loads the libraries and data required for the generative AI model and performs initial settings to run the model. The inputs include pre-prepared model files and configuration scripts. The output is an initialized generative AI model.

[0850] Step 2:

[0851] A user receives an email. In this step, the user's mail client receives the new email and displays it. Specifically, it downloads the new email from the mail server and adds it to the user's inbox. The input is the new email sent from the mail server. The output is the new email displayed in the inbox.

[0852] Step 3:

[0853] The terminal provides the content of the email received to the generative AI model. Specifically, it extracts the body of the received email for analysis and creates a prompt to send to the generative AI model. The input is the content of the email received by the user. For example, the following prompt is sent to the generative AI model:

[0854] "Analyze the following email content and determine if it is a phishing email: 'Urgent: Your account has been compromised, click here to verify your login details.'"

[0855] The output is a prompt sentence for analysis, which is sent to the generative AI model.

[0856] Step 4:

[0857] The generative AI model analyzes the email using the is_phishing_email method. Specifically, the generative AI model checks for suspicious keywords (e.g., "free", "urgent", "click here", "login") in the email body and evaluates the overall content. The input is the prompt provided in step 3. The output is a judgment result on whether the email is phishing.

[0858] Step 5:

[0859] The device receives the analysis results and displays a warning to the user if the email is deemed suspicious. Specifically, it receives the analysis results from the generative AI model, generates a warning message, and displays it to the user. The input is the analysis results provided by the generative AI model. The output is the warning message "Warning: This email looks suspicious." that is displayed to the user.

[0860] Step 6:

[0861] The emotion engine analyzes the user's emotional response. Specifically, it captures the user's facial expressions and voice in real time using a webcam and microphone connected to the device, and analyzes this data to recognize emotions. The input is the user's facial expression and voice data. The output is the user's emotional data (e.g., surprise, anxiety).

[0862] Step 7:

[0863] The device adjusts the warning content and notification method based on the emotional data provided by the emotion engine. Specifically, if the user expresses surprise or anxiety, the tone of the warning message is changed to a calmer one and specific countermeasures are provided. The input is the user's emotional data recognized by the emotion engine. The output is a revised warning message.

[0864] Step 8:

[0865] When a user visits a website, they enter the URL into their device. Specifically, they enter the URL into the address bar of their browser. The input is the URL the user is trying to access (e.g., "http: / / secure-login.example.com"). The output is the URL information the user entered, which is provided to the device.

[0866] Step 9:

[0867] The device sends the URL to the generated AI model, which analyzes it using the is_phishing_website method. Specifically, it checks the URL structure and keywords it contains to evaluate whether it is a phishing website. The input is a URL provided by the user. For example, use the following prompt:

[0868] "Analyze the following URL and determine if it is a phishing website: 'http: / / secure-login.example.com'"

[0869] The output is a determination of whether the URL is a phishing site.

[0870] Step 10:

[0871] The device receives the judgment result and displays a warning to the user if the site is deemed suspicious. The input is the analysis result provided by the generative AI model. The output is the warning message displayed to the user: "Warning: This website looks suspicious."

[0872] The above are the specific processing steps of this system.

[0873] (Application example 2)

[0874] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0875] In recent years, cyber attacks using suspicious emails and phishing websites have been increasing, and many users have fallen victim to them. These attacks are evolving daily, with new patterns and techniques constantly emerging, making traditional methods often insufficient to deal with. Furthermore, rather than simply issuing a warning, it is necessary to encourage appropriate responses while taking into consideration the user's emotions. Therefore, there is a need for a system that can detect suspicious content in real time and issue warnings based on the user's emotions.

[0876] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing a warning to the user when the suspicious emails and phishing websites are detected, and means for analyzing the user's reaction using an emotion engine that recognizes the user's emotions and adjusting the warning content and notification method. This makes it possible to protect users from suspicious emails and phishing websites and to issue appropriate warnings and responses according to the user's emotions.

[0877] A "generative AI model" is a type of artificial intelligence, a technology that has the ability to generate new data based on large amounts of data.

[0878] "Suspicious email" refers to email sent with malicious purposes, such as phishing or spam, that may cause harm to users.

[0879] A "phishing website" is a malicious website designed to steal users' personal or confidential information; it looks like a legitimate website but is actually a disguised version.

[0880] "Means of issuing a warning to users" refers to the means of informing users of the existence of suspicious emails or phishing websites, and can be various methods such as audio, visual, or text.

[0881] An "emotion engine" is a technology for recognizing a user's emotions, and determines the user's emotional state based on data such as facial expressions, voice, and text.

[0882] "Regularly learning and updating new phishing patterns" means that the generative AI model continuously learns about newly discovered phishing techniques and patterns and automatically updates its knowledge.

[0883] "Analysis based on specific keywords, URL structures, and image patterns" is a detection method that uses keywords, URL structures, and image patterns to identify the characteristics of suspicious emails and phishing websites.

[0884] System configuration

[0885] This invention combines a system that uses generative AI models to detect suspicious emails and phishing websites in real time and warns users, with an emotion engine that recognizes user emotions. The system has three main components: a server, a device, and a user.

[0886] Program implementation example

[0887] Detailed Description

[0888] 1. Initializing and training the generative AI model

[0889] The server keeps email and website data up to date by regularly learning and updating new phishing patterns using generative AI models, such as OpenAI's GPT model.

[0890] 2. Email Analysis

[0891] When a user receives an email, the device sends the email content to the server, where the generative AI model analyzes it to determine whether it is suspicious. For example, if the email content is something like "Urgent: Your account has been compromised, click here to verify your login details," the server will have the generative AI model analyze the email. This analysis checks for specific keywords and phrases (e.g., "free," "urgent," "click here," "login"), and the AI ​​evaluates the content.

[0892] 3. User Warning

[0893] If the server determines the email is suspicious, the device will display a warning to the user saying, "Warning: This email looks suspicious."

[0894] 4. Emotion Recognition by Emotion Engine

[0895] An emotion engine is also used at this time. The emotion engine recognizes emotions from the user's facial expressions, voice, text input, etc. For example, it analyzes the user's reactions in real time using a camera or microphone. This analysis is performed using emotion analysis libraries such as Affectiva and Google Cloud Natural Language.

[0896] 5. Adjust warning messages based on emotions

[0897] After the emotion engine recognizes the user's emotions, the device will adjust the warning message and notification method based on that reaction. For example, if the user expresses emotions such as "surprise" or "anxiety," the device will adjust the warning message to something like "Warning: This email contains suspicious content. Please remain calm and check how to deal with it."

