system

Abstract

Provide a system. [Solution] means for initializing the generative artificial intelligence model; means for generating random security incident scenarios using the generative artificial intelligence model; means for executing an attack on a training terminal based on the security incident scenario; means for collecting and analyzing responses and responses from said training terminals; a means for scoring and ranking the performance of training participants based on the analysis results; means for notifying training participants of said scoring and ranking; A system including:

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] In today's world, the risk of security incidents is increasing with the spread of remote work and the sophistication of information systems. Therefore, it is important for companies and organizations to conduct training to deal with actual security incidents. However, traditional training is often based on pre-set scenarios, which are predictable, making it difficult to recreate the tension and realism of an actual attack. Another issue is that low engagement among training participants prevents maximum learning effectiveness. [Means for solving the problem]

[0005] To solve the above-mentioned problems, the present invention provides a system that initializes a generative AI model and uses it to generate and provide random security incident scenarios in real time. Specifically, the system includes a means for initializing the generative AI model, a means for generating random security incident scenarios using the model, and a means for executing attacks on training terminals based on the generated scenarios. The system also includes a means for collecting and analyzing responses and reactions from the training terminals, a means for scoring and ranking training participants' performance based on the analysis results, and a means for notifying the training participants of the scores and rankings. Furthermore, the system features the introduction of game elements into the training environment to improve training participant engagement and maximize learning effectiveness.

[0006] A "generative artificial intelligence model" is an artificial intelligence algorithm that learns from multiple data sets and makes predictions and generates responses to specific tasks.

[0007] A "security incident scenario" is a scenario that mimics a specific situation involving an attack or unauthorized access to a computer system or network.

[0008] A "training terminal" is a computer terminal used to conduct security incident training and to respond to unpredictable attacks.

[0009] "Reaction and response" refers to the actions and measures taken by training participants in the event of a security incident, and are implemented to mitigate security risks.

[0010] "Analysis" refers to a data processing method for evaluating the effectiveness and performance of training participants based on collected data.

[0011] "Scoring" is a method for quantifying and evaluating the performance of training participants, and is calculated based on response speed and accuracy.

[0012] "Ranking" is an evaluation method that ranks multiple training participants based on the scoring results.

[0013] "Game elements" are elements that create a sense of competition or accomplishment and are introduced to increase motivation during training. [Brief explanation of the drawings]

[0014] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 11] FIG. 3 is a sequence diagram showing a processing flow of the data processing system according to the first embodiment. [Figure 12] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 1. [Figure 13]FIG. 10 is a sequence diagram showing the flow of processing in the data processing system according to the second embodiment when an emotion engine is combined. [Figure 14] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 2 when an emotion engine is combined. DETAILED DESCRIPTION OF THE INVENTION

[0015] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0016] First, the terms used in the following description will be explained.

[0017] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, a processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), and an APU (Accelerated Processing Unit).

[0018] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0019] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0020] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), Bluetooth (registered trademark), etc.

[0021] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0022] [First embodiment]

[0023] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0024] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0025] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0026] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0027] The reception device 38 includes a touch panel 38A, a microphone 38B, and the like, and receives user input. The touch panel 38A detects contact with an indicator (for example, a pen or a finger) to receive user input by the touch of the indicator. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0028] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form of expression that the user 20 can perceive (for example, audio and / or text). The display 40A displays visible information such as text and images in accordance with instructions from the processor 46. The speaker 40B outputs audio in accordance with instructions from the processor 46. The camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0029] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0030] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0031] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0032] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0033] In the smart device 14, the processor 46 performs the reception output process. The storage 50 stores a reception output program 60. The reception output program 60 is used in conjunction with the specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0034] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0035] The present invention relates to a system that uses a generative artificial intelligence model to generate random security incident scenarios in real time and execute attacks against training terminals. The system mainly consists of a server, a training terminal, and a user.

[0036] Server-side processing

[0037] The server first initializes a generative AI model. This model is an AI algorithm that learns from multiple data sets and makes predictions and generates responses to specific tasks. After initialization is complete, the server uses the model to generate random security incident scenarios. These scenarios simulate various types of attacks and unauthorized access to computer systems and networks, and provide specific situations in real time.

[0038] Based on the generated security incident scenario, the server executes attacks on the training terminals over the network. These attacks are random and unpredictable, creating a realistic sense of tension for the training participants.

[0039] After the attack is carried out, the server collects and analyzes the reactions and responses from the training devices. After the analysis, the server scores the participants' performance and generates a ranking. The generated scores and rankings are then notified to the participants, allowing them to evaluate their own response capabilities and identify areas for improvement.

[0040] User processing

[0041] The user starts training using the training terminal. Once the training starts, the server sends a scenario-based attack to the user, and the user must respond in real time. For example, if a ransomware attack scenario occurs, the user must stop any suspicious processes and run security software.

[0042] After completing the training, users receive feedback from the server and can check their performance, enabling them to acquire even higher security response capabilities. The incorporation of game elements also increases the engagement of participants and maximizes learning effectiveness.

[0043] Specific examples

[0044] As a concrete example, consider the case of a ransomware attack scenario. The server initializes the generative AI model and randomly selects "ransomware attack" to create a scenario. Based on this scenario, the server launches a virtual ransomware attack on a training device.

[0045] Users begin training on a training device and take appropriate action in response to a ransomware warning that suddenly appears. These actions include terminating suspicious processes and running security software. After completing the training, users check the feedback and ranking sent from the server to understand their own response capabilities.

[0046] In this way, the system of the present invention maximizes the realism of the training and the learning effect by providing unpredictable security incident scenarios in real time. In addition, the introduction of game elements can increase the engagement of training participants.

[0047] The processing flow will be explained below.

[0048] Step 1:

[0049] The server initializes the generative AI model. Specifically, it loads the pre-trained generative AI model into memory space and sets the necessary parameters (e.g., attack start time, attack frequency, etc.).

[0050] Step 2:

[0051] The server generates random security incident scenarios using a generative AI model. The server generates scenarios from the AI ​​model based on triggers and converts them into a format that the system can interpret.

[0052] Step 3:

[0053] The server executes attacks against the training terminals over the network based on the generated security scenario, and the attacks are initiated at the specified timing.

[0054] Step 4:

[0055] The terminal receives and displays an alert based on the attack scenario sent from the server. The alert triggers the terminal to prompt the user to take countermeasures.

[0056] Step 5:

[0057] The user can take appropriate countermeasures based on the alert displayed on the device, such as stopping suspicious processes or running security software.

[0058] Step 6:

[0059] The server collects response and response data from the training devices, including the time taken and success or failure of response actions.

[0060] Step 7:

[0061] The server analyzes the collected data and evaluates the training participants' performance, using a scoring algorithm to calculate a score based on the speed and accuracy of their responses.

[0062] Step 8:

[0063] The server generates scores and rankings for the participants based on the analysis results. The rankings are used to foster a sense of competition among the participants.

[0064] Step 9:

[0065] The server notifies the training participants of the generated scores and rankings, and provides detailed feedback on their individual performance in a post-training feedback report.

[0066] Example 1

[0067] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0068] In today's information society, there is an urgent need to develop human resources with the skills to respond quickly and appropriately to increasingly complex and diverse cyber attacks. However, conventional training systems have problems such as predictable scenarios and a lack of real-time response, making it difficult to adequately train response capabilities to actual threats. Furthermore, they lack the means to increase participant engagement, limiting the learning effect.

[0069] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0070] In this invention, the server includes means for initializing a generated artificial intelligence model, means for generating random security incident scenarios using the generated artificial intelligence model, means for executing attacks on the training information processing device based on the security incident scenarios, means for collecting and analyzing reactions and responses from the training information processing device, means for scoring and ranking the work performance of training participants based on the analysis results, means for notifying the training participants of the scores and rankings, means for storing the reaction data of the training participants in a database, means for having a data analysis tool for analysis using the data and for evaluating the response speed and accuracy of the training participants, means for using a model for scoring the work performance of the training participants, means for displaying the feedback content on a display device of the training information processing device, and means for notifying the feedback content by email. This makes it possible to provide unpredictable security incident scenarios in real time and improve the practical response ability and engagement of participants.

[0071] A "generated artificial intelligence model" is an algorithm that learns from various data and generates predictions and scenarios for specific tasks.

[0072] "Means for initialization" refers to the means for carrying out preparatory work to put the generated artificial intelligence model into operation, and refers to the process of loading the model and making the necessary settings.

[0073] A "security incident scenario" is a hypothetical incident that mimics various threats to information systems, such as attacks over networks and unauthorized access.

[0074] A "training information processing device" is a computer device operated by participants receiving security training, and operates based on instructions from a server.

[0075] A "training participant" is a user who takes part in a security training and deals with a scenario while operating a training information processing device.

[0076] The "means for collecting and analyzing reactions and responses" refers to the process of collecting log data from the training information processing device and analyzing the data to evaluate the participants' responses based on that data.

[0077] The "means for scoring business performance and generating rankings" refers to a means for quantifying the speed and accuracy of participants' responses based on collected data and ranking the performance of all participants.

[0078] "Data analysis tools" are software or libraries used to analyze collected data, including, for example, Python's Pandas and Scikit-learn.

[0079] The "means for displaying feedback content" is a means for displaying the scoring results and rankings of each participant on the screen of the training information processing device after the training is completed.

[0080] "Means of notifying by email" refers to a means of notifying participants of the results of scoring and ranking via email.

[0081] A "database" is a data management system that stores collected data and analysis results and allows access as needed.

[0082] MODE FOR CARRYING OUT THE INVENTION

[0083] The present invention relates to a system that generates random security incident scenarios in real time using a generative AI model and executes attacks on a training information processing device. Specific embodiments of the system are described below.

[0084] Server configuration and operation

[0085] The server initializes a generative AI model, which is built using machine learning frameworks such as TENSORFLOW (registered trademark) and PyTorch. The server initializes the model and generates random security incident scenarios, including various types of attacks such as ransomware attacks, phishing attacks, and DDoS attacks.

[0086] To generate a security incident scenario, follow these steps:

[0087] The server inputs appropriate prompt sentences into the generative AI model and generates a scenario.

[0088] For example, use the following prompt:

[0089] Use a generative AI model to generate a real-time ransomware attack scenario and launch it on designated training devices. After the attack, collect device responses and score participants' performance.

[0090] Based on the generated security incident scenarios, the server launches attacks on the training information processing devices over the network. These attacks are carried out in real time, and the aim is for the training participants to respond to unpredictable situations.

[0091] The role of training information processing equipment

[0092] The training information processing device is installed with software that receives and responds to attacks based on scenarios sent from the server in real time. Training participants use this device to respond to actual security incidents. For example, in the event of a ransomware attack, they will respond by identifying and terminating suspicious processes on the device.

[0093] User operations

[0094] The user operates the training information processing device and responds to real-time attacks from the server. When the training begins, the user receives attacks based on the scenario and must take appropriate action. For example, the user is required to stop suspicious processes or run security software to prevent infection.

[0095] Data collection and analysis

[0096] The server collects reaction and response data sent from the training information processing device in real time. This data is analyzed using data analysis tools such as Python's Pandas and Scikit-learn. Specifically, the analysis involves analyzing what operations the training participants performed and when, and recording the results in a log.

[0097] Scoring and Feedback

[0098] The server scores the work performance of the training participants based on the collected data and generates a ranking. This scoring is performed to evaluate each participant's response speed and accuracy. The generated scores and rankings are displayed on the display device of the training information processing device from the server. Feedback is also sent by email as needed.

[0099] Specific examples

[0100] As a concrete example, consider the case of a ransomware attack scenario. The server initializes a generative AI model and generates a ransomware attack scenario. Based on this scenario, a virtual ransomware attack is launched against a training information processing device. The user begins training on the training information processing device and takes appropriate countermeasures in response to the ransomware warning that suddenly appears. After the training is complete, the server analyzes the user's response and provides the results as feedback. The feedback includes a score and ranking, which the user can use to evaluate their own response.

[0101] In this way, the system of the present invention can maximize the realism of the training and the learning effect by providing unpredictable security incident scenarios in real time. In addition, the incorporation of game elements can increase the engagement of training participants.

[0102] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0103] Step 1:

[0104] The server initializes the generative AI model. First, it loads a pre-trained model using a machine learning framework such as TensorFlow or PyTorch. This is done using functions such as tensorflow.keras.models.load_model. During this initialization process, it logs the time it takes to load the model and the memory usage. The input is the pre-saved model file, and the output is the initialized AI model.

[0105] Specific operation:

[0106] The server calls the load_model function to load the model file.

[0107] Use the logging module to log that the model has finished loading.

[0108] Step 2:

[0109] The server generates security incident scenarios using the initialized generative AI model. Random prompt sentences are input into the generative AI model to generate various security incident scenarios. For example, a prompt sentence that generates a "ransomware attack scenario" is input. The input of this process is the prompt sentence, and the output is the generated security incident scenario.

[0110] Specific operation:

[0111] The server generates a prompt sentence and feeds it into the AI ​​model.

[0112] A generative AI model generates scenarios and logs their contents.

[0113] Step 3:

[0114] The server executes an attack on the training information processing device based on the generated security incident scenario. Specifically, it sends attack packets to specified ports and IP addresses according to the attack method defined in the scenario. The input to this process is the generated security incident scenario, and the output is a transmission log of the attack packets.

[0115] Specific operation:

[0116] The server creates appropriate attack packets based on the scenario.

[0117] The IP address and port of the training information processing device are specified and attack packets are sent.

[0118] Log details of the attack packets sent.

[0119] Step 4:

[0120] The terminal receives the attack from the server and records the reaction and response in a log, which includes actions such as stopping suspicious processes and running security software. The input to this process is the attack from the server, and the output is a log file recording the response.

[0121] Specific operation:

[0122] The terminal monitors and receives attack packets from the server.

[0123] Log the actions taken by the user and send the log to a server.

[0124] Step 5:

[0125] The server collects the log data sent from the training information processing device and performs data analysis. This analysis uses Python's Pandas and Scikit-learn. Based on the collected data, it analyzes the timestamp of each operation and the status of process stoppages. The input to this process is the corresponding log sent from the training information processing device, and the output is the analysis results.

[0126] Specific operation:

[0127] The server receives the log data transmitted from the training information processing device and stores it in a database.

[0128] Analyze the saved data using Pandas and Scikit-learn.

[0129] Step 6:

[0130] Based on the analysis results, the server scores the work performance of the training participants and generates a ranking of all participants. The results are a numerical evaluation of each participant's response speed and accuracy. The input to this process is the analysis results, and the output is a score and ranking.

[0131] Specific operation:

[0132] The server uses Scikit-learn to run a scoring model for each participant and evaluate their business performance.

[0133] The scores of all participants are compared and a ranking is generated.

[0134] Step 7:

[0135] The server notifies the training participants of the scoring and ranking results. Notification methods include email and the display device of the training information processing device. The input to this process is the scoring and ranking results, and the output is the notified feedback.

[0136] Specific operation:

[0137] The server uses the scoring results and rankings to create feedback content.

[0138] The created feedback content is sent by email and is also displayed on the display device of the training information processing device.

[0139] In this way, the system of the present invention cultivates advanced security response capabilities through detailed procedures and real-time attack simulations. Furthermore, by combining data analysis and feedback, it promotes skill development among participants and enables effective training.

[0140] (Application example 1)

[0141] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0142] In today's world, cyber attacks are becoming increasingly complex and diverse, creating a need for security training in realistic environments. However, conventional security training systems use fixed scenarios, resulting in insufficient preparation for actual attacks. Furthermore, there are issues with low engagement among training participants, making it difficult to maximize learning outcomes. To address these issues, a new method is needed to provide random security incident scenarios in real time and improve users' response capabilities.

[0143] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0144] In this invention, the server includes means for initializing a generative artificial intelligence model, means for generating random security incident scenarios using the generative artificial intelligence model, means for executing attacks on training terminals based on the security incident scenarios, means for collecting and analyzing reactions and responses from the training terminals, means for scoring and generating rankings of training participants' performance based on the analysis results, means for notifying the training participants of the scoring and rankings, means for providing the security incident scenarios in real time using a smartphone and collecting user responses, and means for analyzing the responses on a cloud server and generating feedback. This enables training in security scenarios that change in real time, thereby improving users' ability to respond quickly and accurately to actual cyber attacks.

[0145] A "generative artificial intelligence model" is a type of artificial intelligence that has the ability to generate new information and scenarios based on various data.

[0146] A "security incident scenario" is a hypothetical situation that mimics potential attacks or unauthorized access to computer systems or networks.

[0147] A "training terminal" is a device such as a computer or smartphone used to conduct security training.

[0148] "Scoring" is the process of quantifying and evaluating the response capabilities of training participants.

[0149] The "ranking" refers to the ranking of the training participants' performance based on the scored results.

[0150] A "smartphone" is a small computer that can run a variety of applications in addition to the functions of a mobile phone.

[0151] "Cloud server" refers to a virtualized infrastructure of servers that are available remotely over the internet.

[0152] "Real-time" means that processing or information is provided immediately in actual time.

[0153] "Feedback" refers to information indicating evaluations and areas for improvement provided after analyzing the results of training participants' responses.

[0154] "Engagement" means that participants remain actively involved and interested in the training.

[0155] MODE FOR CARRYING OUT THE INVENTION

[0156] System Overview

[0157] This invention is a system that generates security incident scenarios in real time and conducts simulated attacks on users' smartphones to train them on security measures. This system mainly consists of a server, a smartphone (training terminal), and a user.

[0158] Server-side processing

[0159] Initialization

[0160] The server first initializes a generative artificial intelligence model, which has the ability to generate new security incident scenarios based on various data using the generative AI model.

[0161] Scenario Generation

[0162] The server inputs the following prompt to the generative AI model:

[0163] "Generate a randomly selected cyber attack scenario. The scenario will be output in the following format: Attack type: [Type], Attack method: [Method], Attack route: [Route], Countermeasure: [Countermeasure]"

[0164] The generative AI model generates random security incident scenarios based on this prompt.

[0165] Scenario distribution and attack execution

[0166] The generated scenario is sent to the smartphone in real time, and a simulated attack is executed. For example, if the scenario is "Attack type: malware, Attack method: phishing email, Attack route: unknown link, Action: delete suspicious email and activate security software," the smartphone will receive a phishing email.

[0167] Processing on the smartphone side

[0168] Reactions and responses

[0169] Users must use their smartphones to respond quickly and appropriately to simulated attacks based on the scenario, such as deleting suspicious links and activating security software.

[0170] Data collection

[0171] The smartphone collects the user's responses and sends them to a server, which evaluates the user's actual countermeasure actions.

[0172] Server-side analysis and feedback

[0173] Data analysis

[0174] The server analyzes the user's response data sent from the smartphone and scores the user's performance. The analysis is performed using a cloud server and advanced data analysis algorithms.

[0175] Evaluation and Notification

[0176] Based on the scoring results, users' performance is displayed in a ranking format, allowing them to understand their own response capabilities.

[0177] Specific examples

[0178] In the system of the present invention, as a specific example, the following prompt sentence is input to the generative AI model:

[0179] "Generate a randomly selected cyber attack scenario. The scenario will be output in the following format: Attack type: Malware, Attack method: Phishing email, Attack route: Unknown link, Action to take: Delete the suspicious email and launch security software."

[0180] This allows the generative AI model to generate random security scenarios like those described above, enabling realistic training on a smartphone.

[0181] Through this system, users can conduct practical response training for unpredictable security incident scenarios and effectively improve their security response capabilities.

[0182] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0183] Step 1:

[0184] The server initializes the generated AI model

[0185] Input: Initial setting data for the generative AI model

[0186] Specific operation: The server reads the initialization file of the generative AI model and initializes the model, which includes setting model parameters and preparing training data.

[0187] Output: An initialized generative AI model

[0188] Step 2:

[0189] The server generates security incident scenarios

[0190] Input: Initialized generative AI model, prompt

[0191] Specific operation: The server inputs the following prompt to the generative AI model:

[0192] "Generate a randomly selected cyber attack scenario. The scenario will be output in the following format: Attack type: [Type], Attack method: [Method], Attack route: [Route], Countermeasure: [Countermeasure]"

[0193] Data processing and calculation: The generative AI model generates random security incident scenarios based on prompt statements.

[0194] Output: Generated security incident scenario

[0195] Step 3:

[0196] The server distributes the scenario and executes the attack.

[0197] Input: Generated security incident scenario

[0198] Specific operation: The server delivers the generated scenario to the smartphone in real time, after which a pseudo-attack based on the scenario is executed.

[0199] Output: Security incident scenarios and simulated attacks delivered to the user's smartphone

[0200] Step 4:

[0201] Users respond on their smartphones

[0202] Input: Security incident scenarios and simulated attacks delivered to smartphones

[0203] Specific actions: The user takes action based on the security scenario on their smartphone, for example, deleting a suspicious link or launching security software.

[0204] Output: User's response action

[0205] Step 5:

[0206] The smartphone collects the corresponding data and sends it to the server.

[0207] Input: User action

[0208] Specific operation: The smartphone collects data on the actions taken by the user and sends it to the server in real time.

[0209] Output: Corresponding data sent to the server

[0210] Step 6:

[0211] The server analyzes the corresponding data

[0212] Input: Corresponding data sent from the smartphone

[0213] How it works: The server analyzes the response data and scores the user's performance. The analysis uses machine learning algorithms to evaluate the speed and accuracy of the user's response.

[0214] Output: Scoring results

[0215] Step 7:

[0216] The server reflects the scoring results in the rankings.

[0217] Input: Scoring results

[0218] Specific operation: The server generates a ranking based on the scores of all users. The ranking indicates each user's ability and displays their relative position.

[0219] Output: The generated rankings

[0220] Step 8:

[0221] The server notifies the user of the ranking and feedback

[0222] Input: Generated rankings, parsed feedback information

[0223] Specific operation: The server notifies the user of the generated ranking and feedback information via their smartphone. The feedback includes specific improvements and evaluation comments.

[0224] Output: Ranking and feedback given to the user

[0225] Furthermore, an emotion engine that estimates the user's emotion may be combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0226] The present invention relates to a system that uses a generative artificial intelligence model to generate random security incident scenarios in real time, and combines it with an emotion engine that recognizes user emotions. The system is composed of a server, a training terminal, an emotion engine, and a user.

[0227] Server-side processing

[0228] The server first initializes a generative AI model. This model is an AI algorithm that learns from multiple data sets and makes predictions and generates responses to specific tasks. After initialization is complete, the server uses the model to generate random security incident scenarios. These scenarios simulate various types of attacks and unauthorized access to computer systems and networks, and provide specific situations in real time.

[0229] Based on the generated security incident scenario, the server executes attacks on the training terminals over the network. These attacks are random and unpredictable, creating a realistic sense of tension for the training participants.

[0230] After the attack is launched, the server collects the reactions and responses from the training devices, along with the users' emotional data obtained from the emotion engine. The emotional data includes the users' stress levels and motivation. The server analyzes this data and evaluates the training participants' performance.

[0231] After the analysis, the server scores the participants' performance and generates a ranking. The server then notifies the participants of these scores and rankings and provides them as a feedback report. This allows participants to understand not only their own response abilities but also their overall performance, including their emotions, and identify areas for improvement.

[0232] User processing

[0233] The user starts training using the training device and emotion engine. Once training begins, the server receives attacks based on the scenario and the user must respond in real time. For example, if a ransomware attack scenario occurs, the user must stop suspicious processes and run security software.

[0234] Furthermore, the emotion engine collects user emotional data in real time, detecting the user's stress level and motivation during training to evaluate their ability to respond in more realistic situations, further enhancing the realism of training and learning effectiveness.

[0235] After completing the training, users receive feedback from the server to check their performance, which allows them to acquire higher security response and emotional management skills.

[0236] Specific examples

[0237] As a concrete example, consider a ransomware attack scenario. The server initializes the generative AI model and randomly selects "ransomware attack" to create a scenario. Based on this scenario, the server launches a virtual ransomware attack on a training device.

[0238] The user begins training using a training device and the emotion engine, and takes appropriate action in response to a sudden ransomware warning. These actions include terminating suspicious processes and running security software. During the training, the emotion engine detects the user's stress level and motivation in real time.

[0239] After training is complete, the server collects and analyzes the user's reaction and emotional data. Finally, it scores and ranks the user based on the analysis results and notifies them to the user. Based on the feedback, the user can understand how to improve their response skills and emotional management.

[0240] In this way, the system of the present invention not only provides unpredictable security incident scenarios in real time, but also maximizes the realism of the training and the learning effect by recognizing and reflecting the user's emotions in the evaluation. Furthermore, the introduction of game elements can increase the engagement of training participants.

[0241] The processing flow will be explained below.

[0242] Step 1:

[0243] The server initializes the generative AI model. Specifically, it loads the pre-trained generative AI model into memory space and sets the necessary parameters (e.g., attack start time, attack frequency, etc.).

[0244] Step 2:

[0245] The server generates random security incident scenarios using a generative AI model. The server generates scenarios from the AI ​​model based on triggers and converts them into a format that the system can interpret.

[0246] Step 3:

[0247] The server executes attacks against the training terminals over the network based on the generated security scenarios. The attack scenarios are random and unpredictable.

[0248] Step 4:

[0249] The server initializes the emotion engine and prepares it for real-time recognition of the user's emotions. The emotion engine collects emotion data by detecting the user's facial expressions, tone of voice, body temperature, etc.

[0250] Step 5:

[0251] The terminal receives and displays alerts based on attack scenarios sent from the server, which indicate the specific type of attack and suggest countermeasures.

[0252] Step 6:

[0253] The user can take appropriate countermeasures based on the alert displayed on the device, such as stopping suspicious processes or running security software.

[0254] Step 7:

[0255] The device records the user's response actions and sends them to the server, along with the user's emotion data collected by the emotion engine.

[0256] Step 8:

[0257] The server collects and analyzes data sent from the training terminals and emotional data from the emotion engine, including the time taken to take action, success / failure information, and the user's emotional state.

[0258] Step 9:

[0259] The server scores the training participants' performance based on the results of the data analysis, and also evaluates them by taking into account their emotional data, resulting in a comprehensive score.

[0260] Step 10:

[0261] The server generates a ranking based on the analysis results and notifies the training participants, which includes feedback based on each participant's score and emotional data.

[0262] Step 11:

[0263] Users receive feedback reports from the server and see specific advice on their performance and emotional state, allowing them to understand how to improve for their next training session.

[0264] Example 2

[0265] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0266] Conventional security training systems rely on specific scenarios and fixed attack patterns, which limits the effectiveness of training and prevents training participants from fully improving their ability to respond to real security risks. Furthermore, they do not take into account the emotions and stress levels of users during training, making it difficult to evaluate training in a realistic situation. Furthermore, they do not provide immediate feedback, making it difficult to maintain participants' motivation.

[0267] The specific processing by the specific processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means.

[0268] In this invention, the server includes means for initializing a generative AI model, means for generating random security incident scenarios using the generative AI model, means for executing attacks against an information processing device based on the security incident scenarios, means for collecting and analyzing reactions and responses from the information processing device and emotion data acquired from an emotion recognition device, means for scoring and ranking training participants' performance based on the analysis results, and means for notifying training participants of the scoring and ranking. This enables users to improve their ability to respond to a variety of realistic security incident scenarios and enables comprehensive evaluation that takes emotion data into account. Furthermore, immediate feedback can maintain training participants' motivation, enabling more effective training.

[0269] A "generative artificial intelligence model" is an artificial intelligence algorithm that learns from multiple data sets and makes predictions and generates responses to specific tasks.

[0270] A "random security incident scenario" is a scenario that randomly generates specific situations that mimic various types of attacks and unauthorized access to computer systems and networks.

[0271] An "information processing device" is a device that inputs, processes, and outputs data, and includes computers and servers used as training terminals.

[0272] An "emotion recognition device" is a device for collecting and analyzing a user's emotional data, and includes a wearable device, a camera, and dedicated analysis software.

[0273] "Scoring" is the process of analyzing collected data and quantifying and evaluating the performance of training participants.

[0274] "Ranking" refers to arranging training participants in order of evaluation based on the scored results.

[0275] A "feedback report" is a report that notifies training participants of the evaluation results and areas for improvement.

[0276] The present invention relates to a system that generates random security incident scenarios in real time using a generative artificial intelligence model, and combines it with an emotion engine that recognizes user emotions. This system is composed of a server, an information processing device, an emotion recognition device, and a user.

[0277] The server first initializes a generative artificial intelligence model. This model is built using deep learning frameworks such as TensorFlow and PyTorch. Once initialization is complete, the server uses the model to generate random security incident scenarios. These scenarios mimic various types of attacks and unauthorized access to computer systems and networks, providing specific situations in real time.

[0278] Based on the generated security incident scenario, the server launches attacks against information processing devices over the network. These attacks are unpredictable, creating a realistic sense of tension for participants.

[0279] When an attack is launched, the server collects the reaction and response data from the information processing device. It also collects the user's emotional data obtained from the emotion recognition device. This data includes the user's stress level and motivation. The server analyzes the collected data and evaluates the training participant's performance.

[0280] After the analysis, the server scores the training participants' performance and generates a ranking. The server also notifies the participants of these scores and rankings and provides them as a feedback report, allowing them to understand their security response capabilities and emotional management skills and understand areas for improvement.

[0281] The user starts training using the information processing device and emotion recognition device. Once training begins, the user receives attack scenarios from the server and must respond in real time. For example, if a ransomware attack scenario occurs, the user must stop suspicious processes and run security software.

[0282] Furthermore, the emotion recognition device collects user emotional data in real time, detecting the user's stress level and motivation during training, allowing for evaluation of the user's ability to respond in more realistic situations.

[0283] As a concrete example, consider a ransomware attack scenario. The server initializes a generative artificial intelligence model using TensorFlow, randomly selects "ransomware attack," and generates a scenario. Based on this scenario, the server launches a virtual ransomware attack on an information processing device.

[0284] The user begins training using the information processing device and emotion recognition device, and responds appropriately to sudden ransomware warnings. This response includes terminating suspicious processes and running security software. During training, the emotion recognition device detects the user's stress level and motivation in real time.

[0285] After the training is complete, the server collects and analyzes the user's reaction and emotional data. Finally, it scores and ranks the user based on the analysis results and notifies them to the user. Based on the feedback, the user can understand how to improve their response skills and emotional management.

[0286] The system maximizes the realism of training and learning effectiveness by providing unpredictable security incident scenarios in real time and recognizing and reflecting user emotions in evaluations. It also incorporates game elements to increase participant engagement.

[0287] Example prompt sentence:

[0288] 1. "Please tell me how attack scenarios are generated in the real-time security assessment system."

[0289] 2. "Please explain the details of your security training system, including user sentiment data."

[0290] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0291] Step 1:

[0292] The server initializes the generative artificial intelligence model.

[0293] Input: Parameter files for the model and libraries required for initialization (e.g. TensorFlow or PyTorch).

[0294] Data processing: Load model parameters and initialize the model.

[0295] Output: An initialized generative artificial intelligence model.

[0296] Specific operation: The server loads the model parameter file saved in advance and builds a generative AI model based on it. Next, it loads the necessary libraries (TensorFlow and PyTorch) and initializes the model.

[0297] Step 2:

[0298] The server generates random security incident scenarios using the initialized generative artificial intelligence model.

[0299] Input: An initialized generative artificial intelligence model, a library of security incident scenarios (ransomware attacks, phishing attacks, etc.).

[0300] Data processing: Introduce randomness into the model to generate security incident scenarios.

[0301] Output: Generated security incident scenarios.

[0302] How it works: The server inputs specific parameters into the initialized model and generates random scenarios, such as ransomware attacks and phishing attacks.

[0303] Step 3:

[0304] The server executes an attack on the information processing device based on the generated security incident scenario.

[0305] Input: Generated security incident scenario, IP address and connection information of information processing device.

[0306] Data processing: Create attack packets according to the scenario and send them over the network.

[0307] Output: Execution of an attack against information processing equipment.

[0308] Specific operation: The server creates an attack packet based on the scenario and sends it to the information processing device. For example, in the case of a ransomware attack, it sends a virtual ransomware payload to the information processing device.

[0309] Step 4:

[0310] The server collects the reaction and response data from the information processing device, and the emotion data obtained from the emotion recognition device.

[0311] Input: System log of the information processing device after the attack, emotion data from the emotion recognition device.

[0312] Data processing: Collecting log data and sentiment data and converting them into an analyzable format.

[0313] Output: Reaction and sentiment data in a parsable format.

[0314] Specific operation: The server collects system logs from the information processing device and extracts data necessary for analyzing responses to attacks. At the same time, it collects user emotion data obtained from the emotion recognition device.

[0315] Step 5:

[0316] The server analyzes the collected data and scores the performance of the training participants.

[0317] Input: Reaction and emotion data in a parsable format.

[0318] Data processing: Analyze the data using data mining and machine learning algorithms to calculate a score.

[0319] Output: Performance scores of training participants.

[0320] Specific operation: The server analyzes the collected data using machine learning algorithms and calculates a performance score based on the training participants' reactions and emotional data.

[0321] Step 6:

[0322] The server generates a ranking based on the scoring results and notifies the training participants.

[0323] Input: Training participant performance scores.

[0324] Data processing: Training participants are ranked based on their scores.

[0325] Output: Ranking results and feedback report.

[0326] Specific operation: The server generates a ranking based on the performance score and notifies the training participants. Notifications are sent via email or dashboard updates. Users can check their own performance based on this and identify areas for improvement.

[0327] (Application example 2)

[0328] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0329] Conventional security training systems only evaluated users' response capabilities and provided insufficient feedback to provide effective learning. Furthermore, because the evaluation was conducted without taking into account the emotions and stress levels of the training participants, the system lacked realism and limited learning effectiveness. Furthermore, the lack of ingenuity to increase training engagement made it difficult to provide continuous training.

[0330] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 2 is realized by the following means.

[0331] In this invention, the server includes means for initializing a generative AI model, means for generating random security incident scenarios using the generative AI model, means for executing attacks against training terminals based on the security incident scenarios, means for collecting and analyzing reactions and responses from the training terminals, means for scoring and ranking training participants' performance based on the analysis results, means for collecting and analyzing user emotional data from the training terminals, means for notifying training participants of the scoring and analysis, and means for providing feedback and adjusting training content based on the user emotional data. This enables evaluation that takes into account not only the user's response ability but also their emotions, making security training more effective and realistic. Furthermore, incorporating game elements can increase training engagement and promote continuous learning.

[0332] A "generative artificial intelligence model" is an algorithm that learns from multiple data sets and makes predictions and generates information for specific tasks.

[0333] "Security incident scenarios" provide specific real-time situations that mimic various types of attacks and unauthorized access to computer systems and networks.

[0334] A "training terminal" is an information processing device that is subjected to an attack based on a security incident scenario and is used to respond to the attack.

[0335] "Emotional Data" refers to data collected by the emotion recognition engine, including the user's stress level, motivation, etc.

[0336] "Scoring" is the process of numerically evaluating a user's ability to respond.

[0337] "Ranking" refers to the process of ranking based on the scoring results of multiple training participants.

[0338] "Feedback" refers to a report that includes an evaluation of the training content and advice provided to the user based on the analysis results.

[0339] "Game elements" are gamification elements introduced to increase training engagement.

[0340] "Engagement" refers to the level of involvement and enthusiasm that users maintain in the training.

[0341] "Training participant" means a user who receives training using the security training system.

[0342] "Real time" refers to a state in which processing occurs immediately without delay.

[0343] "Analysis" is the process of examining information and drawing conclusions based on collected data.

[0344] The present invention relates to a security training system that uses a generative artificial intelligence model to generate random security incident scenarios in real time and evaluate users' response capabilities and emotions. The system is composed of a server, a training terminal, an emotion engine, and users.

[0345] Server side:

[0346] The server first initializes a generative artificial intelligence model. This AI model is trained using machine learning libraries such as TensorFlow and Keras. The model learns from multiple datasets and generates random security incident scenarios in real time. The generated scenarios include ransomware attacks, phishing attacks, and DDoS attacks.

[0347] After the training scenario is generated, the server executes attacks against the training device based on the scenario. The attacks are unpredictable, providing a realistic sense of tension and learning effect. When the attack is executed, the training device responds and sends the response data to the server.

[0348] At the same time, emotional data from the training participants is collected in real time. The emotion engine uses OpenCV to detect stress levels and motivation from users' facial expressions. This data is sent from the training device to a server and analyzed by an AI model.