[0898] 6. Website Analytics

[0899] Similarly, if a user enters a URL, the device sends it to the server, and the generative AI model analyzes the website. An example of a suspicious URL would be "http: / / secure-login.example.com." If the URL is deemed suspicious, the device will display a warning saying, "Warning: This website looks suspicious."

[0900] Specific examples

[0901] Prompt Sentence Examples

[0902] An example of a prompt to input to a generative AI model is as follows:

[0903] Check if this email is a phishing attempt: Urgent: Your account has been compromised, click here to verify your login details.

[0904] This prompt is sent to a generative AI model to determine whether the email is phishing.

[0905] These processes not only protect users from suspicious emails and phishing websites in real time, but also allow them to receive more appropriate warnings and responses through the emotion engine, which has a significant effect on keeping users safe.

[0906] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0907] Step 1: User receives email

[0908] The user receives an email on their device. The device then provides the content of the received email to the program. Specifically, the program extracts the email body, subject, sender information, etc. This content becomes the input data for subsequent analysis.

[0909] Step 2: Email analysis with a generative AI model

[0910] The device sends the extracted email content to the server. The server inputs the email content into the generative AI model and analyzes whether the email is phishing. At this time, the generative AI model is given the following prompt as input:

[0911] "Check if this email is a phishing attempt: Urgent: Your account has been compromised, click here to verify your login details."

[0912] The server receives the output of the generative AI model and determines whether the email is phishing.

[0913] Step 3: Display a warning message to the user

[0914] The server sends the analysis results back to the device. If the device determines that the email is phishing, it displays a warning message to the user saying, "Warning: This email looks suspicious." The warning message is displayed to alert the user to the danger before they take action.

[0915] Step 4: Emotion Recognition with the Emotion Engine

[0916] When a warning message is displayed, the device captures the user's reaction. Specifically, it takes a picture of the user's facial expression with a camera and records the user's voice with a microphone. The emotion engine recognizes the user's emotions based on this data. For example, if the user shows a surprised expression, that emotional data is input into the emotion engine.

[0917] Step 5: Tailor warning messages according to emotions

[0918] The emotion engine analyzes the user's emotional data and sends the results back to the device. The device then adjusts the warning message based on the analysis results. For example, if the emotion engine detects "surprise" or "anxiety," the device will adjust the warning message to something like "Warning: This email contains suspicious content. Please remain calm and check how to deal with it."

[0919] Step 6: User visits your website

[0920] When a user tries to visit a website by entering a URL, the device sends the URL to the server. For example, the user enters the URL "http: / / secure-login.example.com." This URL becomes the input data for analysis.

[0921] Step 7: Analyze the website with a generative AI model

[0922] The server inputs the received URL into the generative AI model to analyze whether the website is a phishing site. The generative AI model analyzes specific keywords, URL structure, and image patterns to determine whether it is a phishing site. The analysis results are then sent from the server to the device.

[0923] Step 8: Display a warning message for visiting the website

[0924] Based on the analysis results, the device will display a warning message to the user saying, "Warning: This website looks suspicious." The message is displayed to inform the user of the dangers of visiting the website.

[0925] Step 9: Emotion recognition again by the emotion engine

[0926] When a website visit warning message appears, the device will again use the emotion engine to capture the user's reaction and recognize their emotion. For example, if the user shows a look of fear, that data will be input into the emotion engine.

[0927] Step 10: Recalibrate your warning messages based on emotions

[0928] Based on the analysis results of the emotion engine, the device will then adjust the warning message accordingly. For example, if emotions such as "fear" or "suspiciousness" are detected, the warning message will be changed to "Warning: This website is highly suspicious. Do not visit."

[0929] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0930] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0931] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the headset type terminal 314.

[0932] [Fourth embodiment]

[0933] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[0934] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0935] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0936] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[0937] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0938] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0939] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0940] The control object 443 includes a display device, LEDs in the eyes, and motors for driving the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[0941] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0942] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0943] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0944] In the robot 414, the processor 46 performs the reception output process. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0945] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[0946] The present invention is a system that utilizes generative AI models to detect suspicious emails and phishing websites in real time and alert users.

[0947] The server initializes the generative AI model, which periodically learns and updates new phishing patterns. The generative AI model learns the characteristics of phishing and fraudulent content and uses them to identify and classify suspicious emails and websites in real time.

[0948] When a user receives an email, the device provides the email content to the program. The device then sends the provided email content to the generative AI model, which analyzes it using the is_phishing_email method. This method uses regular expressions to search for suspicious keywords (e.g., "free," "urgent," "click here," "login"), and then evaluates the content using the generative AI model. If the email is determined to be suspicious, the device will issue a warning to the user saying, "Warning: This email looks suspicious."

[0949] When a user attempts to visit a website, the device provides the URL to the program. The device then sends the URL to the generative AI model, where it is analyzed using the is_phishing_website method. This method checks whether the URL contains suspicious keywords (e.g., "login," "verify," "secure") and whether the URL structure and patterns match the characteristics of a phishing site. The generative AI model then evaluates the URL, and if it is determined to be a suspicious site, the device issues a warning to the user saying, "Warning: This website looks suspicious."

[0950] The generative AI model continuously learns new phishing patterns, allowing it to stay current with the latest security threats. It also performs highly accurate analysis based on specific keywords, URL structures, and image patterns.

[0951] Specific examples are shown below.

[0952] Example 1: If a user receives an email with the content "Urgent: Your account has been compromised, click here to verify your login details," the device will send the email content to the generative AI model for analysis. Based on the analysis results, the email is deemed suspicious, and the device will display a warning saying "Warning: This email looks suspicious."

[0953] Example 2: If the URL the user is trying to visit is "http: / / secure-login.example.com," the device will send the URL to the AI ​​model for analysis. Based on the analysis results, the model determines that the URL is likely to be a phishing site, and will display a warning saying, "Warning: This website looks suspicious."

[0954] In this way, by using generative AI models, users can be protected from suspicious emails and websites and use the Internet safely.

[0955] The processing flow will be explained below.

[0956] Suspicious email detection process

[0957] Step 1:

[0958] The server initializes the generative AI model, which creates an instance of the generative AI model and prepares it to learn the characteristics of phishing and fraudulent content.

[0959] Step 2:

[0960] The server initializes the phishing detector with the generative AI model, which then uses the generative AI model to analyze emails and websites in real time.