[0349] The server scores the performance of the training participants based on the collected response and emotion data. It also generates a ranking based on the scores of multiple training participants and notifies the user. Detailed feedback is provided along with the ranking results. The feedback includes an evaluation of not only response ability but also emotion management.

[0350] What you need to do:

[0351] The user starts training using the training terminal. Based on the security scenarios sent from the server, the user responds in real time. For example, if a ransomware attack scenario occurs, the user stops the suspicious process and runs security software.

[0352] The emotion engine continues to collect user emotion data during training. After training, users can receive feedback from the server to check their performance. Based on this feedback, users can understand how to improve their response skills and emotion management.

[0353] Examples:

[0354] As a concrete example, consider the "phishing email scenario." In this scenario, the server uses an AI model to simulate a phishing email attack. Users use training devices to verify the sender of the email and check the safety of the links. The accuracy and speed of the response are evaluated, and the emotion engine detects stress levels.

[0355] After completing the training, the server provides feedback such as "Response score: 85, Stress level: 0.65," allowing users to understand areas for improvement in their response skills and emotional management.

[0356] Example prompt sentence:

[0357] "Use AI models to generate real-time security incident scenarios and leverage emotion recognition engines to build models that assess users' stress levels and readiness to respond."

[0358] This provides a concrete understanding of how this AI system can make security training more effective.

[0359] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0360] Step 1:

[0361] The server initializes the generative artificial intelligence model. The input used is a pre-trained model file. Based on this, the server initializes the AI ​​model. The output is the initialized AI model.

[0362] Step 2:

[0363] The server generates random security incident scenarios using the initialized AI model. The inputs are the AI ​​model and a dataset of past security incidents and attacks. The AI ​​model extracts important features and generates random security incident scenarios based on those features. The output is the generated security incident scenario.

[0364] Step 3:

[0365] The server executes attacks against the training terminal based on the generated security incident scenario. The input requires the scenario and information about the training terminal. The server analyzes the scenario and sends commands and triggers to the terminal to execute the virtual attack. The output is the state of the training terminal when the attack is executed.

[0366] Step 4:

[0367] The training terminal collects responses made by users to virtual attacks from the server. The inputs required are attack information from the server and user operation information. The terminal captures user operation logs and reactions in real time. The output is the collected response data.

[0368] Step 5:

[0369] The device collects the user's emotional data in real time. The input requires data from sensor devices such as cameras and microphones. The emotion engine analyzes this data and generates emotional data such as stress level and motivation. The output is the analyzed emotional data.

[0370] Step 6:

[0371] The server receives the reaction data and emotion data collected from the training device. The reaction data and emotion data are required as input. The server analyzes these data with an AI model to evaluate the user's response ability and emotional state. The output is a performance score, which is the analysis result.

[0372] Step 7:

[0373] The server scores users' performance based on the analysis results and generates rankings. The analysis results are required as input. The server calculates the scores and creates rankings based on the scores of multiple users. The output is the scoring and ranking results.

[0374] Step 8:

[0375] The server notifies the user of the scoring and ranking results. The inputs required are the scoring and ranking results. The server generates this information as a feedback report and sends it to the user via the training terminal. The output is the feedback report received by the user.

[0376] Step 9:

[0377] Users review the feedback report to understand areas for improvement in their response skills and emotional management. The input required is the feedback report. Users use the feedback to learn and improve their future responses. The output is the user's improved response skills and emotional management.

[0378] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0379] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (registered trademark) (Internet search engine).<URL: https: / / openai.com / blog / chatgpt> ), Gemini (registered trademark) (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0380] In the above embodiment, an example in which the specific process is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific process may be performed by the smart device 14.

[0381] [Second embodiment]

[0382] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0383] 3, the data processing system 210 includes the data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0384] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0385] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0386] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0387] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0388] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0389] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0390] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0391] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0392] In the smart glasses 214, the reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0393] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal."

[0394] The present invention relates to a system that uses a generative artificial intelligence model to generate random security incident scenarios in real time and execute attacks against training terminals. The system mainly consists of a server, a training terminal, and a user.

[0395] Server-side processing

[0396] The server first initializes a generative AI model. This model is an AI algorithm that learns from multiple data sets and makes predictions and generates responses to specific tasks. After initialization is complete, the server uses the model to generate random security incident scenarios. These scenarios simulate various types of attacks and unauthorized access to computer systems and networks, and provide specific situations in real time.

[0397] Based on the generated security incident scenario, the server executes attacks on the training terminals over the network. These attacks are random and unpredictable, creating a realistic sense of tension for the training participants.

[0398] After the attack is carried out, the server collects and analyzes the reactions and responses from the training devices. After the analysis, the server scores the participants' performance and generates a ranking. The generated scores and rankings are then notified to the participants, allowing them to evaluate their own response capabilities and identify areas for improvement.

[0399] User processing

[0400] The user starts training using the training terminal. Once the training starts, the server sends a scenario-based attack to the user, and the user must respond in real time. For example, if a ransomware attack scenario occurs, the user must stop any suspicious processes and run security software.

[0401] After completing the training, users receive feedback from the server and can check their performance, enabling them to acquire even higher security response capabilities. The incorporation of game elements also increases the engagement of participants and maximizes learning effectiveness.

[0402] Specific examples

[0403] As a concrete example, consider the case of a ransomware attack scenario. The server initializes the generative AI model and randomly selects "ransomware attack" to create a scenario. Based on this scenario, the server launches a virtual ransomware attack on a training device.

[0404] Users begin training on a training device and take appropriate action in response to a ransomware warning that suddenly appears. These actions include terminating suspicious processes and running security software. After completing the training, users check the feedback and ranking sent from the server to understand their own response capabilities.

[0405] In this way, the system of the present invention maximizes the realism of the training and the learning effect by providing unpredictable security incident scenarios in real time. In addition, the introduction of game elements can increase the engagement of training participants.

[0406] The processing flow will be explained below.

[0407] Step 1:

[0408] The server initializes the generative AI model. Specifically, it loads the pre-trained generative AI model into memory space and sets the necessary parameters (e.g., attack start time, attack frequency, etc.).

[0409] Step 2:

[0410] The server generates random security incident scenarios using a generative AI model. The server generates scenarios from the AI ​​model based on triggers and converts them into a format that the system can interpret.

[0411] Step 3:

[0412] The server executes attacks against the training terminals over the network based on the generated security scenario, and the attacks are initiated at the specified timing.

[0413] Step 4:

[0414] The terminal receives and displays an alert based on the attack scenario sent from the server. The alert triggers the terminal to prompt the user to take countermeasures.

[0415] Step 5:

[0416] The user can take appropriate countermeasures based on the alert displayed on the device, such as stopping suspicious processes or running security software.

[0417] Step 6:

[0418] The server collects response and response data from the training devices, including the time taken and success or failure of response actions.

[0419] Step 7:

[0420] The server analyzes the collected data and evaluates the training participants' performance, using a scoring algorithm to calculate a score based on the speed and accuracy of their responses.

[0421] Step 8:

[0422] The server generates scores and rankings for the participants based on the analysis results. The rankings are used to foster a sense of competition among the participants.

[0423] Step 9:

[0424] The server notifies the training participants of the generated scores and rankings, and provides detailed feedback on their individual performance in a post-training feedback report.

[0425] Example 1

[0426] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0427] In today's information society, there is an urgent need to develop human resources with the skills to respond quickly and appropriately to increasingly complex and diverse cyber attacks. However, conventional training systems have problems such as predictable scenarios and a lack of real-time response, making it difficult to adequately train response capabilities to actual threats. Furthermore, they lack the means to increase participant engagement, limiting the learning effect.

[0428] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0429] In this invention, the server includes means for initializing a generated artificial intelligence model, means for generating random security incident scenarios using the generated artificial intelligence model, means for executing attacks on the training information processing device based on the security incident scenarios, means for collecting and analyzing reactions and responses from the training information processing device, means for scoring and ranking the work performance of training participants based on the analysis results, means for notifying the training participants of the scores and rankings, means for storing the reaction data of the training participants in a database, means for having a data analysis tool for analysis using the data and for evaluating the response speed and accuracy of the training participants, means for using a model for scoring the work performance of the training participants, means for displaying the feedback content on a display device of the training information processing device, and means for notifying the feedback content by email. This makes it possible to provide unpredictable security incident scenarios in real time and improve the practical response ability and engagement of participants.

[0430] A "generated artificial intelligence model" is an algorithm that learns from various data and generates predictions and scenarios for specific tasks.

[0431] "Means for initialization" refers to the means for carrying out preparatory work to put the generated artificial intelligence model into operation, and refers to the process of loading the model and making the necessary settings.

[0432] A "security incident scenario" is a hypothetical incident that mimics various threats to information systems, such as attacks over networks and unauthorized access.

[0433] A "training information processing device" is a computer device operated by participants receiving security training, and operates based on instructions from a server.

[0434] A "training participant" is a user who takes part in a security training and deals with a scenario while operating a training information processing device.

[0435] The "means for collecting and analyzing reactions and responses" refers to the process of collecting log data from the training information processing device and analyzing the data to evaluate the participants' responses based on that data.

[0436] The "means for scoring business performance and generating rankings" refers to a means for quantifying the speed and accuracy of participants' responses based on collected data and ranking the performance of all participants.

[0437] "Data analysis tools" are software or libraries used to analyze collected data, including, for example, Python's Pandas and Scikit-learn.

[0438] The "means for displaying feedback content" is a means for displaying the scoring results and rankings of each participant on the screen of the training information processing device after the training is completed.

[0439] "Means of notifying by email" refers to a means of notifying participants of the results of scoring and ranking via email.

[0440] A "database" is a data management system that stores collected data and analysis results and allows access as needed.

[0441] MODE FOR CARRYING OUT THE INVENTION

[0442] The present invention relates to a system that generates random security incident scenarios in real time using a generative AI model and executes attacks on a training information processing device. Specific embodiments of the system are described below.

[0443] Server configuration and operation

[0444] The server initializes a generative AI model, which is built using machine learning frameworks such as TensorFlow and PyTorch. The server then initializes the model and generates random security incident scenarios, including various types of attacks, such as ransomware attacks, phishing attacks, and DDoS attacks.

[0445] To generate a security incident scenario, follow these steps:

[0446] The server inputs appropriate prompt sentences into the generative AI model and generates a scenario.

[0447] For example, use the following prompt:

[0448] Use a generative AI model to generate a real-time ransomware attack scenario and launch it on designated training devices. After the attack, collect device responses and score participants' performance.

[0449] Based on the generated security incident scenarios, the server launches attacks on the training information processing devices over the network. These attacks are carried out in real time, and the aim is for the training participants to respond to unpredictable situations.

[0450] The role of training information processing equipment

[0451] The training information processing device is installed with software that receives and responds to attacks based on scenarios sent from the server in real time. Training participants use this device to respond to actual security incidents. For example, in the event of a ransomware attack, they will respond by identifying and terminating suspicious processes on the device.

[0452] User operations

[0453] The user operates the training information processing device and responds to real-time attacks from the server. When the training begins, the user receives attacks based on the scenario and must take appropriate action. For example, the user is required to stop suspicious processes or run security software to prevent infection.

[0454] Data collection and analysis

[0455] The server collects reaction and response data sent from the training information processing device in real time. This data is analyzed using data analysis tools such as Python's Pandas and Scikit-learn. Specifically, the analysis involves analyzing what operations the training participants performed and when, and recording the results in a log.

[0456] Scoring and Feedback

[0457] The server scores the work performance of the training participants based on the collected data and generates a ranking. This scoring is performed to evaluate each participant's response speed and accuracy. The generated scores and rankings are displayed on the display device of the training information processing device from the server. Feedback is also sent by email as needed.

[0458] Specific examples

[0459] As a concrete example, consider the case of a ransomware attack scenario. The server initializes a generative AI model and generates a ransomware attack scenario. Based on this scenario, a virtual ransomware attack is launched against a training information processing device. The user begins training on the training information processing device and takes appropriate countermeasures in response to the ransomware warning that suddenly appears. After the training is complete, the server analyzes the user's response and provides the results as feedback. The feedback includes a score and ranking, which the user can use to evaluate their own response.

[0460] In this way, the system of the present invention can maximize the realism of the training and the learning effect by providing unpredictable security incident scenarios in real time. In addition, the incorporation of game elements can increase the engagement of training participants.

[0461] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0462] Step 1:

[0463] The server initializes the generative AI model. First, it loads a pre-trained model using a machine learning framework such as TensorFlow or PyTorch. This is done using functions such as tensorflow.keras.models.load_model. During this initialization process, it logs the time it takes to load the model and the memory usage. The input is the pre-saved model file, and the output is the initialized AI model.

[0464] Specific operation:

[0465] The server calls the load_model function to load the model file.

[0466] Use the logging module to log that the model has finished loading.

[0467] Step 2:

[0468] The server generates security incident scenarios using the initialized generative AI model. Random prompt sentences are input into the generative AI model to generate various security incident scenarios. For example, a prompt sentence that generates a "ransomware attack scenario" is input. The input of this process is the prompt sentence, and the output is the generated security incident scenario.

[0469] Specific operation:

[0470] The server generates a prompt sentence and feeds it into the AI ​​model.

[0471] A generative AI model generates scenarios and logs their contents.

[0472] Step 3:

[0473] The server executes an attack on the training information processing device based on the generated security incident scenario. Specifically, it sends attack packets to specified ports and IP addresses according to the attack method defined in the scenario. The input to this process is the generated security incident scenario, and the output is a transmission log of the attack packets.

[0474] Specific operation:

[0475] The server creates appropriate attack packets based on the scenario.

[0476] The IP address and port of the training information processing device are specified and attack packets are sent.

[0477] Log details of the attack packets sent.

[0478] Step 4:

[0479] The terminal receives the attack from the server and records the reaction and response in a log, which includes actions such as stopping suspicious processes and running security software. The input to this process is the attack from the server, and the output is a log file recording the response.

[0480] Specific operation:

[0481] The terminal monitors and receives attack packets from the server.

[0482] Log the actions taken by the user and send the log to a server.

[0483] Step 5:

[0484] The server collects the log data sent from the training information processing device and performs data analysis. This analysis uses Python's Pandas and Scikit-learn. Based on the collected data, it analyzes the timestamp of each operation and the status of process stoppages. The input to this process is the corresponding log sent from the training information processing device, and the output is the analysis results.

[0485] Specific operation:

[0486] The server receives the log data transmitted from the training information processing device and stores it in a database.

[0487] Analyze the saved data using Pandas and Scikit-learn.

[0488] Step 6:

[0489] Based on the analysis results, the server scores the work performance of the training participants and generates a ranking of all participants. The results are a numerical evaluation of each participant's response speed and accuracy. The input to this process is the analysis results, and the output is a score and ranking.

[0490] Specific operation:

[0491] The server uses Scikit-learn to run a scoring model for each participant and evaluate their business performance.

[0492] The scores of all participants are compared and a ranking is generated.

[0493] Step 7:

[0494] The server notifies the training participants of the scoring and ranking results. Notification methods include email and the display device of the training information processing device. The input to this process is the scoring and ranking results, and the output is the notified feedback.

[0495] Specific operation:

[0496] The server uses the scoring results and rankings to create feedback content.

[0497] The created feedback content is sent by email and is also displayed on the display device of the training information processing device.

[0498] In this way, the system of the present invention cultivates advanced security response capabilities through detailed procedures and real-time attack simulations. Furthermore, by combining data analysis and feedback, it promotes skill development among participants and enables effective training.

[0499] (Application example 1)

[0500] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0501] In today's world, cyber attacks are becoming increasingly complex and diverse, creating a need for security training in realistic environments. However, conventional security training systems use fixed scenarios, resulting in insufficient preparation for actual attacks. Furthermore, there are issues with low engagement among training participants, making it difficult to maximize learning outcomes. To address these issues, a new method is needed to provide random security incident scenarios in real time and improve users' response capabilities.

[0502] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0503] In this invention, the server includes means for initializing a generative artificial intelligence model, means for generating random security incident scenarios using the generative artificial intelligence model, means for executing attacks on training terminals based on the security incident scenarios, means for collecting and analyzing reactions and responses from the training terminals, means for scoring and generating rankings of training participants' performance based on the analysis results, means for notifying the training participants of the scoring and rankings, means for providing the security incident scenarios in real time using a smartphone and collecting user responses, and means for analyzing the responses on a cloud server and generating feedback. This enables training in security scenarios that change in real time, thereby improving users' ability to respond quickly and accurately to actual cyber attacks.

[0504] A "generative artificial intelligence model" is a type of artificial intelligence that has the ability to generate new information and scenarios based on various data.

[0505] A "security incident scenario" is a hypothetical situation that mimics potential attacks or unauthorized access to computer systems or networks.

[0506] A "training terminal" is a device such as a computer or smartphone used to conduct security training.

[0507] "Scoring" is the process of quantifying and evaluating the response capabilities of training participants.

[0508] The "ranking" refers to the ranking of the training participants' performance based on the scored results.

[0509] A "smartphone" is a small computer that can run a variety of applications in addition to the functions of a mobile phone.

[0510] "Cloud server" refers to a virtualized infrastructure of servers that are available remotely over the internet.

[0511] "Real-time" means that processing or information is provided immediately in actual time.

[0512] "Feedback" refers to information indicating evaluations and areas for improvement provided after analyzing the results of training participants' responses.

[0513] "Engagement" means that participants remain actively involved and interested in the training.

[0514] MODE FOR CARRYING OUT THE INVENTION

[0515] System Overview

[0516] This invention is a system that generates security incident scenarios in real time and conducts simulated attacks on users' smartphones to train them on security measures. This system mainly consists of a server, a smartphone (training terminal), and a user.

[0517] Server-side processing

[0518] Initialization

[0519] The server first initializes a generative artificial intelligence model, which has the ability to generate new security incident scenarios based on various data using the generative AI model.

[0520] Scenario Generation

[0521] The server inputs the following prompt to the generative AI model:

[0522] "Generate a randomly selected cyber attack scenario. The scenario will be output in the following format: Attack type: [Type], Attack method: [Method], Attack route: [Route], Countermeasure: [Countermeasure]"

[0523] The generative AI model generates random security incident scenarios based on this prompt.

[0524] Scenario distribution and attack execution

[0525] The generated scenario is sent to the smartphone in real time, and a simulated attack is executed. For example, if the scenario is "Attack type: malware, Attack method: phishing email, Attack route: unknown link, Action: delete suspicious email and activate security software," the smartphone will receive a phishing email.

[0526] Processing on the smartphone side

[0527] Reactions and responses

[0528] Users must use their smartphones to respond quickly and appropriately to simulated attacks based on the scenario, such as deleting suspicious links and activating security software.

[0529] Data collection

[0530] The smartphone collects the user's responses and sends them to a server, which evaluates the user's actual countermeasure actions.

[0531] Server-side analysis and feedback

[0532] Data analysis

[0533] The server analyzes the user's response data sent from the smartphone and scores the user's performance. The analysis is performed using a cloud server and advanced data analysis algorithms.

[0534] Evaluation and Notification

[0535] Based on the scoring results, users' performance is displayed in a ranking format, allowing them to understand their own response capabilities.

[0536] Specific examples

[0537] In the system of the present invention, as a specific example, the following prompt sentence is input to the generative AI model:

[0538] "Generate a randomly selected cyber attack scenario. The scenario will be output in the following format: Attack type: Malware, Attack method: Phishing email, Attack route: Unknown link, Action to take: Delete the suspicious email and launch security software."

[0539] This allows the generative AI model to generate random security scenarios like those described above, enabling realistic training on a smartphone.

[0540] Through this system, users can conduct practical response training for unpredictable security incident scenarios and effectively improve their security response capabilities.

[0541] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0542] Step 1:

[0543] The server initializes the generated AI model

[0544] Input: Initial setting data for the generative AI model

[0545] Specific operation: The server reads the initialization file of the generative AI model and initializes the model, which includes setting model parameters and preparing training data.

[0546] Output: An initialized generative AI model

[0547] Step 2:

[0548] The server generates security incident scenarios

[0549] Input: Initialized generative AI model, prompt

[0550] Specific operation: The server inputs the following prompt to the generative AI model:

[0551] "Generate a randomly selected cyber attack scenario. The scenario will be output in the following format: Attack type: [Type], Attack method: [Method], Attack route: [Route], Countermeasure: [Countermeasure]"

[0552] Data processing and calculation: The generative AI model generates random security incident scenarios based on prompt statements.

[0553] Output: Generated security incident scenario

[0554] Step 3:

[0555] The server distributes the scenario and executes the attack.

[0556] Input: Generated security incident scenario

[0557] Specific operation: The server delivers the generated scenario to the smartphone in real time, after which a pseudo-attack based on the scenario is executed.

[0558] Output: Security incident scenarios and simulated attacks delivered to the user's smartphone

[0559] Step 4:

[0560] Users respond on their smartphones

[0561] Input: Security incident scenarios and simulated attacks delivered to smartphones

[0562] Specific actions: The user takes action based on the security scenario on their smartphone, for example, deleting a suspicious link or launching security software.

[0563] Output: User's response action

[0564] Step 5:

[0565] The smartphone collects the corresponding data and sends it to the server.

[0566] Input: User action

[0567] Specific operation: The smartphone collects data on the actions taken by the user and sends it to the server in real time.

[0568] Output: Corresponding data sent to the server

[0569] Step 6:

[0570] The server analyzes the corresponding data

[0571] Input: Corresponding data sent from the smartphone

[0572] How it works: The server analyzes the response data and scores the user's performance. The analysis uses machine learning algorithms to evaluate the speed and accuracy of the user's response.

[0573] Output: Scoring results

[0574] Step 7:

[0575] The server reflects the scoring results in the rankings.

[0576] Input: Scoring results

[0577] Specific operation: The server generates a ranking based on the scores of all users. The ranking indicates each user's ability and displays their relative position.

[0578] Output: The generated rankings

[0579] Step 8:

[0580] The server notifies the user of the ranking and feedback

[0581] Input: Generated rankings, parsed feedback information

[0582] Specific operation: The server notifies the user of the generated ranking and feedback information via their smartphone. The feedback includes specific improvements and evaluation comments.

[0583] Output: Ranking and feedback given to the user

[0584] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[0585] The present invention relates to a system that uses a generative artificial intelligence model to generate random security incident scenarios in real time, and combines it with an emotion engine that recognizes user emotions. The system is composed of a server, a training terminal, an emotion engine, and a user.

[0586] Server-side processing

[0587] The server first initializes a generative AI model. This model is an AI algorithm that learns from multiple data sets and makes predictions and generates responses to specific tasks. After initialization is complete, the server uses the model to generate random security incident scenarios. These scenarios simulate various types of attacks and unauthorized access to computer systems and networks, and provide specific situations in real time.

[0588] Based on the generated security incident scenario, the server executes attacks on the training terminals over the network. These attacks are random and unpredictable, creating a realistic sense of tension for the training participants.

[0589] After the attack is launched, the server collects the reactions and responses from the training devices, along with the users' emotional data obtained from the emotion engine. The emotional data includes the users' stress levels and motivation. The server analyzes this data and evaluates the training participants' performance.

[0590] After the analysis, the server scores the participants' performance and generates a ranking. The server then notifies the participants of these scores and rankings and provides them as a feedback report. This allows participants to understand not only their own response abilities but also their overall performance, including their emotions, and identify areas for improvement.

[0591] User processing

[0592] The user starts training using the training device and emotion engine. Once training begins, the server receives attacks based on the scenario and the user must respond in real time. For example, if a ransomware attack scenario occurs, the user must stop suspicious processes and run security software.

[0593] Furthermore, the emotion engine collects user emotional data in real time, detecting the user's stress level and motivation during training to evaluate their ability to respond in more realistic situations, further enhancing the realism of training and learning effectiveness.

[0594] After completing the training, users receive feedback from the server to check their performance, which allows them to acquire higher security response and emotional management skills.

[0595] Specific examples

[0596] As a concrete example, consider a ransomware attack scenario. The server initializes the generative AI model and randomly selects "ransomware attack" to create a scenario. Based on this scenario, the server launches a virtual ransomware attack on a training device.

[0597] The user begins training using a training device and the emotion engine, and takes appropriate action in response to a sudden ransomware warning. These actions include terminating suspicious processes and running security software. During the training, the emotion engine detects the user's stress level and motivation in real time.

[0598] After training is complete, the server collects and analyzes the user's reaction and emotional data. Finally, it scores and ranks the user based on the analysis results and notifies them to the user. Based on the feedback, the user can understand how to improve their response skills and emotional management.

[0599] In this way, the system of the present invention not only provides unpredictable security incident scenarios in real time, but also maximizes the realism of the training and the learning effect by recognizing and reflecting the user's emotions in the evaluation. Furthermore, the introduction of game elements can increase the engagement of training participants.

[0600] The processing flow will be explained below.

[0601] Step 1:

[0602] The server initializes the generative AI model. Specifically, it loads the pre-trained generative AI model into memory space and sets the necessary parameters (e.g., attack start time, attack frequency, etc.).

[0603] Step 2:

[0604] The server generates random security incident scenarios using a generative AI model. The server generates scenarios from the AI ​​model based on triggers and converts them into a format that the system can interpret.

[0605] Step 3:

[0606] The server executes attacks against the training terminals over the network based on the generated security scenarios. The attack scenarios are random and unpredictable.

[0607] Step 4:

[0608] The server initializes the emotion engine and prepares it for real-time recognition of the user's emotions. The emotion engine collects emotion data by detecting the user's facial expressions, tone of voice, body temperature, etc.

[0609] Step 5:

[0610] The terminal receives and displays alerts based on attack scenarios sent from the server, which indicate the specific type of attack and suggest countermeasures.

[0611] Step 6:

[0612] The user can take appropriate countermeasures based on the alert displayed on the device, such as stopping suspicious processes or running security software.

[0613] Step 7:

[0614] The device records the user's response actions and sends them to the server, along with the user's emotion data collected by the emotion engine.

[0615] Step 8:

[0616] The server collects and analyzes data sent from the training terminals and emotional data from the emotion engine, including the time taken to take action, success / failure information, and the user's emotional state.

[0617] Step 9:

[0618] The server scores the training participants' performance based on the results of the data analysis, and also evaluates them by taking into account their emotional data, resulting in a comprehensive score.

[0619] Step 10:

[0620] The server generates a ranking based on the analysis results and notifies the training participants, which includes feedback based on each participant's score and emotional data.

[0621] Step 11:

[0622] Users receive feedback reports from the server and see specific advice on their performance and emotional state, allowing them to understand how to improve for their next training session.

[0623] Example 2

[0624] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0625] Conventional security training systems rely on specific scenarios and fixed attack patterns, which limits the effectiveness of training and prevents training participants from fully improving their ability to respond to real security risks. Furthermore, they do not take into account the emotions and stress levels of users during training, making it difficult to evaluate training in a realistic situation. Furthermore, they do not provide immediate feedback, making it difficult to maintain participants' motivation.

[0626] The specific processing by the specific processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means.

[0627] In this invention, the server includes means for initializing a generative AI model, means for generating random security incident scenarios using the generative AI model, means for executing attacks against an information processing device based on the security incident scenarios, means for collecting and analyzing reactions and responses from the information processing device and emotion data acquired from an emotion recognition device, means for scoring and ranking training participants' performance based on the analysis results, and means for notifying training participants of the scoring and ranking. This enables users to improve their ability to respond to a variety of realistic security incident scenarios and enables comprehensive evaluation that takes emotion data into account. Furthermore, immediate feedback can maintain training participants' motivation, enabling more effective training.

[0628] A "generative artificial intelligence model" is an artificial intelligence algorithm that learns from multiple data sets and makes predictions and generates responses to specific tasks.

[0629] A "random security incident scenario" is a scenario that randomly generates specific situations that mimic various types of attacks and unauthorized access to computer systems and networks.

[0630] An "information processing device" is a device that inputs, processes, and outputs data, and includes computers and servers used as training terminals.

[0631] An "emotion recognition device" is a device for collecting and analyzing a user's emotional data, and includes a wearable device, a camera, and dedicated analysis software.

[0632] "Scoring" is the process of analyzing collected data and quantifying and evaluating the performance of training participants.

[0633] "Ranking" refers to arranging training participants in order of evaluation based on the scored results.

[0634] A "feedback report" is a report that notifies training participants of the evaluation results and areas for improvement.

[0635] The present invention relates to a system that generates random security incident scenarios in real time using a generative artificial intelligence model, and combines it with an emotion engine that recognizes user emotions. This system is composed of a server, an information processing device, an emotion recognition device, and a user.

[0636] The server first initializes a generative artificial intelligence model. This model is built using deep learning frameworks such as TensorFlow and PyTorch. Once initialization is complete, the server uses the model to generate random security incident scenarios. These scenarios mimic various types of attacks and unauthorized access to computer systems and networks, providing specific situations in real time.

[0637] Based on the generated security incident scenario, the server launches attacks against information processing devices over the network. These attacks are unpredictable, creating a realistic sense of tension for participants.

[0638] When an attack is launched, the server collects the reaction and response data from the information processing device. It also collects the user's emotional data obtained from the emotion recognition device. This data includes the user's stress level and motivation. The server analyzes the collected data and evaluates the training participant's performance.

[0639] After the analysis, the server scores the training participants' performance and generates a ranking. The server also notifies the participants of these scores and rankings and provides them as a feedback report, allowing them to understand their security response capabilities and emotional management skills and understand areas for improvement.

[0640] The user starts training using the information processing device and emotion recognition device. Once training begins, the user receives attack scenarios from the server and must respond in real time. For example, if a ransomware attack scenario occurs, the user must stop suspicious processes and run security software.

[0641] Furthermore, the emotion recognition device collects user emotional data in real time, detecting the user's stress level and motivation during training, allowing for evaluation of the user's ability to respond in more realistic situations.

[0642] As a concrete example, consider a ransomware attack scenario. The server initializes a generative artificial intelligence model using TensorFlow, randomly selects "ransomware attack," and generates a scenario. Based on this scenario, the server launches a virtual ransomware attack on an information processing device.

[0643] The user begins training using the information processing device and emotion recognition device, and responds appropriately to sudden ransomware warnings. This response includes terminating suspicious processes and running security software. During training, the emotion recognition device detects the user's stress level and motivation in real time.

[0644] After the training is complete, the server collects and analyzes the user's reaction and emotional data. Finally, it scores and ranks the user based on the analysis results and notifies them to the user. Based on the feedback, the user can understand how to improve their response skills and emotional management.

[0645] The system maximizes the realism of training and learning effectiveness by providing unpredictable security incident scenarios in real time and recognizing and reflecting user emotions in evaluations. It also incorporates game elements to increase participant engagement.

[0646] Example prompt sentence:

[0647] 1. "Please tell me how attack scenarios are generated in the real-time security assessment system."

[0648] 2. "Please explain the details of your security training system, including user sentiment data."

[0649] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0650] Step 1:

[0651] The server initializes the generative artificial intelligence model.

[0652] Input: Parameter files for the model and libraries required for initialization (e.g. TensorFlow or PyTorch).

[0653] Data processing: Load model parameters and initialize the model.

[0654] Output: An initialized generative artificial intelligence model.

[0655] Specific operation: The server loads the model parameter file saved in advance and builds a generative AI model based on it. Next, it loads the necessary libraries (TensorFlow and PyTorch) and initializes the model.

[0656] Step 2:

[0657] The server generates random security incident scenarios using the initialized generative artificial intelligence model.

[0658] Input: An initialized generative artificial intelligence model, a library of security incident scenarios (ransomware attacks, phishing attacks, etc.).

[0659] Data processing: Introduce randomness into the model to generate security incident scenarios.

[0660] Output: Generated security incident scenarios.

[0661] How it works: The server inputs specific parameters into the initialized model and generates random scenarios, such as ransomware attacks and phishing attacks.

[0662] Step 3:

[0663] The server executes an attack on the information processing device based on the generated security incident scenario.

[0664] Input: Generated security incident scenario, IP address and connection information of information processing device.

[0665] Data processing: Create attack packets according to the scenario and send them over the network.

[0666] Output: Execution of an attack against information processing equipment.

[0667] Specific operation: The server creates an attack packet based on the scenario and sends it to the information processing device. For example, in the case of a ransomware attack, it sends a virtual ransomware payload to the information processing device.

[0668] Step 4:

[0669] The server collects the reaction and response data from the information processing device, and the emotion data obtained from the emotion recognition device.

[0670] Input: System log of the information processing device after the attack, emotion data from the emotion recognition device.

[0671] Data processing: Collecting log data and sentiment data and converting them into an analyzable format.

[0672] Output: Reaction and sentiment data in a parsable format.

[0673] Specific operation: The server collects system logs from the information processing device and extracts data necessary for analyzing responses to attacks. At the same time, it collects user emotion data obtained from the emotion recognition device.

[0674] Step 5:

[0675] The server analyzes the collected data and scores the performance of the training participants.

[0676] Input: Reaction and emotion data in a parsable format.

[0677] Data processing: Analyze the data using data mining and machine learning algorithms to calculate a score.

[0678] Output: Performance scores of training participants.

[0679] Specific operation: The server analyzes the collected data using machine learning algorithms and calculates a performance score based on the training participants' reactions and emotional data.

[0680] Step 6:

[0681] The server generates a ranking based on the scoring results and notifies the training participants.

[0682] Input: Training participant performance scores.

[0683] Data processing: Training participants are ranked based on their scores.

[0684] Output: Ranking results and feedback report.

[0685] Specific operation: The server generates a ranking based on the performance score and notifies the training participants. Notifications are sent via email or dashboard updates. Users can check their own performance based on this and identify areas for improvement.

[0686] (Application example 2)

[0687] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0688] Conventional security training systems only evaluated users' response capabilities and provided insufficient feedback to provide effective learning. Furthermore, because the evaluation was conducted without taking into account the emotions and stress levels of the training participants, the system lacked realism and limited learning effectiveness. Furthermore, the lack of ingenuity to increase training engagement made it difficult to provide continuous training.

[0689] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 2 is realized by the following means.

[0690] In this invention, the server includes means for initializing a generative AI model, means for generating random security incident scenarios using the generative AI model, means for executing attacks against training terminals based on the security incident scenarios, means for collecting and analyzing reactions and responses from the training terminals, means for scoring and ranking training participants' performance based on the analysis results, means for collecting and analyzing user emotional data from the training terminals, means for notifying training participants of the scoring and analysis, and means for providing feedback and adjusting training content based on the user emotional data. This enables evaluation that takes into account not only the user's response ability but also their emotions, making security training more effective and realistic. Furthermore, incorporating game elements can increase training engagement and promote continuous learning.

[0691] A "generative artificial intelligence model" is an algorithm that learns from multiple data sets and makes predictions and generates information for specific tasks.

[0692] "Security incident scenarios" provide specific real-time situations that mimic various types of attacks and unauthorized access to computer systems and networks.

[0693] A "training terminal" is an information processing device that is subjected to an attack based on a security incident scenario and is used to respond to the attack.

[0694] "Emotional Data" refers to data collected by the emotion recognition engine, including the user's stress level, motivation, etc.

[0695] "Scoring" is the process of numerically evaluating a user's ability to respond.

[0696] "Ranking" refers to the process of ranking based on the scoring results of multiple training participants.

[0697] "Feedback" refers to a report that includes an evaluation of the training content and advice provided to the user based on the analysis results.

[0698] "Game elements" are gamification elements introduced to increase training engagement.

[0699] "Engagement" refers to the level of involvement and enthusiasm that users maintain in the training.

[0700] "Training participant" means a user who receives training using the security training system.

[0701] "Real time" refers to a state in which processing occurs immediately without delay.

[0702] "Analysis" is the process of examining information and drawing conclusions based on collected data.

[0703] The present invention relates to a security training system that uses a generative artificial intelligence model to generate random security incident scenarios in real time and evaluate users' response capabilities and emotions. The system is composed of a server, a training terminal, an emotion engine, and users.

[0704] Server side:

[0705] The server first initializes a generative artificial intelligence model. This AI model is trained using machine learning libraries such as TensorFlow and Keras. The model learns from multiple datasets and generates random security incident scenarios in real time. The generated scenarios include ransomware attacks, phishing attacks, and DDoS attacks.

[0706] After the training scenario is generated, the server executes attacks against the training device based on the scenario. The attacks are unpredictable, providing a realistic sense of tension and learning effect. When the attack is executed, the training device responds and sends the response data to the server.

[0707] At the same time, emotional data from the training participants is collected in real time. The emotion engine uses OpenCV to detect stress levels and motivation from users' facial expressions. This data is sent from the training device to a server and analyzed by an AI model.