[0961] Step 3:

[0962] The server updates the training data for the generated AI model, allowing the AI ​​model to learn new phishing patterns and respond to the latest threats.

[0963] Step 4:

[0964] A user opens the email they received and types the contents into their terminal. For example, the email may say, "Urgent: Your account has been compromised, click here to verify your login details."

[0965] Step 5:

[0966] The device sends the entered email content to the phishing detector.

[0967] Step 6:

[0968] The phishing detector analyzes the content of the email sent. First, it checks the content of the email using regular expressions to see if it contains predetermined suspicious keywords (e.g., "free," "urgent," "click here," "login").

[0969] Step 7:

[0970] Based on the results of the keyword check, the phishing detector uses a generative AI model to perform a more detailed content analysis, and then uses the classify method of the generative AI model to determine whether the email content is phishing.

[0971] Step 8:

[0972] If the device receives the phishing detection results and determines that the email is suspicious, it will display a warning to the user saying, "Warning: This email looks suspicious."

[0973] Phishing website detection process

[0974] Step 1:

[0975] The user enters the URL of the website they are trying to visit into the terminal. For example, the URL might be "http: / / secure-login.example.com."

[0976] Step 2:

[0977] The device sends the entered URL to the phishing detector.

[0978] Step 3:

[0979] The phishing detector analyzes the submitted URL, checking its structure and whether it contains any suspicious keywords (e.g. "login", "verify", "secure").

[0980] Step 4:

[0981] Based on the results of URL analysis, the phishing detector uses a generative AI model to perform further detailed URL analysis, and uses the classify method of the generative AI model to determine whether the URL corresponds to a phishing site.

[0982] Step 5:

[0983] If the device receives the phishing detection results and determines the site to be suspicious, it will display a warning to the user saying, "Warning: This website looks suspicious."

[0984] Through the above processing steps, users are protected in real time from suspicious emails and phishing sites, allowing them to use the Internet safely.

[0985] Example 1

[0986] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[0987] With the spread of the Internet, the number of phishing scams and suspicious emails is increasing, increasing the risk of users being exposed to these threats. To address this issue, a system that can detect suspicious emails and phishing websites in real time and issue warnings to users is needed. However, conventional methods have difficulty responding to new phishing patterns, and regular expressions and simple keyword detection in particular have limitations. There is a need to develop a system that utilizes generative AI models to effectively detect threats in real time.

[0988] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0989] In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing a warning to a user when the suspicious emails and phishing websites are detected, means for initializing the generative AI model and performing periodic learning and updating for analyzing suspicious emails and phishing websites, means for detecting suspicious keywords and URL structures using regular expressions, and means for obtaining the analysis results via the user's terminal and displaying a warning. This makes it possible to detect suspicious emails and phishing websites with high accuracy in real time and protect users from these threats.

[0990] A "generative AI model" is an algorithm or system that uses artificial intelligence technology to learn patterns and features from data and then generate and analyze them.

[0991] "Suspicious email" refers to email that is likely to be malicious, such as phishing or spam, and is an electronic message sent to deceive users and steal their personal information.

[0992] A "phishing website" is a malicious web page that masquerades as a legitimate website and is designed to trick users into entering personal or authentication information.

[0993] "Real-time analysis" refers to processing and analyzing data instantly and providing the results immediately.

[0994] "Issuing a warning" means that the system displays a message to the user to warn them or notify them of a danger.

[0995] A "regular expression" is a notation used to specify text patterns and to manipulate and search strings, and is used to efficiently search for specific strings or patterns.

[0996] A "URL structure" is the shape and format of a string of characters used to point to resources on the Internet.

[0997] "Obtaining analysis results" refers to obtaining the conclusions and judgments generated after the system analyzes the data.

[0998] "Initializing" means setting a system or model to a state before it starts operating and loading the necessary data and parameters.

[0999] "Periodic learning and updating" is the process of incorporating new data at regular intervals to maintain or improve the performance and accuracy of a model.

[1000] This invention is a system that uses generative AI models to detect suspicious emails and phishing websites in real time and issue warnings to users. This system is mainly composed of three elements: a server, a terminal, and a user.

[1001] Server configuration and operation

[1002] The server runs on Google Cloud Platform or other cloud infrastructure and is responsible for initializing and running the generative AI model. Specifically, the server builds and operates the AI ​​model using TensorFlow and Hugging Face's Transformers library. The server periodically collects the latest phishing email and phishing site data and updates the generative AI model based on that data.

[1003] Terminal configuration and operation

[1004] The user's device (e.g., a PC or smartphone) is responsible for sending emails and website URLs to the server for analysis, providing an interface for accessing the generative AI model, and issuing warnings to the user based on the analysis results.

[1005] The specific software used by the device includes a program that uses regular expressions in Python's re library to search for suspicious keywords, and an API client for calling the generative AI model.

[1006] User operations

[1007] When a user receives an email, the content of the email is sent by the device to the generative AI model. Similarly, when a user attempts to visit a website, the URL is sent by the device to the generative AI model.

[1008] Analysis and Warning Flow

[1009] The analysis uses the is_phishing_email and is_phishing_website methods. These methods detect suspicious keywords and URL structures and evaluate the overall content using a generative AI model. If the analysis results indicate that the email or website is suspicious, the device will warn the user with the message "Warning: This email looks suspicious" or "Warning: This website looks suspicious."

[1010] Specific examples

[1011] Example 1: If a user receives an email with the content "Urgent: Your account has been compromised, click here to verify your login details," the device sends the email content to the generative AI model for analysis. This email contains suspicious keywords such as "Urgent," "click here," and "verify," so the is_phishing_email method uses regular expressions to detect these keywords, and the generative AI model determines the email to be suspicious. As a result, the device displays a warning to the user saying, "Warning: This email looks suspicious."

[1012] Example 2: If the URL a user is trying to visit is "http: / / secure-login.example.com," the device sends the URL to the generated AI model for analysis. This URL contains suspicious keywords such as "secure" and "login," so the is_phishing_website method uses regular expressions to detect these keywords, and the generated AI model determines that the URL is suspicious. As a result, the device displays a warning to the user: "Warning: This website looks suspicious."

[1013] This system protects users from suspicious emails and websites, allowing them to use the Internet safely.

[1014] The flow of the identification process in the first embodiment will be described with reference to FIG.

[1015] Step 1:

[1016] The server initializes the generative AI model. During this initialization process, the server retrieves the latest dataset of phishing emails and phishing sites and trains the generative AI model based on this. The model is built using TensorFlow on Google Cloud Platform and the Hugging Face Transformers library. It receives the dataset as input and obtains a trained generative AI model as output.

[1017] What it does: The server downloads the dataset, runs the process of training the model using the TensorFlow library, and saves the trained model after completion.

[1018] Step 2:

[1019] The user receives an email. At this point, the user's device retrieves the email content and prepares it for sending to the generative AI model. The received email is taken as input and converted into a data format for sending as output to the generative AI model.

[1020] Specific operation: The contents of the received email are obtained via API and the necessary data (e.g., email body, subject, sender information, etc.) is extracted.

[1021] Step 3:

[1022] The device sends preprocessed emails to the server to be sent to the generative AI model. At this time, the is_phishing_email method is used to analyze suspicious keywords and patterns. The preprocessed email data is received as input, and the analysis result indicating the likelihood of the email being suspicious is obtained as output.

[1023] Specific operation: Search for suspicious keywords using Python's re library, execute the process of sending the data to the generative AI model, receive the analysis results, and evaluate their reliability.

[1024] Step 4:

[1025] The terminal displays a warning to the user based on the analysis results. If the email is judged to be suspicious, it will warn the user with "Warning: This email looks suspicious." It receives the analysis results as input and displays a warning message to the user as output.

[1026] What it does: Displays a warning message to the user as a popup or notification banner. Uses the email client interface to visually indicate the warning.

[1027] Step 5:

[1028] When a user attempts to visit a website, the device retrieves the URL and prepares it for sending to the generative AI model. It takes the URL being visited as input and converts it into a data format to send to the generative AI model as output.

[1029] Specific operation: Uses a browser extension to catch the URL and extract the necessary data (e.g., the entire URL, domain information, etc.).

[1030] Step 6:

[1031] The device sends the preprocessed URL to the server to be sent to the generative AI model. At this time, the is_phishing_website method is used to analyze suspicious keywords and structures. The preprocessed URL data is received as input, and the analysis result indicating the possibility of the website being suspicious is obtained as output.

[1032] Specific operation: Search for suspicious keywords using Python's re library, execute the process of sending the data to the generative AI model, receive the analysis results, and evaluate their reliability.

[1033] Step 7:

[1034] The device displays a warning to the user based on the analysis results. If the URL is determined to be suspicious, it will warn the user with "Warning: This website looks suspicious." It receives the analysis results as input and displays a warning message to the user as output.

[1035] What it does: Displays a warning message to the user as a popup or notification banner. Uses the browser interface to visually indicate the warning.

[1036] Through the above processing steps, users can be effectively protected from suspicious emails and phishing websites.

[1037] (Application example 1)

[1038] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1039] In recent years, phishing attacks and fraudulent emails have been increasing, making it difficult for users to take appropriate measures against them. In particular, phishing websites and emails have become more sophisticated, making it difficult to detect them using conventional security measures, hindering safe Internet use. In addition, new phishing patterns are constantly emerging, requiring technology to respond quickly to these attacks.

[1040] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[1041] In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing an alert to a communication device when the suspicious emails and phishing websites are detected, and means for controlling the generative AI model and detecting suspicious content using application software. This allows users to quickly respond to the latest phishing patterns, is protected from suspicious emails and websites, and enables safe Internet use.

[1042] A "generative AI model" is a model trained using machine learning techniques that has the ability to detect and classify suspicious emails and phishing websites.

[1043] "Suspicious email" refers to email containing suspicious content sent with the intent of phishing or unauthorized access.

[1044] A "phishing website" is a website that is disguised with the intent of fraudulently obtaining users' personal information and authentication information.

[1045] "Real-time analysis measures" are mechanisms for instantly evaluating the content of emails and websites to detect suspicious elements.

[1046] The "means for issuing a warning to a communication device" has the function of notifying the user of information about detected suspicious emails or websites and displaying a warning.

[1047] "Application software" refers to programs installed on smartphones and other devices that detect suspicious content and respond based on the analysis results.

[1048] This invention is a system that uses a generative AI model to detect suspicious emails and phishing websites in real time and issue a warning to the user. Specifically, a server manages the generative AI model, and the device provides email and website URLs, which are then forwarded to the generative AI model for analysis. Based on the analysis results, the device issues a warning if suspicious content is detected.

[1049] The server initializes the generative AI model using the transformers library provided by Hugging Face. The generative AI model periodically learns and updates new phishing patterns. This model continues to learn suspicious features, allowing it to adapt to the latest security threats.

[1050] The device is primarily a smartphone, and the program works in conjunction with an email client and a browser extension.

[1051] For example:

[1052] 1. Suspicious email analysis:

[1053] If a user receives an email with the message "Urgent: Your account has been compromised, click here to verify your login details," the device forwards the email content to the generative AI model.

[1054] The generative AI model analyzes email content to detect suspicious keywords and patterns, in this case keywords like "urgent" and "click here" that are identified as risk factors.

[1055] After analysis, the email is determined to be highly likely to be phishing, so the device displays a warning to the user saying, "Warning: This email looks suspicious."

[1056] 2. Phishing website analysis:

[1057] When a user attempts to access the URL "http: / / secure-login.example.com", the device forwards the URL to the generative AI model.

[1058] The generative AI model analyzes the structure of the URL and the keywords it contains, in this case keywords like "secure" and "login" that match the characteristics of a phishing site.

[1059] After analysis, the URL is determined to be a likely phishing site, so the device displays a warning to the user saying, "Warning: This website looks suspicious."

[1060] Example prompts to input to a generative AI model:

[1061] For email content: Classify this email content: Urgent: Your account has been compromised, click here to verify your login details.

[1062] For a URL: Is this a phishing website? URL: http: / / secure-login.example.com

[1063] This protects users from suspicious emails and websites, allowing them to use the Internet safely.

[1064] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[1065] Step 1:

[1066] When a user receives an email or accesses a website, the device acquires the content of the received email or the URL of the website the user is trying to access. This input data is the email body or URL.

[1067] Step 2:

[1068] The device provides the retrieved email content or URL to the generative AI model, which process includes the device communicating with the generative AI model and forwarding the email content or URL for analysis.

[1069] Step 3:

[1070] The generative AI model on the server analyzes the provided email content and URLs. This analysis includes keyword detection using regular expressions and an overall evaluation by the AI ​​model. For example, the regular expressions are used to search for whether the email content contains keywords such as "urgent" or "click here," and then the generative AI model evaluates the content. Similarly, in the case of URLs, the URL structure and keywords (e.g., "secure," "login") are analyzed. The output of this step is an evaluation result of whether the email or URL is suspicious.