[0708] The server scores the performance of the training participants based on the collected response and emotion data. It also generates a ranking based on the scores of multiple training participants and notifies the user. Detailed feedback is provided along with the ranking results. The feedback includes an evaluation of not only response ability but also emotion management.

[0709] What you need to do:

[0710] The user starts training using the training terminal. Based on the security scenarios sent from the server, the user responds in real time. For example, if a ransomware attack scenario occurs, the user stops the suspicious process and runs security software.

[0711] The emotion engine continues to collect user emotion data during training. After training, users can receive feedback from the server to check their performance. Based on this feedback, users can understand how to improve their response skills and emotion management.

[0712] Examples:

[0713] As a concrete example, consider the "phishing email scenario." In this scenario, the server uses an AI model to simulate a phishing email attack. Users use training devices to verify the sender of the email and check the safety of the links. The accuracy and speed of the response are evaluated, and the emotion engine detects stress levels.

[0714] After completing the training, the server provides feedback such as "Response score: 85, Stress level: 0.65," allowing users to understand areas for improvement in their response skills and emotional management.

[0715] Example prompt sentence:

[0716] "Use AI models to generate real-time security incident scenarios and leverage emotion recognition engines to build models that assess users' stress levels and readiness to respond."

[0717] This provides a concrete understanding of how this AI system can make security training more effective.

[0718] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0719] Step 1:

[0720] The server initializes the generative artificial intelligence model. The input used is a pre-trained model file. Based on this, the server initializes the AI ​​model. The output is the initialized AI model.

[0721] Step 2:

[0722] The server generates random security incident scenarios using the initialized AI model. The inputs are the AI ​​model and a dataset of past security incidents and attacks. The AI ​​model extracts important features and generates random security incident scenarios based on those features. The output is the generated security incident scenario.

[0723] Step 3:

[0724] The server executes attacks against the training terminal based on the generated security incident scenario. The input requires the scenario and information about the training terminal. The server analyzes the scenario and sends commands and triggers to the terminal to execute the virtual attack. The output is the state of the training terminal when the attack is executed.

[0725] Step 4:

[0726] The training terminal collects responses made by users to virtual attacks from the server. The inputs required are attack information from the server and user operation information. The terminal captures user operation logs and reactions in real time. The output is the collected response data.

[0727] Step 5:

[0728] The device collects the user's emotional data in real time. The input requires data from sensor devices such as cameras and microphones. The emotion engine analyzes this data and generates emotional data such as stress level and motivation. The output is the analyzed emotional data.

[0729] Step 6:

[0730] The server receives the reaction data and emotion data collected from the training device. The reaction data and emotion data are required as input. The server analyzes these data with an AI model to evaluate the user's response ability and emotional state. The output is a performance score, which is the analysis result.

[0731] Step 7:

[0732] The server scores users' performance based on the analysis results and generates rankings. The analysis results are required as input. The server calculates the scores and creates rankings based on the scores of multiple users. The output is the scoring and ranking results.

[0733] Step 8:

[0734] The server notifies the user of the scoring and ranking results. The inputs required are the scoring and ranking results. The server generates this information as a feedback report and sends it to the user via the training terminal. The output is the feedback report received by the user.

[0735] Step 9:

[0736] Users review the feedback report to understand areas for improvement in their response skills and emotional management. The input required is the feedback report. Users use the feedback to learn and improve their future responses. The output is the user's improved response skills and emotional management.

[0737] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0738] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0739] In the above embodiment, an example in which the specific processing is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the smart glasses 214.

[0740] [Third embodiment]

[0741] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[0742] 5, the data processing system 310 includes the data processing device 12 and a headset type terminal 314. An example of the data processing device 12 is a server.

[0743] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0744] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[0745] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0746] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0747] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0748] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0749] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0750] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0751] In the headset type terminal 314, a reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0752] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the headset type terminal 314 will be referred to as the "terminal."

[0753] The present invention relates to a system that uses a generative artificial intelligence model to generate random security incident scenarios in real time and execute attacks against training terminals. The system mainly consists of a server, a training terminal, and a user.

[0754] Server-side processing

[0755] The server first initializes a generative AI model. This model is an AI algorithm that learns from multiple data sets and makes predictions and generates responses to specific tasks. After initialization is complete, the server uses the model to generate random security incident scenarios. These scenarios simulate various types of attacks and unauthorized access to computer systems and networks, and provide specific situations in real time.

[0756] Based on the generated security incident scenario, the server executes attacks on the training terminals over the network. These attacks are random and unpredictable, creating a realistic sense of tension for the training participants.

[0757] After the attack is carried out, the server collects and analyzes the reactions and responses from the training devices. After the analysis, the server scores the participants' performance and generates a ranking. The generated scores and rankings are then notified to the participants, allowing them to evaluate their own response capabilities and identify areas for improvement.

[0758] User processing

[0759] The user starts training using the training terminal. Once the training starts, the server sends a scenario-based attack to the user, and the user must respond in real time. For example, if a ransomware attack scenario occurs, the user must stop any suspicious processes and run security software.

[0760] After completing the training, users receive feedback from the server and can check their performance, enabling them to acquire even higher security response capabilities. The incorporation of game elements also increases the engagement of participants and maximizes learning effectiveness.

[0761] Specific examples

[0762] As a concrete example, consider the case of a ransomware attack scenario. The server initializes the generative AI model and randomly selects "ransomware attack" to create a scenario. Based on this scenario, the server launches a virtual ransomware attack on a training device.

[0763] Users begin training on a training device and take appropriate action in response to a ransomware warning that suddenly appears. These actions include terminating suspicious processes and running security software. After completing the training, users check the feedback and ranking sent from the server to understand their own response capabilities.

[0764] In this way, the system of the present invention maximizes the realism of the training and the learning effect by providing unpredictable security incident scenarios in real time. In addition, the introduction of game elements can increase the engagement of training participants.

[0765] The processing flow will be explained below.

[0766] Step 1:

[0767] The server initializes the generative AI model. Specifically, it loads the pre-trained generative AI model into memory space and sets the necessary parameters (e.g., attack start time, attack frequency, etc.).

[0768] Step 2:

[0769] The server generates random security incident scenarios using a generative AI model. The server generates scenarios from the AI ​​model based on triggers and converts them into a format that the system can interpret.

[0770] Step 3:

[0771] The server executes attacks against the training terminals over the network based on the generated security scenario, and the attacks are initiated at the specified timing.

[0772] Step 4:

[0773] The terminal receives and displays an alert based on the attack scenario sent from the server. The alert triggers the terminal to prompt the user to take countermeasures.

[0774] Step 5:

[0775] The user can take appropriate countermeasures based on the alert displayed on the device, such as stopping suspicious processes or running security software.

[0776] Step 6:

[0777] The server collects response and response data from the training devices, including the time taken and success or failure of response actions.

[0778] Step 7:

[0779] The server analyzes the collected data and evaluates the training participants' performance, using a scoring algorithm to calculate a score based on the speed and accuracy of their responses.

[0780] Step 8:

[0781] The server generates scores and rankings for the participants based on the analysis results. The rankings are used to foster a sense of competition among the participants.

[0782] Step 9:

[0783] The server notifies the training participants of the generated scores and rankings, and provides detailed feedback on their individual performance in a post-training feedback report.

[0784] Example 1

[0785] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0786] In today's information society, there is an urgent need to develop human resources with the skills to respond quickly and appropriately to increasingly complex and diverse cyber attacks. However, conventional training systems have problems such as predictable scenarios and a lack of real-time response, making it difficult to adequately train response capabilities to actual threats. Furthermore, they lack the means to increase participant engagement, limiting the learning effect.

[0787] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0788] In this invention, the server includes means for initializing a generated artificial intelligence model, means for generating random security incident scenarios using the generated artificial intelligence model, means for executing attacks on the training information processing device based on the security incident scenarios, means for collecting and analyzing reactions and responses from the training information processing device, means for scoring and ranking the work performance of training participants based on the analysis results, means for notifying the training participants of the scores and rankings, means for storing the reaction data of the training participants in a database, means for having a data analysis tool for analysis using the data and for evaluating the response speed and accuracy of the training participants, means for using a model for scoring the work performance of the training participants, means for displaying the feedback content on a display device of the training information processing device, and means for notifying the feedback content by email. This makes it possible to provide unpredictable security incident scenarios in real time and improve the practical response ability and engagement of participants.

[0789] A "generated artificial intelligence model" is an algorithm that learns from various data and generates predictions and scenarios for specific tasks.

[0790] "Means for initialization" refers to the means for carrying out preparatory work to put the generated artificial intelligence model into operation, and refers to the process of loading the model and making the necessary settings.

[0791] A "security incident scenario" is a hypothetical incident that mimics various threats to information systems, such as attacks over networks and unauthorized access.

[0792] A "training information processing device" is a computer device operated by participants receiving security training, and operates based on instructions from a server.

[0793] A "training participant" is a user who takes part in a security training and deals with a scenario while operating a training information processing device.

[0794] The "means for collecting and analyzing reactions and responses" refers to the process of collecting log data from the training information processing device and analyzing the data to evaluate the participants' responses based on that data.

[0795] The "means for scoring business performance and generating rankings" refers to a means for quantifying the speed and accuracy of participants' responses based on collected data and ranking the performance of all participants.

[0796] "Data analysis tools" are software or libraries used to analyze collected data, including, for example, Python's Pandas and Scikit-learn.

[0797] The "means for displaying feedback content" is a means for displaying the scoring results and rankings of each participant on the screen of the training information processing device after the training is completed.

[0798] "Means of notifying by email" refers to a means of notifying participants of the results of scoring and ranking via email.

[0799] A "database" is a data management system that stores collected data and analysis results and allows access as needed.

[0800] MODE FOR CARRYING OUT THE INVENTION

[0801] The present invention relates to a system that generates random security incident scenarios in real time using a generative AI model and executes attacks on a training information processing device. Specific embodiments of the system are described below.

[0802] Server configuration and operation

[0803] The server initializes a generative AI model, which is built using machine learning frameworks such as TensorFlow and PyTorch. The server then initializes the model and generates random security incident scenarios, including various types of attacks, such as ransomware attacks, phishing attacks, and DDoS attacks.

[0804] To generate a security incident scenario, follow these steps:

[0805] The server inputs appropriate prompt sentences into the generative AI model and generates a scenario.

[0806] For example, use the following prompt:

[0807] Use a generative AI model to generate a real-time ransomware attack scenario and launch it on designated training devices. After the attack, collect device responses and score participants' performance.

[0808] Based on the generated security incident scenarios, the server launches attacks on the training information processing devices over the network. These attacks are carried out in real time, and the aim is for the training participants to respond to unpredictable situations.

[0809] The role of training information processing equipment

[0810] The training information processing device is installed with software that receives and responds to attacks based on scenarios sent from the server in real time. Training participants use this device to respond to actual security incidents. For example, in the event of a ransomware attack, they will respond by identifying and terminating suspicious processes on the device.

[0811] User operations

[0812] The user operates the training information processing device and responds to real-time attacks from the server. When the training begins, the user receives attacks based on the scenario and must take appropriate action. For example, the user is required to stop suspicious processes or run security software to prevent infection.

[0813] Data collection and analysis

[0814] The server collects reaction and response data sent from the training information processing device in real time. This data is analyzed using data analysis tools such as Python's Pandas and Scikit-learn. Specifically, the analysis involves analyzing what operations the training participants performed and when, and recording the results in a log.

[0815] Scoring and Feedback

[0816] The server scores the work performance of the training participants based on the collected data and generates a ranking. This scoring is performed to evaluate each participant's response speed and accuracy. The generated scores and rankings are displayed on the display device of the training information processing device from the server. Feedback is also sent by email as needed.

[0817] Specific examples

[0818] As a concrete example, consider the case of a ransomware attack scenario. The server initializes a generative AI model and generates a ransomware attack scenario. Based on this scenario, a virtual ransomware attack is launched against a training information processing device. The user begins training on the training information processing device and takes appropriate countermeasures in response to the ransomware warning that suddenly appears. After the training is complete, the server analyzes the user's response and provides the results as feedback. The feedback includes a score and ranking, which the user can use to evaluate their own response.

[0819] In this way, the system of the present invention can maximize the realism of the training and the learning effect by providing unpredictable security incident scenarios in real time. In addition, the incorporation of game elements can increase the engagement of training participants.

[0820] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0821] Step 1:

[0822] The server initializes the generative AI model. First, it loads a pre-trained model using a machine learning framework such as TensorFlow or PyTorch. This is done using functions such as tensorflow.keras.models.load_model. During this initialization process, it logs the time it takes to load the model and the memory usage. The input is the pre-saved model file, and the output is the initialized AI model.

[0823] Specific operation:

[0824] The server calls the load_model function to load the model file.

[0825] Use the logging module to log that the model has finished loading.

[0826] Step 2:

[0827] The server generates security incident scenarios using the initialized generative AI model. Random prompt sentences are input into the generative AI model to generate various security incident scenarios. For example, a prompt sentence that generates a "ransomware attack scenario" is input. The input of this process is the prompt sentence, and the output is the generated security incident scenario.

[0828] Specific operation:

[0829] The server generates a prompt sentence and feeds it into the AI ​​model.

[0830] A generative AI model generates scenarios and logs their contents.

[0831] Step 3:

[0832] The server executes an attack on the training information processing device based on the generated security incident scenario. Specifically, it sends attack packets to specified ports and IP addresses according to the attack method defined in the scenario. The input to this process is the generated security incident scenario, and the output is a transmission log of the attack packets.

[0833] Specific operation:

[0834] The server creates appropriate attack packets based on the scenario.

[0835] The IP address and port of the training information processing device are specified and attack packets are sent.

[0836] Log details of the attack packets sent.

[0837] Step 4:

[0838] The terminal receives the attack from the server and records the reaction and response in a log, which includes actions such as stopping suspicious processes and running security software. The input to this process is the attack from the server, and the output is a log file recording the response.

[0839] Specific operation:

[0840] The terminal monitors and receives attack packets from the server.

[0841] Log the actions taken by the user and send the log to a server.

[0842] Step 5:

[0843] The server collects the log data sent from the training information processing device and performs data analysis. This analysis uses Python's Pandas and Scikit-learn. Based on the collected data, it analyzes the timestamp of each operation and the status of process stoppages. The input to this process is the corresponding log sent from the training information processing device, and the output is the analysis results.

[0844] Specific operation:

[0845] The server receives the log data transmitted from the training information processing device and stores it in a database.

[0846] Analyze the saved data using Pandas and Scikit-learn.

[0847] Step 6:

[0848] Based on the analysis results, the server scores the work performance of the training participants and generates a ranking of all participants. The results are a numerical evaluation of each participant's response speed and accuracy. The input to this process is the analysis results, and the output is a score and ranking.

[0849] Specific operation:

[0850] The server uses Scikit-learn to run a scoring model for each participant and evaluate their business performance.

[0851] The scores of all participants are compared and a ranking is generated.

[0852] Step 7:

[0853] The server notifies the training participants of the scoring and ranking results. Notification methods include email and the display device of the training information processing device. The input to this process is the scoring and ranking results, and the output is the notified feedback.

[0854] Specific operation:

[0855] The server uses the scoring results and rankings to create feedback content.

[0856] The created feedback content is sent by email and is also displayed on the display device of the training information processing device.

[0857] In this way, the system of the present invention cultivates advanced security response capabilities through detailed procedures and real-time attack simulations. Furthermore, by combining data analysis and feedback, it promotes skill development among participants and enables effective training.

[0858] (Application example 1)

[0859] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0860] In today's world, cyber attacks are becoming increasingly complex and diverse, creating a need for security training in realistic environments. However, conventional security training systems use fixed scenarios, resulting in insufficient preparation for actual attacks. Furthermore, there are issues with low engagement among training participants, making it difficult to maximize learning outcomes. To address these issues, a new method is needed to provide random security incident scenarios in real time and improve users' response capabilities.

[0861] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0862] In this invention, the server includes means for initializing a generative artificial intelligence model, means for generating random security incident scenarios using the generative artificial intelligence model, means for executing attacks on training terminals based on the security incident scenarios, means for collecting and analyzing reactions and responses from the training terminals, means for scoring and generating rankings of training participants' performance based on the analysis results, means for notifying the training participants of the scoring and rankings, means for providing the security incident scenarios in real time using a smartphone and collecting user responses, and means for analyzing the responses on a cloud server and generating feedback. This enables training in security scenarios that change in real time, thereby improving users' ability to respond quickly and accurately to actual cyber attacks.

[0863] A "generative artificial intelligence model" is a type of artificial intelligence that has the ability to generate new information and scenarios based on various data.

[0864] A "security incident scenario" is a hypothetical situation that mimics potential attacks or unauthorized access to computer systems or networks.

[0865] A "training terminal" is a device such as a computer or smartphone used to conduct security training.

[0866] "Scoring" is the process of quantifying and evaluating the response capabilities of training participants.

[0867] The "ranking" refers to the ranking of the training participants' performance based on the scored results.

[0868] A "smartphone" is a small computer that can run a variety of applications in addition to the functions of a mobile phone.

[0869] "Cloud server" refers to a virtualized infrastructure of servers that are available remotely over the internet.

[0870] "Real-time" means that processing or information is provided immediately in actual time.

[0871] "Feedback" refers to information indicating evaluations and areas for improvement provided after analyzing the results of training participants' responses.

[0872] "Engagement" means that participants remain actively involved and interested in the training.

[0873] MODE FOR CARRYING OUT THE INVENTION

[0874] System Overview

[0875] This invention is a system that generates security incident scenarios in real time and conducts simulated attacks on users' smartphones to train them on security measures. This system mainly consists of a server, a smartphone (training terminal), and a user.

[0876] Server-side processing

[0877] Initialization

[0878] The server first initializes a generative artificial intelligence model, which has the ability to generate new security incident scenarios based on various data using the generative AI model.

[0879] Scenario Generation

[0880] The server inputs the following prompt to the generative AI model:

[0881] "Generate a randomly selected cyber attack scenario. The scenario will be output in the following format: Attack type: [Type], Attack method: [Method], Attack route: [Route], Countermeasure: [Countermeasure]"

[0882] The generative AI model generates random security incident scenarios based on this prompt.

[0883] Scenario distribution and attack execution

[0884] The generated scenario is sent to the smartphone in real time, and a simulated attack is executed. For example, if the scenario is "Attack type: malware, Attack method: phishing email, Attack route: unknown link, Action: delete suspicious email and activate security software," the smartphone will receive a phishing email.