[1071] Step 4:

[1072] Based on the analysis results of the generative AI model, the device generates a warning message for suspicious emails and websites, such as "Warning: This email looks suspicious" or "Warning: This website looks suspicious."

[1073] Step 5:

[1074] The device will then display the generated warning message to the user via a pop-up notification or alert dialog, protecting the user from phishing attacks and unauthorized access.

[1075] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[1076] The present invention combines a system that uses generative AI models to detect suspicious emails and phishing websites in real time and alert users to them, with an emotion engine that recognizes user emotions.

[1077] The server initializes the generative AI model, learning the characteristics of phishing and fraudulent content so that it can identify and classify them in real time. The generative AI model is constantly updated to learn new phishing patterns, ensuring it can always keep up with the latest threats.

[1078] When a user receives an email, the device provides the email content to the program. If the email content is something like "Urgent: Your account has been compromised, click here to verify your login details," the device sends the email to the generative AI model for analysis. The generative AI model analyzes the email body using the is_phishing_email method. This method checks whether the email contains suspicious keywords (e.g., "free," "urgent," "click here," "login") and then evaluates the content using the model.

[1079] After the device receives the phishing detection result, if the email is deemed suspicious, it displays a warning to the user saying, "Warning: This email looks suspicious." At this time, the emotion engine also detects the user's reaction.

[1080] When a user receives a warning, the emotion engine analyzes the user's facial expressions, voice, text input, etc. to recognize their emotions. The emotion engine obtains this data in real time and recognizes the emotional reaction the user had to the warning.

[1081] After the emotion engine recognizes the user's emotions, the device will adjust the warning content and notification method based on the results. For example, if the user reacts with fear, the warning message will be changed to a calmer tone and provide more detailed countermeasures.

[1082] When a user attempts to visit a website, they enter the URL into their device. For example, if the URL is "http: / / secure-login.example.com," the device sends this information to the generative AI model for analysis. The generative AI model evaluates the URL using the is_phishing_website method, checking for suspicious keywords (e.g., "login," "verify," "secure") and the URL structure, and determines that it is a phishing site.

[1083] After the device receives the phishing detection results, if the site is deemed suspicious, it will display a warning to the user saying, "Warning: This website looks suspicious." In this case, the emotion engine will also analyze the user's reaction and adjust the notification method to encourage appropriate action.

[1084] As a concrete example, the system details the process when a user provides email content and when a user provides a URL. In the case of email, if the system detects that the email is suspicious and detects that the user's reaction is "surprise" or "anxiety," it adjusts the warning message accordingly. Similarly, in the case of URLs, if the system detects that the site is suspicious and detects that the user's reaction is "fear" or "suspicious," it provides a response method appropriate to that emotion.

[1085] Through the above process, users are protected in real time from suspicious emails and phishing sites, and can receive more appropriate warnings and responses through the emotion engine.

[1086] The processing flow will be explained below.

[1087] Suspicious email detection and user emotion recognition processing

[1088] Step 1:

[1089] The server initializes the generative AI model, which creates an instance of the generative AI model and prepares it to learn the characteristics of phishing and fraudulent content.

[1090] Step 2:

[1091] The server initializes the phishing detector with the generative AI model, which then performs real-time analysis of emails and websites.

[1092] Step 3:

[1093] The server updates the training data for the generated AI model, allowing the AI ​​model to learn new phishing patterns and respond to the latest threats.

[1094] Step 4:

[1095] A user opens the email they received and types the contents into their terminal. For example, the email may say, "Urgent: Your account has been compromised, click here to verify your login details."

[1096] Step 5:

[1097] The device sends the entered email content to the phishing detector.

[1098] Step 6:

[1099] The phishing detector analyzes the content of the email sent. First, it checks the content of the email using regular expressions to see if it contains predetermined suspicious keywords (e.g., "free," "urgent," "click here," "login").

[1100] Step 7:

[1101] Based on the results of the keyword check, the phishing detector uses a generative AI model to perform a more detailed content analysis, and then uses the classify method of the generative AI model to determine whether the email content is phishing.

[1102] Step 8:

[1103] If the device receives the phishing detection results and determines that the email is suspicious, it will display a warning to the user saying, "Warning: This email looks suspicious."

[1104] Step 9:

[1105] When the device issues a warning, it uses an emotion engine to detect the user's reaction. The emotion engine analyzes the user's facial expressions, voice, and text input to recognize the user's emotional reaction to the warning.

[1106] Step 10:

[1107] After the emotion engine recognizes the user's emotions, the device will adjust the warning content and notification method based on the results. For example, if the user reacts with fear, the warning message will be changed to a calmer tone and provide more detailed countermeasures.

[1108] Phishing website detection and user emotion recognition processing

[1109] Step 1:

[1110] The user enters the URL of the website they are trying to visit into the terminal. For example, the URL might be "http: / / secure-login.example.com."

[1111] Step 2:

[1112] The device sends the entered URL to the phishing detector.

[1113] Step 3:

[1114] The phishing detector analyzes the submitted URL, checking its structure and whether it contains any suspicious keywords (e.g. "login", "verify", "secure").

[1115] Step 4:

[1116] Based on the results of URL analysis, the phishing detector uses a generative AI model to perform further detailed URL analysis, and uses the classify method of the generative AI model to determine whether the URL corresponds to a phishing site.

[1117] Step 5:

[1118] If the device receives the phishing detection results and determines the site to be suspicious, it will display a warning to the user saying, "Warning: This website looks suspicious."

[1119] Step 6:

[1120] When the device issues a warning, it uses an emotion engine to detect the user's reaction. The emotion engine analyzes the user's facial expressions, voice, and text input to recognize the user's emotional reaction to the warning.

[1121] Step 7:

[1122] After the emotion engine recognizes the user's emotions, the device will adjust the alerts and notification methods based on the results. For example, if the user expresses fear or doubt, the device will provide a response method according to that emotion.

[1123] Through these processing steps, users are protected in real time from suspicious emails and phishing sites, and can receive more appropriate warnings and responses through the emotion engine.

[1124] Example 2

[1125] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1126] While conventional phishing detection systems have the ability to detect suspicious emails and phishing websites, they have a problem in that they are unable to provide flexible warnings and notifications that reflect the user's emotions. In particular, when users are frightened or confused by the warning, they often do not take appropriate action. Another problem is that they are slow to learn and apply new phishing patterns.