[0885] Processing on the smartphone side

[0886] Reactions and responses

[0887] Users must use their smartphones to respond quickly and appropriately to simulated attacks based on the scenario, such as deleting suspicious links and activating security software.

[0888] Data collection

[0889] The smartphone collects the user's responses and sends them to a server, which evaluates the user's actual countermeasure actions.

[0890] Server-side analysis and feedback

[0891] Data analysis

[0892] The server analyzes the user's response data sent from the smartphone and scores the user's performance. The analysis is performed using a cloud server and advanced data analysis algorithms.

[0893] Evaluation and Notification

[0894] Based on the scoring results, users' performance is displayed in a ranking format, allowing them to understand their own response capabilities.

[0895] Specific examples

[0896] In the system of the present invention, as a specific example, the following prompt sentence is input to the generative AI model:

[0897] "Generate a randomly selected cyber attack scenario. The scenario will be output in the following format: Attack type: Malware, Attack method: Phishing email, Attack route: Unknown link, Action to take: Delete the suspicious email and launch security software."

[0898] This allows the generative AI model to generate random security scenarios like those described above, enabling realistic training on a smartphone.

[0899] Through this system, users can conduct practical response training for unpredictable security incident scenarios and effectively improve their security response capabilities.

[0900] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0901] Step 1:

[0902] The server initializes the generated AI model

[0903] Input: Initial setting data for the generative AI model

[0904] Specific operation: The server reads the initialization file of the generative AI model and initializes the model, which includes setting model parameters and preparing training data.

[0905] Output: An initialized generative AI model

[0906] Step 2:

[0907] The server generates security incident scenarios

[0908] Input: Initialized generative AI model, prompt

[0909] Specific operation: The server inputs the following prompt to the generative AI model:

[0910] "Generate a randomly selected cyber attack scenario. The scenario will be output in the following format: Attack type: [Type], Attack method: [Method], Attack route: [Route], Countermeasure: [Countermeasure]"

[0911] Data processing and calculation: The generative AI model generates random security incident scenarios based on prompt statements.

[0912] Output: Generated security incident scenario

[0913] Step 3:

[0914] The server distributes the scenario and executes the attack.

[0915] Input: Generated security incident scenario

[0916] Specific operation: The server delivers the generated scenario to the smartphone in real time, after which a pseudo-attack based on the scenario is executed.

[0917] Output: Security incident scenarios and simulated attacks delivered to the user's smartphone

[0918] Step 4:

[0919] Users respond on their smartphones

[0920] Input: Security incident scenarios and simulated attacks delivered to smartphones

[0921] Specific actions: The user takes action based on the security scenario on their smartphone, for example, deleting a suspicious link or launching security software.

[0922] Output: User's response action

[0923] Step 5:

[0924] The smartphone collects the corresponding data and sends it to the server.

[0925] Input: User action

[0926] Specific operation: The smartphone collects data on the actions taken by the user and sends it to the server in real time.

[0927] Output: Corresponding data sent to the server

[0928] Step 6:

[0929] The server analyzes the corresponding data

[0930] Input: Corresponding data sent from the smartphone

[0931] How it works: The server analyzes the response data and scores the user's performance. The analysis uses machine learning algorithms to evaluate the speed and accuracy of the user's response.

[0932] Output: Scoring results

[0933] Step 7:

[0934] The server reflects the scoring results in the rankings.

[0935] Input: Scoring results

[0936] Specific operation: The server generates a ranking based on the scores of all users. The ranking indicates each user's ability and displays their relative position.

[0937] Output: The generated rankings

[0938] Step 8:

[0939] The server notifies the user of the ranking and feedback

[0940] Input: Generated rankings, parsed feedback information

[0941] Specific operation: The server notifies the user of the generated ranking and feedback information via their smartphone. The feedback includes specific improvements and evaluation comments.

[0942] Output: Ranking and feedback given to the user

[0943] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[0944] The present invention relates to a system that uses a generative artificial intelligence model to generate random security incident scenarios in real time, and combines it with an emotion engine that recognizes user emotions. The system is composed of a server, a training terminal, an emotion engine, and a user.

[0945] Server-side processing

[0946] The server first initializes a generative AI model. This model is an AI algorithm that learns from multiple data sets and makes predictions and generates responses to specific tasks. After initialization is complete, the server uses the model to generate random security incident scenarios. These scenarios simulate various types of attacks and unauthorized access to computer systems and networks, and provide specific situations in real time.

[0947] Based on the generated security incident scenario, the server executes attacks on the training terminals over the network. These attacks are random and unpredictable, creating a realistic sense of tension for the training participants.

[0948] After the attack is launched, the server collects the reactions and responses from the training devices, along with the users' emotional data obtained from the emotion engine. The emotional data includes the users' stress levels and motivation. The server analyzes this data and evaluates the training participants' performance.

[0949] After the analysis, the server scores the participants' performance and generates a ranking. The server then notifies the participants of these scores and rankings and provides them as a feedback report. This allows participants to understand not only their own response abilities but also their overall performance, including their emotions, and identify areas for improvement.

[0950] User processing

[0951] The user starts training using the training device and emotion engine. Once training begins, the server receives attacks based on the scenario and the user must respond in real time. For example, if a ransomware attack scenario occurs, the user must stop suspicious processes and run security software.

[0952] Furthermore, the emotion engine collects user emotional data in real time, detecting the user's stress level and motivation during training to evaluate their ability to respond in more realistic situations, further enhancing the realism of training and learning effectiveness.

[0953] After completing the training, users receive feedback from the server to check their performance, which allows them to acquire higher security response and emotional management skills.

[0954] Specific examples

[0955] As a concrete example, consider a ransomware attack scenario. The server initializes the generative AI model and randomly selects "ransomware attack" to create a scenario. Based on this scenario, the server launches a virtual ransomware attack on a training device.

[0956] The user begins training using a training device and the emotion engine, and takes appropriate action in response to a sudden ransomware warning. These actions include terminating suspicious processes and running security software. During the training, the emotion engine detects the user's stress level and motivation in real time.

[0957] After training is complete, the server collects and analyzes the user's reaction and emotional data. Finally, it scores and ranks the user based on the analysis results and notifies them to the user. Based on the feedback, the user can understand how to improve their response skills and emotional management.

[0958] In this way, the system of the present invention not only provides unpredictable security incident scenarios in real time, but also maximizes the realism of the training and the learning effect by recognizing and reflecting the user's emotions in the evaluation. Furthermore, the introduction of game elements can increase the engagement of training participants.

[0959] The processing flow will be explained below.

[0960] Step 1:

[0961] The server initializes the generative AI model. Specifically, it loads the pre-trained generative AI model into memory space and sets the necessary parameters (e.g., attack start time, attack frequency, etc.).

[0962] Step 2:

[0963] The server generates random security incident scenarios using a generative AI model. The server generates scenarios from the AI ​​model based on triggers and converts them into a format that the system can interpret.

[0964] Step 3:

[0965] The server executes attacks against the training terminals over the network based on the generated security scenarios. The attack scenarios are random and unpredictable.

[0966] Step 4:

[0967] The server initializes the emotion engine and prepares it for real-time recognition of the user's emotions. The emotion engine collects emotion data by detecting the user's facial expressions, tone of voice, body temperature, etc.

[0968] Step 5:

[0969] The terminal receives and displays alerts based on attack scenarios sent from the server, which indicate the specific type of attack and suggest countermeasures.

[0970] Step 6:

[0971] The user can take appropriate countermeasures based on the alert displayed on the device, such as stopping suspicious processes or running security software.

[0972] Step 7:

[0973] The device records the user's response actions and sends them to the server, along with the user's emotion data collected by the emotion engine.

[0974] Step 8:

[0975] The server collects and analyzes data sent from the training terminals and emotional data from the emotion engine, including the time taken to take action, success / failure information, and the user's emotional state.

[0976] Step 9:

[0977] The server scores the training participants' performance based on the results of the data analysis, and also evaluates them by taking into account their emotional data, resulting in a comprehensive score.

[0978] Step 10:

[0979] The server generates a ranking based on the analysis results and notifies the training participants, which includes feedback based on each participant's score and emotional data.

[0980] Step 11:

[0981] Users receive feedback reports from the server and see specific advice on their performance and emotional state, allowing them to understand how to improve for their next training session.

[0982] Example 2

[0983] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[0984] Conventional security training systems rely on specific scenarios and fixed attack patterns, which limits the effectiveness of training and prevents training participants from fully improving their ability to respond to real security risks. Furthermore, they do not take into account the emotions and stress levels of users during training, making it difficult to evaluate training in a realistic situation. Furthermore, they do not provide immediate feedback, making it difficult to maintain participants' motivation.

[0985] The specific processing by the specific processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means.

[0986] In this invention, the server includes means for initializing a generative AI model, means for generating random security incident scenarios using the generative AI model, means for executing attacks against an information processing device based on the security incident scenarios, means for collecting and analyzing reactions and responses from the information processing device and emotion data acquired from an emotion recognition device, means for scoring and ranking training participants' performance based on the analysis results, and means for notifying training participants of the scoring and ranking. This enables users to improve their ability to respond to a variety of realistic security incident scenarios and enables comprehensive evaluation that takes emotion data into account. Furthermore, immediate feedback can maintain training participants' motivation, enabling more effective training.

[0987] A "generative artificial intelligence model" is an artificial intelligence algorithm that learns from multiple data sets and makes predictions and generates responses to specific tasks.

[0988] A "random security incident scenario" is a scenario that randomly generates specific situations that mimic various types of attacks and unauthorized access to computer systems and networks.

[0989] An "information processing device" is a device that inputs, processes, and outputs data, and includes computers and servers used as training terminals.

[0990] An "emotion recognition device" is a device for collecting and analyzing a user's emotional data, and includes a wearable device, a camera, and dedicated analysis software.

[0991] "Scoring" is the process of analyzing collected data and quantifying and evaluating the performance of training participants.

[0992] "Ranking" refers to arranging training participants in order of evaluation based on the scored results.

[0993] A "feedback report" is a report that notifies training participants of the evaluation results and areas for improvement.

[0994] The present invention relates to a system that generates random security incident scenarios in real time using a generative artificial intelligence model, and combines it with an emotion engine that recognizes user emotions. This system is composed of a server, an information processing device, an emotion recognition device, and a user.

[0995] The server first initializes a generative artificial intelligence model. This model is built using deep learning frameworks such as TensorFlow and PyTorch. Once initialization is complete, the server uses the model to generate random security incident scenarios. These scenarios mimic various types of attacks and unauthorized access to computer systems and networks, providing specific situations in real time.

[0996] Based on the generated security incident scenario, the server launches attacks against information processing devices over the network. These attacks are unpredictable, creating a realistic sense of tension for participants.

[0997] When an attack is launched, the server collects the reaction and response data from the information processing device. It also collects the user's emotional data obtained from the emotion recognition device. This data includes the user's stress level and motivation. The server analyzes the collected data and evaluates the training participant's performance.

[0998] After the analysis, the server scores the training participants' performance and generates a ranking. The server also notifies the participants of these scores and rankings and provides them as a feedback report, allowing them to understand their security response capabilities and emotional management skills and understand areas for improvement.

[0999] The user starts training using the information processing device and emotion recognition device. Once training begins, the user receives attack scenarios from the server and must respond in real time. For example, if a ransomware attack scenario occurs, the user must stop suspicious processes and run security software.

[1000] Furthermore, the emotion recognition device collects user emotional data in real time, detecting the user's stress level and motivation during training, allowing for evaluation of the user's ability to respond in more realistic situations.

[1001] As a concrete example, consider a ransomware attack scenario. The server initializes a generative artificial intelligence model using TensorFlow, randomly selects "ransomware attack," and generates a scenario. Based on this scenario, the server launches a virtual ransomware attack on an information processing device.

[1002] The user begins training using the information processing device and emotion recognition device, and responds appropriately to sudden ransomware warnings. This response includes terminating suspicious processes and running security software. During training, the emotion recognition device detects the user's stress level and motivation in real time.

[1003] After the training is complete, the server collects and analyzes the user's reaction and emotional data. Finally, it scores and ranks the user based on the analysis results and notifies them to the user. Based on the feedback, the user can understand how to improve their response skills and emotional management.

[1004] The system maximizes the realism of training and learning effectiveness by providing unpredictable security incident scenarios in real time and recognizing and reflecting user emotions in evaluations. It also incorporates game elements to increase participant engagement.

[1005] Example prompt sentence:

[1006] 1. "Please tell me how attack scenarios are generated in the real-time security assessment system."

[1007] 2. "Please explain the details of your security training system, including user sentiment data."

[1008] The flow of the identification process in the second embodiment will be described with reference to FIG.

[1009] Step 1:

[1010] The server initializes the generative artificial intelligence model.

[1011] Input: Parameter files for the model and libraries required for initialization (e.g. TensorFlow or PyTorch).

[1012] Data processing: Load model parameters and initialize the model.

[1013] Output: An initialized generative artificial intelligence model.

[1014] Specific operation: The server loads the model parameter file saved in advance and builds a generative AI model based on it. Next, it loads the necessary libraries (TensorFlow and PyTorch) and initializes the model.

[1015] Step 2:

[1016] The server generates random security incident scenarios using the initialized generative artificial intelligence model.

[1017] Input: An initialized generative artificial intelligence model, a library of security incident scenarios (ransomware attacks, phishing attacks, etc.).

[1018] Data processing: Introduce randomness into the model to generate security incident scenarios.

[1019] Output: Generated security incident scenarios.

[1020] How it works: The server inputs specific parameters into the initialized model and generates random scenarios, such as ransomware attacks and phishing attacks.

[1021] Step 3:

[1022] The server executes an attack on the information processing device based on the generated security incident scenario.

[1023] Input: Generated security incident scenario, IP address and connection information of information processing device.

[1024] Data processing: Create attack packets according to the scenario and send them over the network.

[1025] Output: Execution of an attack against information processing equipment.

[1026] Specific operation: The server creates an attack packet based on the scenario and sends it to the information processing device. For example, in the case of a ransomware attack, it sends a virtual ransomware payload to the information processing device.

[1027] Step 4:

[1028] The server collects the reaction and response data from the information processing device, and the emotion data obtained from the emotion recognition device.

[1029] Input: System log of the information processing device after the attack, emotion data from the emotion recognition device.

[1030] Data processing: Collecting log data and sentiment data and converting them into an analyzable format.

[1031] Output: Reaction and sentiment data in a parsable format.

[1032] Specific operation: The server collects system logs from the information processing device and extracts data necessary for analyzing responses to attacks. At the same time, it collects user emotion data obtained from the emotion recognition device.

[1033] Step 5:

[1034] The server analyzes the collected data and scores the performance of the training participants.

[1035] Input: Reaction and emotion data in a parsable format.

[1036] Data processing: Analyze the data using data mining and machine learning algorithms to calculate a score.

[1037] Output: Performance scores of training participants.

[1038] Specific operation: The server analyzes the collected data using machine learning algorithms and calculates a performance score based on the training participants' reactions and emotional data.

[1039] Step 6:

[1040] The server generates a ranking based on the scoring results and notifies the training participants.

[1041] Input: Training participant performance scores.

[1042] Data processing: Training participants are ranked based on their scores.

[1043] Output: Ranking results and feedback report.

[1044] Specific operation: The server generates a ranking based on the performance score and notifies the training participants. Notifications are sent via email or dashboard updates. Users can check their own performance based on this and identify areas for improvement.

[1045] (Application example 2)

[1046] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1047] Conventional security training systems only evaluated users' response capabilities and provided insufficient feedback to provide effective learning. Furthermore, because the evaluation was conducted without taking into account the emotions and stress levels of the training participants, the system lacked realism and limited learning effectiveness. Furthermore, the lack of ingenuity to increase training engagement made it difficult to provide continuous training.

[1048] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 2 is realized by the following means.

[1049] In this invention, the server includes means for initializing a generative AI model, means for generating random security incident scenarios using the generative AI model, means for executing attacks against training terminals based on the security incident scenarios, means for collecting and analyzing reactions and responses from the training terminals, means for scoring and ranking training participants' performance based on the analysis results, means for collecting and analyzing user emotional data from the training terminals, means for notifying training participants of the scoring and analysis, and means for providing feedback and adjusting training content based on the user emotional data. This enables evaluation that takes into account not only the user's response ability but also their emotions, making security training more effective and realistic. Furthermore, incorporating game elements can increase training engagement and promote continuous learning.

[1050] A "generative artificial intelligence model" is an algorithm that learns from multiple data sets and makes predictions and generates information for specific tasks.

[1051] "Security incident scenarios" provide specific real-time situations that mimic various types of attacks and unauthorized access to computer systems and networks.

[1052] A "training terminal" is an information processing device that is subjected to an attack based on a security incident scenario and is used to respond to the attack.

[1053] "Emotional Data" refers to data collected by the emotion recognition engine, including the user's stress level, motivation, etc.

[1054] "Scoring" is the process of numerically evaluating a user's ability to respond.

[1055] "Ranking" refers to the process of ranking based on the scoring results of multiple training participants.

[1056] "Feedback" refers to a report that includes an evaluation of the training content and advice provided to the user based on the analysis results.

[1057] "Game elements" are gamification elements introduced to increase training engagement.

[1058] "Engagement" refers to the level of involvement and enthusiasm that users maintain in the training.

[1059] "Training participant" means a user who receives training using the security training system.

[1060] "Real time" refers to a state in which processing occurs immediately without delay.

[1061] "Analysis" is the process of examining information and drawing conclusions based on collected data.

[1062] The present invention relates to a security training system that uses a generative artificial intelligence model to generate random security incident scenarios in real time and evaluate users' response capabilities and emotions. The system is composed of a server, a training terminal, an emotion engine, and users.

[1063] Server side:

[1064] The server first initializes a generative artificial intelligence model. This AI model is trained using machine learning libraries such as TensorFlow and Keras. The model learns from multiple datasets and generates random security incident scenarios in real time. The generated scenarios include ransomware attacks, phishing attacks, and DDoS attacks.

[1065] After the training scenario is generated, the server executes attacks against the training device based on the scenario. The attacks are unpredictable, providing a realistic sense of tension and learning effect. When the attack is executed, the training device responds and sends the response data to the server.

[1066] At the same time, emotional data from the training participants is collected in real time. The emotion engine uses OpenCV to detect stress levels and motivation from users' facial expressions. This data is sent from the training device to a server and analyzed by an AI model.