[1127] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing a warning to a user when the suspicious emails and phishing websites are detected, and means for adjusting the warning content and notification method using an emotion engine that recognizes the user's emotions. This enables flexible and appropriate warnings and notifications that correspond to the user's emotions.

[1128] A "generative AI model" is an artificial intelligence algorithm trained to detect phishing emails and suspicious websites.

[1129] A "prompt" is an instruction entered into a generative AI model to make it perform a specific task.

[1130] "Suspicious email" refers to emails intended to phish or spread malware, with the intent to deceive users and steal their personal information.

[1131] A "phishing website" is a webpage that masquerades as a legitimate website and is intended to fraudulently obtain users' personal information.

[1132] "Warning measures" are mechanisms that notify users when they encounter suspicious emails or phishing websites.

[1133] The "emotion engine" is a technology that recognizes and analyzes the user's emotions, enabling appropriate measures and notifications to be taken based on the user's reaction.

[1134] This invention combines a system that uses generative AI models to detect suspicious emails and phishing websites in real time and warns users, with an emotion engine that recognizes user emotions. This system protects users from suspicious emails and websites in real time and enables appropriate responses based on their emotions.

[1135] System Configuration

[1136] server

[1137] The server loads and initializes the generative AI model. This model learns the characteristics of phishing and fraudulent content and identifies and classifies them in real time. For example, we use OpenAI's GPT-3 model. The server also periodically learns new phishing patterns and processes data to update the model, allowing it to respond to the latest threats.

[1138] Terminal

[1139] The device is responsible for analyzing the content of emails received by the user and the URLs of websites the user attempts to access. The device provides the analysis data to the generative AI model, and after receiving the results, displays appropriate warnings to the user. Furthermore, the device uses an emotion engine to recognize the user's emotions in real time and adjust the content of the warning and notification method.

[1140] When a user receives an email

[1141] When a user receives an email, the device provides the email content to the generative AI model. For example, it sends the following prompt:

[1142] "Analyze the following email content and determine if it is a phishing email: 'Urgent: Your account has been compromised, click here to verify your login details.'"

[1143] The generative AI model checks the email body for suspicious keywords (e.g., "free," "urgent," "click here," "login") and then evaluates the overall content. The device receives the analysis results, and if it determines the email is suspicious, it displays a warning to the user saying, "Warning: This email looks suspicious."

[1144] Recognizing user emotions

[1145] The emotion engine analyzes the user's facial expressions, voice, and text input to recognize emotions. Specifically, it uses a webcam and microphone to capture data in real time and determine the user's emotional reaction to the warning. Based on this, the device can adjust the content of the warning message and notification method.

[1146] When a user visits a website

[1147] When a user wants to visit a website, they enter its URL into their device, for example "http: / / secure-login.example.com", which the device sends to a generative AI model for analysis, using a prompt like this:

[1148] "Analyze the following URL and determine if it is a phishing website: 'http: / / secure-login.example.com'"

[1149] The generative AI model analyzes the URL and evaluates suspicious keywords, URL structure, etc. If the device determines it is a phishing site, it displays a warning to the user saying, "Warning: This website looks suspicious."

[1150] As described above, by combining a generative AI model with an emotion engine, the present invention detects suspicious emails and phishing websites in real time and provides users with appropriate warnings and emotional responses.

[1151] The flow of the identification process in the second embodiment will be described with reference to FIG.

[1152] Step 1:

[1153] The server initializes the generative AI model. In this step, the model is loaded with pre-trained features of phishing and fraudulent content, and made ready for use. Specifically, the server loads the libraries and data required for the generative AI model and performs initial settings to run the model. The inputs include pre-prepared model files and configuration scripts. The output is an initialized generative AI model.

[1154] Step 2:

[1155] A user receives an email. In this step, the user's mail client receives the new email and displays it. Specifically, it downloads the new email from the mail server and adds it to the user's inbox. The input is the new email sent from the mail server. The output is the new email displayed in the inbox.

[1156] Step 3:

[1157] The terminal provides the content of the email received to the generative AI model. Specifically, it extracts the body of the received email for analysis and creates a prompt to send to the generative AI model. The input is the content of the email received by the user. For example, the following prompt is sent to the generative AI model:

[1158] "Analyze the following email content and determine if it is a phishing email: 'Urgent: Your account has been compromised, click here to verify your login details.'"

[1159] The output is a prompt sentence for analysis, which is sent to the generative AI model.

[1160] Step 4:

[1161] The generative AI model analyzes the email using the is_phishing_email method. Specifically, the generative AI model checks for suspicious keywords (e.g., "free", "urgent", "click here", "login") in the email body and evaluates the overall content. The input is the prompt provided in step 3. The output is a judgment result on whether the email is phishing.

[1162] Step 5:

[1163] The device receives the analysis results and displays a warning to the user if the email is deemed suspicious. Specifically, it receives the analysis results from the generative AI model, generates a warning message, and displays it to the user. The input is the analysis results provided by the generative AI model. The output is the warning message "Warning: This email looks suspicious." that is displayed to the user.

[1164] Step 6:

[1165] The emotion engine analyzes the user's emotional response. Specifically, it captures the user's facial expressions and voice in real time using a webcam and microphone connected to the device, and analyzes this data to recognize emotions. The input is the user's facial expression and voice data. The output is the user's emotional data (e.g., surprise, anxiety).

[1166] Step 7:

[1167] The device adjusts the warning content and notification method based on the emotional data provided by the emotion engine. Specifically, if the user expresses surprise or anxiety, the tone of the warning message is changed to a calmer one and specific countermeasures are provided. The input is the user's emotional data recognized by the emotion engine. The output is a revised warning message.

[1168] Step 8:

[1169] When a user visits a website, they enter the URL into their device. Specifically, they enter the URL into the address bar of their browser. The input is the URL the user is trying to access (e.g., "http: / / secure-login.example.com"). The output is the URL information the user entered, which is provided to the device.

[1170] Step 9:

[1171] The device sends the URL to the generated AI model, which analyzes it using the is_phishing_website method. Specifically, it checks the URL structure and keywords it contains to evaluate whether it is a phishing website. The input is a URL provided by the user. For example, use the following prompt:

[1172] "Analyze the following URL and determine if it is a phishing website: 'http: / / secure-login.example.com'"

[1173] The output is a determination of whether the URL is a phishing site.

[1174] Step 10:

[1175] The device receives the judgment result and displays a warning to the user if the site is deemed suspicious. The input is the analysis result provided by the generative AI model. The output is the warning message displayed to the user: "Warning: This website looks suspicious."