[1067] The server scores the performance of the training participants based on the collected response and emotion data. It also generates a ranking based on the scores of multiple training participants and notifies the user. Detailed feedback is provided along with the ranking results. The feedback includes an evaluation of not only response ability but also emotion management.

[1068] What you need to do:

[1069] The user starts training using the training terminal. Based on the security scenarios sent from the server, the user responds in real time. For example, if a ransomware attack scenario occurs, the user stops the suspicious process and runs security software.

[1070] The emotion engine continues to collect user emotion data during training. After training, users can receive feedback from the server to check their performance. Based on this feedback, users can understand how to improve their response skills and emotion management.

[1071] Examples:

[1072] As a concrete example, consider the "phishing email scenario." In this scenario, the server uses an AI model to simulate a phishing email attack. Users use training devices to verify the sender of the email and check the safety of the links. The accuracy and speed of the response are evaluated, and the emotion engine detects stress levels.

[1073] After completing the training, the server provides feedback such as "Response score: 85, Stress level: 0.65," allowing users to understand areas for improvement in their response skills and emotional management.

[1074] Example prompt sentence:

[1075] "Use AI models to generate real-time security incident scenarios and leverage emotion recognition engines to build models that assess users' stress levels and readiness to respond."

[1076] This provides a concrete understanding of how this AI system can make security training more effective.

[1077] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[1078] Step 1:

[1079] The server initializes the generative artificial intelligence model. The input used is a pre-trained model file. Based on this, the server initializes the AI ​​model. The output is the initialized AI model.

[1080] Step 2:

[1081] The server generates random security incident scenarios using the initialized AI model. The inputs are the AI ​​model and a dataset of past security incidents and attacks. The AI ​​model extracts important features and generates random security incident scenarios based on those features. The output is the generated security incident scenario.

[1082] Step 3:

[1083] The server executes attacks against the training terminal based on the generated security incident scenario. The input requires the scenario and information about the training terminal. The server analyzes the scenario and sends commands and triggers to the terminal to execute the virtual attack. The output is the state of the training terminal when the attack is executed.

[1084] Step 4:

[1085] The training terminal collects responses made by users to virtual attacks from the server. The inputs required are attack information from the server and user operation information. The terminal captures user operation logs and reactions in real time. The output is the collected response data.

[1086] Step 5:

[1087] The device collects the user's emotional data in real time. The input requires data from sensor devices such as cameras and microphones. The emotion engine analyzes this data and generates emotional data such as stress level and motivation. The output is the analyzed emotional data.

[1088] Step 6:

[1089] The server receives the reaction data and emotion data collected from the training device. The reaction data and emotion data are required as input. The server analyzes these data with an AI model to evaluate the user's response ability and emotional state. The output is a performance score, which is the analysis result.

[1090] Step 7:

[1091] The server scores users' performance based on the analysis results and generates rankings. The analysis results are required as input. The server calculates the scores and creates rankings based on the scores of multiple users. The output is the scoring and ranking results.

[1092] Step 8:

[1093] The server notifies the user of the scoring and ranking results. The inputs required are the scoring and ranking results. The server generates this information as a feedback report and sends it to the user via the training terminal. The output is the feedback report received by the user.

[1094] Step 9:

[1095] Users review the feedback report to understand areas for improvement in their response skills and emotional management. The input required is the feedback report. Users use the feedback to learn and improve their future responses. The output is the user's improved response skills and emotional management.

[1096] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[1097] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1098] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the headset type terminal 314.

[1099] [Fourth embodiment]

[1100] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[1101] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[1102] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[1103] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[1104] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[1105] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[1106] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[1107] The control object 443 includes a display device, LEDs in the eyes, and motors for driving the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[1108] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[1109] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[1110] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[1111] In the robot 414, the processor 46 performs the reception output process. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[1112] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1113] The present invention relates to a system that uses a generative artificial intelligence model to generate random security incident scenarios in real time and execute attacks against training terminals. The system mainly consists of a server, a training terminal, and a user.

[1114] Server-side processing

[1115] The server first initializes a generative AI model. This model is an AI algorithm that learns from multiple data sets and makes predictions and generates responses to specific tasks. After initialization is complete, the server uses the model to generate random security incident scenarios. These scenarios simulate various types of attacks and unauthorized access to computer systems and networks, and provide specific situations in real time.

[1116] Based on the generated security incident scenario, the server executes attacks on the training terminals over the network. These attacks are random and unpredictable, creating a realistic sense of tension for the training participants.

[1117] After the attack is carried out, the server collects and analyzes the reactions and responses from the training devices. After the analysis, the server scores the participants' performance and generates a ranking. The generated scores and rankings are then notified to the participants, allowing them to evaluate their own response capabilities and identify areas for improvement.

[1118] User processing

[1119] The user starts training using the training terminal. Once the training starts, the server sends a scenario-based attack to the user, and the user must respond in real time. For example, if a ransomware attack scenario occurs, the user must stop any suspicious processes and run security software.

[1120] After completing the training, users receive feedback from the server and can check their performance, enabling them to acquire even higher security response capabilities. The incorporation of game elements also increases the engagement of participants and maximizes learning effectiveness.

[1121] Specific examples

[1122] As a concrete example, consider the case of a ransomware attack scenario. The server initializes the generative AI model and randomly selects "ransomware attack" to create a scenario. Based on this scenario, the server launches a virtual ransomware attack on a training device.

[1123] Users begin training on a training device and take appropriate action in response to a ransomware warning that suddenly appears. These actions include terminating suspicious processes and running security software. After completing the training, users check the feedback and ranking sent from the server to understand their own response capabilities.

[1124] In this way, the system of the present invention maximizes the realism of the training and the learning effect by providing unpredictable security incident scenarios in real time. In addition, the introduction of game elements can increase the engagement of training participants.

[1125] The processing flow will be explained below.

[1126] Step 1:

[1127] The server initializes the generative AI model. Specifically, it loads the pre-trained generative AI model into memory space and sets the necessary parameters (e.g., attack start time, attack frequency, etc.).

[1128] Step 2:

[1129] The server generates random security incident scenarios using a generative AI model. The server generates scenarios from the AI ​​model based on triggers and converts them into a format that the system can interpret.

[1130] Step 3:

[1131] The server executes attacks against the training terminals over the network based on the generated security scenario, and the attacks are initiated at the specified timing.

[1132] Step 4:

[1133] The terminal receives and displays an alert based on the attack scenario sent from the server. The alert triggers the terminal to prompt the user to take countermeasures.

[1134] Step 5:

[1135] The user can take appropriate countermeasures based on the alert displayed on the device, such as stopping suspicious processes or running security software.

[1136] Step 6:

[1137] The server collects response and response data from the training devices, including the time taken and success or failure of response actions.

[1138] Step 7:

[1139] The server analyzes the collected data and evaluates the training participants' performance, using a scoring algorithm to calculate a score based on the speed and accuracy of their responses.

[1140] Step 8:

[1141] The server generates scores and rankings for the participants based on the analysis results. The rankings are used to foster a sense of competition among the participants.

[1142] Step 9:

[1143] The server notifies the training participants of the generated scores and rankings, and provides detailed feedback on their individual performance in a post-training feedback report.

[1144] Example 1

[1145] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1146] In today's information society, there is an urgent need to develop human resources with the skills to respond quickly and appropriately to increasingly complex and diverse cyber attacks. However, conventional training systems have problems such as predictable scenarios and a lack of real-time response, making it difficult to adequately train response capabilities to actual threats. Furthermore, they lack the means to increase participant engagement, limiting the learning effect.

[1147] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[1148] In this invention, the server includes means for initializing a generated artificial intelligence model, means for generating random security incident scenarios using the generated artificial intelligence model, means for executing attacks on the training information processing device based on the security incident scenarios, means for collecting and analyzing reactions and responses from the training information processing device, means for scoring and ranking the work performance of training participants based on the analysis results, means for notifying the training participants of the scores and rankings, means for storing the reaction data of the training participants in a database, means for having a data analysis tool for analysis using the data and for evaluating the response speed and accuracy of the training participants, means for using a model for scoring the work performance of the training participants, means for displaying the feedback content on a display device of the training information processing device, and means for notifying the feedback content by email. This makes it possible to provide unpredictable security incident scenarios in real time and improve the practical response ability and engagement of participants.

[1149] A "generated artificial intelligence model" is an algorithm that learns from various data and generates predictions and scenarios for specific tasks.

[1150] "Means for initialization" refers to the means for carrying out preparatory work to put the generated artificial intelligence model into operation, and refers to the process of loading the model and making the necessary settings.

[1151] A "security incident scenario" is a hypothetical incident that mimics various threats to information systems, such as attacks over networks and unauthorized access.

[1152] A "training information processing device" is a computer device operated by participants receiving security training, and operates based on instructions from a server.

[1153] A "training participant" is a user who takes part in a security training and deals with a scenario while operating a training information processing device.

[1154] The "means for collecting and analyzing reactions and responses" refers to the process of collecting log data from the training information processing device and analyzing the data to evaluate the participants' responses based on that data.

[1155] The "means for scoring business performance and generating rankings" refers to a means for quantifying the speed and accuracy of participants' responses based on collected data and ranking the performance of all participants.

[1156] "Data analysis tools" are software or libraries used to analyze collected data, including, for example, Python's Pandas and Scikit-learn.

[1157] The "means for displaying feedback content" is a means for displaying the scoring results and rankings of each participant on the screen of the training information processing device after the training is completed.

[1158] "Means of notifying by email" refers to a means of notifying participants of the results of scoring and ranking via email.

[1159] A "database" is a data management system that stores collected data and analysis results and allows access as needed.

[1160] MODE FOR CARRYING OUT THE INVENTION

[1161] The present invention relates to a system that generates random security incident scenarios in real time using a generative AI model and executes attacks on a training information processing device. Specific embodiments of the system are described below.

[1162] Server configuration and operation

[1163] The server initializes a generative AI model, which is built using machine learning frameworks such as TensorFlow and PyTorch. The server then initializes the model and generates random security incident scenarios, including various types of attacks, such as ransomware attacks, phishing attacks, and DDoS attacks.

[1164] To generate a security incident scenario, follow these steps:

[1165] The server inputs appropriate prompt sentences into the generative AI model and generates a scenario.

[1166] For example, use the following prompt:

[1167] Use a generative AI model to generate a real-time ransomware attack scenario and launch it on designated training devices. After the attack, collect device responses and score participants' performance.

[1168] Based on the generated security incident scenarios, the server launches attacks on the training information processing devices over the network. These attacks are carried out in real time, and the aim is for the training participants to respond to unpredictable situations.

[1169] The role of training information processing equipment

[1170] The training information processing device is installed with software that receives and responds to attacks based on scenarios sent from the server in real time. Training participants use this device to respond to actual security incidents. For example, in the event of a ransomware attack, they will respond by identifying and terminating suspicious processes on the device.

[1171] User operations

[1172] The user operates the training information processing device and responds to real-time attacks from the server. When the training begins, the user receives attacks based on the scenario and must take appropriate action. For example, the user is required to stop suspicious processes or run security software to prevent infection.

[1173] Data collection and analysis

[1174] The server collects reaction and response data sent from the training information processing device in real time. This data is analyzed using data analysis tools such as Python's Pandas and Scikit-learn. Specifically, the analysis involves analyzing what operations the training participants performed and when, and recording the results in a log.

[1175] Scoring and Feedback

[1176] The server scores the work performance of the training participants based on the collected data and generates a ranking. This scoring is performed to evaluate each participant's response speed and accuracy. The generated scores and rankings are displayed on the display device of the training information processing device from the server. Feedback is also sent by email as needed.

[1177] Specific examples

[1178] As a concrete example, consider the case of a ransomware attack scenario. The server initializes a generative AI model and generates a ransomware attack scenario. Based on this scenario, a virtual ransomware attack is launched against a training information processing device. The user begins training on the training information processing device and takes appropriate countermeasures in response to the ransomware warning that suddenly appears. After the training is complete, the server analyzes the user's response and provides the results as feedback. The feedback includes a score and ranking, which the user can use to evaluate their own response.

[1179] In this way, the system of the present invention can maximize the realism of the training and the learning effect by providing unpredictable security incident scenarios in real time. In addition, the incorporation of game elements can increase the engagement of training participants.

[1180] The flow of the identification process in the first embodiment will be described with reference to FIG.

[1181] Step 1:

[1182] The server initializes the generative AI model. First, it loads a pre-trained model using a machine learning framework such as TensorFlow or PyTorch. This is done using functions such as tensorflow.keras.models.load_model. During this initialization process, it logs the time it takes to load the model and the memory usage. The input is the pre-saved model file, and the output is the initialized AI model.

[1183] Specific operation:

[1184] The server calls the load_model function to load the model file.

[1185] Use the logging module to log that the model has finished loading.

[1186] Step 2:

[1187] The server generates security incident scenarios using the initialized generative AI model. Random prompt sentences are input into the generative AI model to generate various security incident scenarios. For example, a prompt sentence that generates a "ransomware attack scenario" is input. The input of this process is the prompt sentence, and the output is the generated security incident scenario.

[1188] Specific operation:

[1189] The server generates a prompt sentence and feeds it into the AI ​​model.

[1190] A generative AI model generates scenarios and logs their contents.

[1191] Step 3:

[1192] The server executes an attack on the training information processing device based on the generated security incident scenario. Specifically, it sends attack packets to specified ports and IP addresses according to the attack method defined in the scenario. The input to this process is the generated security incident scenario, and the output is a transmission log of the attack packets.

[1193] Specific operation:

[1194] The server creates appropriate attack packets based on the scenario.

[1195] The IP address and port of the training information processing device are specified and attack packets are sent.

[1196] Log details of the attack packets sent.

[1197] Step 4:

[1198] The terminal receives the attack from the server and records the reaction and response in a log, which includes actions such as stopping suspicious processes and running security software. The input to this process is the attack from the server, and the output is a log file recording the response.

[1199] Specific operation:

[1200] The terminal monitors and receives attack packets from the server.

[1201] Log the actions taken by the user and send the log to a server.

[1202] Step 5:

[1203] The server collects the log data sent from the training information processing device and performs data analysis. This analysis uses Python's Pandas and Scikit-learn. Based on the collected data, it analyzes the timestamp of each operation and the status of process stoppages. The input to this process is the corresponding log sent from the training information processing device, and the output is the analysis results.

[1204] Specific operation:

[1205] The server receives the log data transmitted from the training information processing device and stores it in a database.

[1206] Analyze the saved data using Pandas and Scikit-learn.

[1207] Step 6:

[1208] Based on the analysis results, the server scores the work performance of the training participants and generates a ranking of all participants. The results are a numerical evaluation of each participant's response speed and accuracy. The input to this process is the analysis results, and the output is a score and ranking.

[1209] Specific operation:

[1210] The server uses Scikit-learn to run a scoring model for each participant and evaluate their business performance.

[1211] The scores of all participants are compared and a ranking is generated.

[1212] Step 7:

[1213] The server notifies the training participants of the scoring and ranking results. Notification methods include email and the display device of the training information processing device. The input to this process is the scoring and ranking results, and the output is the notified feedback.

[1214] Specific operation:

[1215] The server uses the scoring results and rankings to create feedback content.

[1216] The created feedback content is sent by email and is also displayed on the display device of the training information processing device.

[1217] In this way, the system of the present invention cultivates advanced security response capabilities through detailed procedures and real-time attack simulations. Furthermore, by combining data analysis and feedback, it promotes skill development among participants and enables effective training.

[1218] (Application example 1)

[1219] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1220] In today's world, cyber attacks are becoming increasingly complex and diverse, creating a need for security training in realistic environments. However, conventional security training systems use fixed scenarios, resulting in insufficient preparation for actual attacks. Furthermore, there are issues with low engagement among training participants, making it difficult to maximize learning outcomes. To address these issues, a new method is needed to provide random security incident scenarios in real time and improve users' response capabilities.

[1221] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[1222] In this invention, the server includes means for initializing a generative artificial intelligence model, means for generating random security incident scenarios using the generative artificial intelligence model, means for executing attacks on training terminals based on the security incident scenarios, means for collecting and analyzing reactions and responses from the training terminals, means for scoring and generating rankings of training participants' performance based on the analysis results, means for notifying the training participants of the scoring and rankings, means for providing the security incident scenarios in real time using a smartphone and collecting user responses, and means for analyzing the responses on a cloud server and generating feedback. This enables training in security scenarios that change in real time, thereby improving users' ability to respond quickly and accurately to actual cyber attacks.

[1223] A "generative artificial intelligence model" is a type of artificial intelligence that has the ability to generate new information and scenarios based on various data.

[1224] A "security incident scenario" is a hypothetical situation that mimics potential attacks or unauthorized access to computer systems or networks.

[1225] A "training terminal" is a device such as a computer or smartphone used to conduct security training.

[1226] "Scoring" is the process of quantifying and evaluating the response capabilities of training participants.

[1227] The "ranking" refers to the ranking of the training participants' performance based on the scored results.

[1228] A "smartphone" is a small computer that can run a variety of applications in addition to the functions of a mobile phone.

[1229] "Cloud server" refers to a virtualized infrastructure of servers that are available remotely over the internet.

[1230] "Real-time" means that processing or information is provided immediately in actual time.

[1231] "Feedback" refers to information indicating evaluations and areas for improvement provided after analyzing the results of training participants' responses.

[1232] "Engagement" means that participants remain actively involved and interested in the training.

[1233] MODE FOR CARRYING OUT THE INVENTION

[1234] System Overview

[1235] This invention is a system that generates security incident scenarios in real time and conducts simulated attacks on users' smartphones to train them on security measures. This system mainly consists of a server, a smartphone (training terminal), and a user.

[1236] Server-side processing

[1237] Initialization

[1238] The server first initializes a generative artificial intelligence model, which has the ability to generate new security incident scenarios based on various data using the generative AI model.

[1239] Scenario Generation

[1240] The server inputs the following prompt to the generative AI model:

[1241] "Generate a randomly selected cyber attack scenario. The scenario will be output in the following format: Attack type: [Type], Attack method: [Method], Attack route: [Route], Countermeasure: [Countermeasure]"

[1242] The generative AI model generates random security incident scenarios based on this prompt.

[1243] Scenario distribution and attack execution

[1244] The generated scenario is sent to the smartphone in real time, and a simulated attack is executed. For example, if the scenario is "Attack type: malware, Attack method: phishing email, Attack route: unknown link, Action: delete suspicious email and activate security software," the smartphone will receive a phishing email.