[1176] The above are the specific processing steps of this system.

[1177] (Application example 2)

[1178] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1179] In recent years, cyber attacks using suspicious emails and phishing websites have been increasing, and many users have fallen victim to them. These attacks are evolving daily, with new patterns and techniques constantly emerging, making traditional methods often insufficient to deal with. Furthermore, rather than simply issuing a warning, it is necessary to encourage appropriate responses while taking into consideration the user's emotions. Therefore, there is a need for a system that can detect suspicious content in real time and issue warnings based on the user's emotions.

[1180] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for analyzing suspicious emails in real time using a generative AI model, means for analyzing phishing websites in real time using the generative AI model, means for issuing a warning to the user when the suspicious emails and phishing websites are detected, and means for analyzing the user's reaction using an emotion engine that recognizes the user's emotions and adjusting the warning content and notification method. This makes it possible to protect users from suspicious emails and phishing websites and to issue appropriate warnings and responses according to the user's emotions.

[1181] A "generative AI model" is a type of artificial intelligence, a technology that has the ability to generate new data based on large amounts of data.

[1182] "Suspicious email" refers to email sent with malicious purposes, such as phishing or spam, that may cause harm to users.

[1183] A "phishing website" is a malicious website designed to steal users' personal or confidential information; it looks like a legitimate website but is actually a disguised version.

[1184] "Means of issuing a warning to users" refers to the means of informing users of the existence of suspicious emails or phishing websites, and can be various methods such as audio, visual, or text.

[1185] An "emotion engine" is a technology for recognizing a user's emotions, and determines the user's emotional state based on data such as facial expressions, voice, and text.

[1186] "Regularly learning and updating new phishing patterns" means that the generative AI model continuously learns about newly discovered phishing techniques and patterns and automatically updates its knowledge.

[1187] "Analysis based on specific keywords, URL structures, and image patterns" is a detection method that uses keywords, URL structures, and image patterns to identify the characteristics of suspicious emails and phishing websites.

[1188] System configuration

[1189] This invention combines a system that uses generative AI models to detect suspicious emails and phishing websites in real time and warns users, with an emotion engine that recognizes user emotions. The system has three main components: a server, a device, and a user.

[1190] Program implementation example

[1191] Detailed Description

[1192] 1. Initializing and training the generative AI model

[1193] The server keeps email and website data up to date by regularly learning and updating new phishing patterns using generative AI models, such as OpenAI's GPT model.

[1194] 2. Email Analysis

[1195] When a user receives an email, the device sends the email content to the server, where the generative AI model analyzes it to determine whether it is suspicious. For example, if the email content is something like "Urgent: Your account has been compromised, click here to verify your login details," the server will have the generative AI model analyze the email. This analysis checks for specific keywords and phrases (e.g., "free," "urgent," "click here," "login"), and the AI ​​evaluates the content.

[1196] 3. User Warning

[1197] If the server determines the email is suspicious, the device will display a warning to the user saying, "Warning: This email looks suspicious."

[1198] 4. Emotion Recognition by Emotion Engine

[1199] An emotion engine is also used at this time. The emotion engine recognizes emotions from the user's facial expressions, voice, text input, etc. For example, it analyzes the user's reactions in real time using a camera or microphone. This analysis is performed using emotion analysis libraries such as Affectiva and Google Cloud Natural Language.

[1200] 5. Adjust warning messages based on emotions

[1201] After the emotion engine recognizes the user's emotions, the device will adjust the warning message and notification method based on that reaction. For example, if the user expresses emotions such as "surprise" or "anxiety," the device will adjust the warning message to something like "Warning: This email contains suspicious content. Please remain calm and check how to deal with it."

[1202] 6. Website Analytics

[1203] Similarly, if a user enters a URL, the device sends it to the server, and the generative AI model analyzes the website. An example of a suspicious URL would be "http: / / secure-login.example.com." If the URL is deemed suspicious, the device will display a warning saying, "Warning: This website looks suspicious."

[1204] Specific examples

[1205] Prompt Sentence Examples

[1206] An example of a prompt to input to a generative AI model is as follows:

[1207] Check if this email is a phishing attempt: Urgent: Your account has been compromised, click here to verify your login details.

[1208] This prompt is sent to a generative AI model to determine whether the email is phishing.

[1209] These processes not only protect users from suspicious emails and phishing websites in real time, but also allow them to receive more appropriate warnings and responses through the emotion engine, which has a significant effect on keeping users safe.

[1210] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[1211] Step 1: User receives email

[1212] The user receives an email on their device. The device then provides the content of the received email to the program. Specifically, the program extracts the email body, subject, sender information, etc. This content becomes the input data for subsequent analysis.

[1213] Step 2: Email analysis with a generative AI model

[1214] The device sends the extracted email content to the server. The server inputs the email content into the generative AI model and analyzes whether the email is phishing. At this time, the generative AI model is given the following prompt as input:

[1215] "Check if this email is a phishing attempt: Urgent: Your account has been compromised, click here to verify your login details."

[1216] The server receives the output of the generative AI model and determines whether the email is phishing.

[1217] Step 3: Display a warning message to the user

[1218] The server sends the analysis results back to the device. If the device determines that the email is phishing, it displays a warning message to the user saying, "Warning: This email looks suspicious." The warning message is displayed to alert the user to the danger before they take action.

[1219] Step 4: Emotion Recognition with the Emotion Engine

[1220] When a warning message is displayed, the device captures the user's reaction. Specifically, it takes a picture of the user's facial expression with a camera and records the user's voice with a microphone. The emotion engine recognizes the user's emotions based on this data. For example, if the user shows a surprised expression, that emotional data is input into the emotion engine.

[1221] Step 5: Tailor warning messages according to emotions

[1222] The emotion engine analyzes the user's emotional data and sends the results back to the device. The device then adjusts the warning message based on the analysis results. For example, if the emotion engine detects "surprise" or "anxiety," the device will adjust the warning message to something like "Warning: This email contains suspicious content. Please remain calm and check how to deal with it."

[1223] Step 6: User visits your website

[1224] When a user tries to visit a website by entering a URL, the device sends the URL to the server. For example, the user enters the URL "http: / / secure-login.example.com." This URL becomes the input data for analysis.

[1225] Step 7: Analyze the website with a generative AI model

[1226] The server inputs the received URL into the generative AI model to analyze whether the website is a phishing site. The generative AI model analyzes specific keywords, URL structure, and image patterns to determine whether it is a phishing site. The analysis results are then sent from the server to the device.

[1227] Step 8: Display a warning message for visiting the website

[1228] Based on the analysis results, the device will display a warning message to the user saying, "Warning: This website looks suspicious." The message is displayed to inform the user of the dangers of visiting the website.

[1229] Step 9: Emotion recognition again by the emotion engine

[1230] When a website visit warning message appears, the device will again use the emotion engine to capture the user's reaction and recognize their emotion. For example, if the user shows a look of fear, that data will be input into the emotion engine.

[1231] Step 10: Recalibrate your warning messages based on emotions

[1232] Based on the analysis results of the emotion engine, the device will then adjust the warning message accordingly. For example, if emotions such as "fear" or "suspiciousness" are detected, the warning message will be changed to "Warning: This website is highly suspicious. Do not visit."

[1233] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[1234] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1235] In the above embodiment, an example in which the specific processing is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the robot 414.

[1236] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[1237] FIG. 9 illustrates an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and behaviors arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion includes both affect and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[1238] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[1239] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[1240] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. Emotions can also be created for robots, automobiles, and motorcycles, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on Voice Emotion Recognition and Emotional Brain Physiological Signal Analysis Systems, Tokushima University, Doctoral Dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the "reaction" domain, where sensation is dominant. The right half of the emotion map lists emotions belonging to the "situation" domain, where situational awareness is dominant.

[1241] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[1242] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[1243] The system according to the present disclosure has been described above mainly with respect to the functions of the data processing device 12, but the system according to the present disclosure is not necessarily implemented on a server. The system according to the present disclosure may be implemented as a general information processing system. The present disclosure may be implemented, for example, as a software program running on a personal computer or an application running on a smartphone, etc. The method according to the present disclosure may be provided to users in the form of SaaS (Software as a Service).

[1244] In the above embodiment, an example was given in which the specific processing is performed by one computer 22, but the technology of the present disclosure is not limited to this, and the specific processing may be distributed and performed by a plurality of computers including the computer 22. For example, the data generation model 58 may be provided in an external device of the data processing device 12, and data may be generated in the external device in accordance with input data.

[1245] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[1246] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[1247] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[1248] The hardware resource for executing a specific process can be any of the following processors: An example of a processor is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. Another example of a processor is a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[1249] The hardware resource that executes the specific processing may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific processing may be a single processor.

[1250] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[1251] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[1252] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[1253] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[1254] The following is further disclosed regarding the above embodiment.

[1255] (Claim 1)

[1256] A means to analyze suspicious emails in real time using generative AI models; and

[1257] A means for analyzing phishing websites in real time using a generative AI model; and

[1258] means for alerting a user when said suspicious emails and phishing websites are detected;

[1259] A system including:

[1260] (Claim 2)

[1261] 10. The system of claim 1, wherein the generative AI model periodically learns and updates new phishing patterns.

[1262] (Claim 3)

[1263] 10. The system of claim 1, wherein the suspicious emails and phishing websites are analyzed based on specific keywords, URL structures, and image patterns.

[1264] "Example 1"

[1265] (Claim 1)

[1266] A means to analyze suspicious emails in real time using generative AI models; and

[1267] A means for analyzing phishing websites in real time using a generative AI model; and

[1268] means for alerting a user when said suspicious emails and phishing websites are detected;

[1269] means for initializing the generative AI model and periodically training and updating it for suspicious email analysis and phishing website analysis;

[1270] A method to detect suspicious keywords and URL structures using regular expressions,

[1271] A means of obtaining the analysis results through the user's device and displaying a warning;

[1272] A system including:

[1273] (Claim 2)

[1274] 10. The system of claim 1, wherein the generative AI model periodically learns and updates new phishing patterns.

[1275] (Claim 3)

[1276] 10. The system of claim 1, wherein the suspicious emails and phishing websites are analyzed based on specific keywords, URL structures, and image patterns.

[1277] "Application Example 1"

[1278] (Claim 1)

[1279] A means to analyze suspicious emails in real time using generative AI models; and

[1280] A means for analyzing phishing websites in real time using a generative AI model; and

[1281] means for issuing an alert to a communication device when the suspicious email and phishing website are detected;

[1282] means for controlling the generative AI model to detect suspicious content using application software;

[1283] A system including:

[1284] (Claim 2)

[1285] 10. The system of claim 1, wherein the generative AI model periodically learns and updates new phishing patterns.

[1286] (Claim 3)

[1287] 10. The system of claim 1, wherein the suspicious emails and phishing websites are analyzed based on specific keywords, URL structures, and image patterns.

[1288] "Example 2: Combining Emotion Engines"

[1289] (Claim 1)

[1290] A means to analyze suspicious emails in real time using generative AI models; and

[1291] A means for analyzing phishing websites in real time using a generative AI model; and

[1292] means for alerting a user when said suspicious emails and phishing websites are detected;

[1293] A means for adjusting the content of warnings and notification methods using an emotion engine that recognizes the user's emotions;

[1294] A system including:

[1295] (Claim 2)

[1296] 10. The system of claim 1, wherein the generative AI model periodically learns and updates new phishing patterns.

[1297] (Claim 3)

[1298] 10. The system of claim 1, wherein the suspicious emails and phishing websites are analyzed based on specific keywords, URL structures, and image patterns.

[1299] "Application example 2 when combining emotion engines"

[1300] (Claim 1)

[1301] A means to analyze suspicious emails in real time using generative AI models; and

[1302] A means for analyzing phishing websites in real time using a generative AI model; and

[1303] means for alerting a user when said suspicious emails and phishing websites are detected;

[1304] A means to analyze the user's reaction using an emotion engine that recognizes the user's emotions and adjust the content of the warning and notification method;

[1305] A system including:

[1306] (Claim 2)

[1307] 10. The system of claim 1, wherein the generative AI model periodically learns and updates new phishing patterns.

[1308] (Claim 3)

[1309] 10. The system of claim 1, wherein the suspicious emails and phishing websites are analyzed based on specific keywords, URL structures, and image patterns. [Explanation of symbols]

[1310] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot< / url:> < / url:> < / url:> < / url:>

Claims

1. A means to analyze suspicious emails in real time using generative AI models; and A means for analyzing phishing websites in real time using a generative AI model; and means for alerting a user when said suspicious emails and phishing websites are detected; A system including:

2. The system of claim 1 , wherein the generative AI model periodically learns and updates new phishing patterns.

3. The system of claim 1 , wherein the suspicious emails and phishing websites are analyzed based on specific keywords, URL structures, and image patterns.

Images