[1245] Processing on the smartphone side

[1246] Reactions and responses

[1247] Users must use their smartphones to respond quickly and appropriately to simulated attacks based on the scenario, such as deleting suspicious links and activating security software.

[1248] Data collection

[1249] The smartphone collects the user's responses and sends them to a server, which evaluates the user's actual countermeasure actions.

[1250] Server-side analysis and feedback

[1251] Data analysis

[1252] The server analyzes the user's response data sent from the smartphone and scores the user's performance. The analysis is performed using a cloud server and advanced data analysis algorithms.

[1253] Evaluation and Notification

[1254] Based on the scoring results, users' performance is displayed in a ranking format, allowing them to understand their own response capabilities.

[1255] Specific examples

[1256] In the system of the present invention, as a specific example, the following prompt sentence is input to the generative AI model:

[1257] "Generate a randomly selected cyber attack scenario. The scenario will be output in the following format: Attack type: Malware, Attack method: Phishing email, Attack route: Unknown link, Action to take: Delete the suspicious email and launch security software."

[1258] This allows the generative AI model to generate random security scenarios like those described above, enabling realistic training on a smartphone.

[1259] Through this system, users can conduct practical response training for unpredictable security incident scenarios and effectively improve their security response capabilities.

[1260] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[1261] Step 1:

[1262] The server initializes the generated AI model

[1263] Input: Initial setting data for the generative AI model

[1264] Specific operation: The server reads the initialization file of the generative AI model and initializes the model, which includes setting model parameters and preparing training data.

[1265] Output: An initialized generative AI model

[1266] Step 2:

[1267] The server generates security incident scenarios

[1268] Input: Initialized generative AI model, prompt

[1269] Specific operation: The server inputs the following prompt to the generative AI model:

[1270] "Generate a randomly selected cyber attack scenario. The scenario will be output in the following format: Attack type: [Type], Attack method: [Method], Attack route: [Route], Countermeasure: [Countermeasure]"

[1271] Data processing and calculation: The generative AI model generates random security incident scenarios based on prompt statements.

[1272] Output: Generated security incident scenario

[1273] Step 3:

[1274] The server distributes the scenario and executes the attack.

[1275] Input: Generated security incident scenario

[1276] Specific operation: The server delivers the generated scenario to the smartphone in real time, after which a pseudo-attack based on the scenario is executed.

[1277] Output: Security incident scenarios and simulated attacks delivered to the user's smartphone

[1278] Step 4:

[1279] Users respond on their smartphones

[1280] Input: Security incident scenarios and simulated attacks delivered to smartphones

[1281] Specific actions: The user takes action based on the security scenario on their smartphone, for example, deleting a suspicious link or launching security software.

[1282] Output: User's response action

[1283] Step 5:

[1284] The smartphone collects the corresponding data and sends it to the server.

[1285] Input: User action

[1286] Specific operation: The smartphone collects data on the actions taken by the user and sends it to the server in real time.

[1287] Output: Corresponding data sent to the server

[1288] Step 6:

[1289] The server analyzes the corresponding data

[1290] Input: Corresponding data sent from the smartphone

[1291] How it works: The server analyzes the response data and scores the user's performance. The analysis uses machine learning algorithms to evaluate the speed and accuracy of the user's response.

[1292] Output: Scoring results

[1293] Step 7:

[1294] The server reflects the scoring results in the rankings.

[1295] Input: Scoring results

[1296] Specific operation: The server generates a ranking based on the scores of all users. The ranking indicates each user's ability and displays their relative position.

[1297] Output: The generated rankings

[1298] Step 8:

[1299] The server notifies the user of the ranking and feedback

[1300] Input: Generated rankings, parsed feedback information

[1301] Specific operation: The server notifies the user of the generated ranking and feedback information via their smartphone. The feedback includes specific improvements and evaluation comments.

[1302] Output: Ranking and feedback given to the user

[1303] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[1304] The present invention relates to a system that uses a generative artificial intelligence model to generate random security incident scenarios in real time, and combines it with an emotion engine that recognizes user emotions. The system is composed of a server, a training terminal, an emotion engine, and a user.

[1305] Server-side processing

[1306] The server first initializes a generative AI model. This model is an AI algorithm that learns from multiple data sets and makes predictions and generates responses to specific tasks. After initialization is complete, the server uses the model to generate random security incident scenarios. These scenarios simulate various types of attacks and unauthorized access to computer systems and networks, and provide specific situations in real time.

[1307] Based on the generated security incident scenario, the server executes attacks on the training terminals over the network. These attacks are random and unpredictable, creating a realistic sense of tension for the training participants.

[1308] After the attack is launched, the server collects the reactions and responses from the training devices, along with the users' emotional data obtained from the emotion engine. The emotional data includes the users' stress levels and motivation. The server analyzes this data and evaluates the training participants' performance.

[1309] After the analysis, the server scores the participants' performance and generates a ranking. The server then notifies the participants of these scores and rankings and provides them as a feedback report. This allows participants to understand not only their own response abilities but also their overall performance, including their emotions, and identify areas for improvement.

[1310] User processing

[1311] The user starts training using the training device and emotion engine. Once training begins, the server receives attacks based on the scenario and the user must respond in real time. For example, if a ransomware attack scenario occurs, the user must stop suspicious processes and run security software.

[1312] Furthermore, the emotion engine collects user emotional data in real time, detecting the user's stress level and motivation during training to evaluate their ability to respond in more realistic situations, further enhancing the realism of training and learning effectiveness.

[1313] After completing the training, users receive feedback from the server to check their performance, which allows them to acquire higher security response and emotional management skills.

[1314] Specific examples

[1315] As a concrete example, consider a ransomware attack scenario. The server initializes the generative AI model and randomly selects "ransomware attack" to create a scenario. Based on this scenario, the server launches a virtual ransomware attack on a training device.

[1316] The user begins training using a training device and the emotion engine, and takes appropriate action in response to a sudden ransomware warning. These actions include terminating suspicious processes and running security software. During the training, the emotion engine detects the user's stress level and motivation in real time.

[1317] After training is complete, the server collects and analyzes the user's reaction and emotional data. Finally, it scores and ranks the user based on the analysis results and notifies them to the user. Based on the feedback, the user can understand how to improve their response skills and emotional management.

[1318] In this way, the system of the present invention not only provides unpredictable security incident scenarios in real time, but also maximizes the realism of the training and the learning effect by recognizing and reflecting the user's emotions in the evaluation. Furthermore, the introduction of game elements can increase the engagement of training participants.

[1319] The processing flow will be explained below.

[1320] Step 1:

[1321] The server initializes the generative AI model. Specifically, it loads the pre-trained generative AI model into memory space and sets the necessary parameters (e.g., attack start time, attack frequency, etc.).

[1322] Step 2:

[1323] The server generates random security incident scenarios using a generative AI model. The server generates scenarios from the AI ​​model based on triggers and converts them into a format that the system can interpret.

[1324] Step 3:

[1325] The server executes attacks against the training terminals over the network based on the generated security scenarios. The attack scenarios are random and unpredictable.

[1326] Step 4:

[1327] The server initializes the emotion engine and prepares it for real-time recognition of the user's emotions. The emotion engine collects emotion data by detecting the user's facial expressions, tone of voice, body temperature, etc.

[1328] Step 5:

[1329] The terminal receives and displays alerts based on attack scenarios sent from the server, which indicate the specific type of attack and suggest countermeasures.

[1330] Step 6:

[1331] The user can take appropriate countermeasures based on the alert displayed on the device, such as stopping suspicious processes or running security software.

[1332] Step 7:

[1333] The device records the user's response actions and sends them to the server, along with the user's emotion data collected by the emotion engine.

[1334] Step 8:

[1335] The server collects and analyzes data sent from the training terminals and emotional data from the emotion engine, including the time taken to take action, success / failure information, and the user's emotional state.

[1336] Step 9:

[1337] The server scores the training participants' performance based on the results of the data analysis, and also evaluates them by taking into account their emotional data, resulting in a comprehensive score.

[1338] Step 10:

[1339] The server generates a ranking based on the analysis results and notifies the training participants, which includes feedback based on each participant's score and emotional data.

[1340] Step 11:

[1341] Users receive feedback reports from the server and see specific advice on their performance and emotional state, allowing them to understand how to improve for their next training session.

[1342] Example 2

[1343] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1344] Conventional security training systems rely on specific scenarios and fixed attack patterns, which limits the effectiveness of training and prevents training participants from fully improving their ability to respond to real security risks. Furthermore, they do not take into account the emotions and stress levels of users during training, making it difficult to evaluate training in a realistic situation. Furthermore, they do not provide immediate feedback, making it difficult to maintain participants' motivation.

[1345] The specific processing by the specific processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means.

[1346] In this invention, the server includes means for initializing a generative AI model, means for generating random security incident scenarios using the generative AI model, means for executing attacks against an information processing device based on the security incident scenarios, means for collecting and analyzing reactions and responses from the information processing device and emotion data acquired from an emotion recognition device, means for scoring and ranking training participants' performance based on the analysis results, and means for notifying training participants of the scoring and ranking. This enables users to improve their ability to respond to a variety of realistic security incident scenarios and enables comprehensive evaluation that takes emotion data into account. Furthermore, immediate feedback can maintain training participants' motivation, enabling more effective training.

[1347] A "generative artificial intelligence model" is an artificial intelligence algorithm that learns from multiple data sets and makes predictions and generates responses to specific tasks.

[1348] A "random security incident scenario" is a scenario that randomly generates specific situations that mimic various types of attacks and unauthorized access to computer systems and networks.

[1349] An "information processing device" is a device that inputs, processes, and outputs data, and includes computers and servers used as training terminals.

[1350] An "emotion recognition device" is a device for collecting and analyzing a user's emotional data, and includes a wearable device, a camera, and dedicated analysis software.

[1351] "Scoring" is the process of analyzing collected data and quantifying and evaluating the performance of training participants.

[1352] "Ranking" refers to arranging training participants in order of evaluation based on the scored results.

[1353] A "feedback report" is a report that notifies training participants of the evaluation results and areas for improvement.

[1354] The present invention relates to a system that generates random security incident scenarios in real time using a generative artificial intelligence model, and combines it with an emotion engine that recognizes user emotions. This system is composed of a server, an information processing device, an emotion recognition device, and a user.

[1355] The server first initializes a generative artificial intelligence model. This model is built using deep learning frameworks such as TensorFlow and PyTorch. Once initialization is complete, the server uses the model to generate random security incident scenarios. These scenarios mimic various types of attacks and unauthorized access to computer systems and networks, providing specific situations in real time.

[1356] Based on the generated security incident scenario, the server launches attacks against information processing devices over the network. These attacks are unpredictable, creating a realistic sense of tension for participants.

[1357] When an attack is launched, the server collects the reaction and response data from the information processing device. It also collects the user's emotional data obtained from the emotion recognition device. This data includes the user's stress level and motivation. The server analyzes the collected data and evaluates the training participant's performance.

[1358] After the analysis, the server scores the training participants' performance and generates a ranking. The server also notifies the participants of these scores and rankings and provides them as a feedback report, allowing them to understand their security response capabilities and emotional management skills and understand areas for improvement.

[1359] The user starts training using the information processing device and emotion recognition device. Once training begins, the user receives attack scenarios from the server and must respond in real time. For example, if a ransomware attack scenario occurs, the user must stop suspicious processes and run security software.

[1360] Furthermore, the emotion recognition device collects user emotional data in real time, detecting the user's stress level and motivation during training, allowing for evaluation of the user's ability to respond in more realistic situations.

[1361] As a concrete example, consider a ransomware attack scenario. The server initializes a generative artificial intelligence model using TensorFlow, randomly selects "ransomware attack," and generates a scenario. Based on this scenario, the server launches a virtual ransomware attack on an information processing device.

[1362] The user begins training using the information processing device and emotion recognition device, and responds appropriately to sudden ransomware warnings. This response includes terminating suspicious processes and running security software. During training, the emotion recognition device detects the user's stress level and motivation in real time.

[1363] After the training is complete, the server collects and analyzes the user's reaction and emotional data. Finally, it scores and ranks the user based on the analysis results and notifies them to the user. Based on the feedback, the user can understand how to improve their response skills and emotional management.

[1364] The system maximizes the realism of training and learning effectiveness by providing unpredictable security incident scenarios in real time and recognizing and reflecting user emotions in evaluations. It also incorporates game elements to increase participant engagement.

[1365] Example prompt sentence:

[1366] 1. "Please tell me how attack scenarios are generated in the real-time security assessment system."

[1367] 2. "Please explain the details of your security training system, including user sentiment data."

[1368] The flow of the identification process in the second embodiment will be described with reference to FIG.

[1369] Step 1:

[1370] The server initializes the generative artificial intelligence model.

[1371] Input: Parameter files for the model and libraries required for initialization (e.g. TensorFlow or PyTorch).

[1372] Data processing: Load model parameters and initialize the model.

[1373] Output: An initialized generative artificial intelligence model.

[1374] Specific operation: The server loads the model parameter file saved in advance and builds a generative AI model based on it. Next, it loads the necessary libraries (TensorFlow and PyTorch) and initializes the model.

[1375] Step 2:

[1376] The server generates random security incident scenarios using the initialized generative artificial intelligence model.

[1377] Input: An initialized generative artificial intelligence model, a library of security incident scenarios (ransomware attacks, phishing attacks, etc.).

[1378] Data processing: Introduce randomness into the model to generate security incident scenarios.

[1379] Output: Generated security incident scenarios.

[1380] How it works: The server inputs specific parameters into the initialized model and generates random scenarios, such as ransomware attacks and phishing attacks.

[1381] Step 3:

[1382] The server executes an attack on the information processing device based on the generated security incident scenario.

[1383] Input: Generated security incident scenario, IP address and connection information of information processing device.

[1384] Data processing: Create attack packets according to the scenario and send them over the network.

[1385] Output: Execution of an attack against information processing equipment.

[1386] Specific operation: The server creates an attack packet based on the scenario and sends it to the information processing device. For example, in the case of a ransomware attack, it sends a virtual ransomware payload to the information processing device.

[1387] Step 4:

[1388] The server collects the reaction and response data from the information processing device, and the emotion data obtained from the emotion recognition device.

[1389] Input: System log of the information processing device after the attack, emotion data from the emotion recognition device.

[1390] Data processing: Collecting log data and sentiment data and converting them into an analyzable format.

[1391] Output: Reaction and sentiment data in a parsable format.

[1392] Specific operation: The server collects system logs from the information processing device and extracts data necessary for analyzing responses to attacks. At the same time, it collects user emotion data obtained from the emotion recognition device.

[1393] Step 5:

[1394] The server analyzes the collected data and scores the performance of the training participants.

[1395] Input: Reaction and emotion data in a parsable format.

[1396] Data processing: Analyze the data using data mining and machine learning algorithms to calculate a score.

[1397] Output: Performance scores of training participants.

[1398] Specific operation: The server analyzes the collected data using machine learning algorithms and calculates a performance score based on the training participants' reactions and emotional data.

[1399] Step 6:

[1400] The server generates a ranking based on the scoring results and notifies the training participants.

[1401] Input: Training participant performance scores.

[1402] Data processing: Training participants are ranked based on their scores.

[1403] Output: Ranking results and feedback report.

[1404] Specific operation: The server generates a ranking based on the performance score and notifies the training participants. Notifications are sent via email or dashboard updates. Users can check their own performance based on this and identify areas for improvement.

[1405] (Application example 2)

[1406] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1407] Conventional security training systems only evaluated users' response capabilities and provided insufficient feedback to provide effective learning. Furthermore, because the evaluation was conducted without taking into account the emotions and stress levels of the training participants, the system lacked realism and limited learning effectiveness. Furthermore, the lack of ingenuity to increase training engagement made it difficult to provide continuous training.

[1408] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 2 is realized by the following means.

[1409] In this invention, the server includes means for initializing a generative AI model, means for generating random security incident scenarios using the generative AI model, means for executing attacks against training terminals based on the security incident scenarios, means for collecting and analyzing reactions and responses from the training terminals, means for scoring and ranking training participants' performance based on the analysis results, means for collecting and analyzing user emotional data from the training terminals, means for notifying training participants of the scoring and analysis, and means for providing feedback and adjusting training content based on the user emotional data. This enables evaluation that takes into account not only the user's response ability but also their emotions, making security training more effective and realistic. Furthermore, incorporating game elements can increase training engagement and promote continuous learning.

[1410] A "generative artificial intelligence model" is an algorithm that learns from multiple data sets and makes predictions and generates information for specific tasks.

[1411] "Security incident scenarios" provide specific real-time situations that mimic various types of attacks and unauthorized access to computer systems and networks.

[1412] A "training terminal" is an information processing device that is subjected to an attack based on a security incident scenario and is used to respond to the attack.

[1413] "Emotional Data" refers to data collected by the emotion recognition engine, including the user's stress level, motivation, etc.

[1414] "Scoring" is the process of numerically evaluating a user's ability to respond.

[1415] "Ranking" refers to the process of ranking based on the scoring results of multiple training participants.

[1416] "Feedback" refers to a report that includes an evaluation of the training content and advice provided to the user based on the analysis results.

[1417] "Game elements" are gamification elements introduced to increase training engagement.

[1418] "Engagement" refers to the level of involvement and enthusiasm that users maintain in the training.

[1419] "Training participant" means a user who receives training using the security training system.

[1420] "Real time" refers to a state in which processing occurs immediately without delay.

[1421] "Analysis" is the process of examining information and drawing conclusions based on collected data.

[1422] The present invention relates to a security training system that uses a generative artificial intelligence model to generate random security incident scenarios in real time and evaluate users' response capabilities and emotions. The system is composed of a server, a training terminal, an emotion engine, and users.

[1423] Server side:

[1424] The server first initializes a generative artificial intelligence model. This AI model is trained using machine learning libraries such as TensorFlow and Keras. The model learns from multiple datasets and generates random security incident scenarios in real time. The generated scenarios include ransomware attacks, phishing attacks, and DDoS attacks.

[1425] After the training scenario is generated, the server executes attacks against the training device based on the scenario. The attacks are unpredictable, providing a realistic sense of tension and learning effect. When the attack is executed, the training device responds and sends the response data to the server.

[1426] At the same time, emotional data from the training participants is collected in real time. The emotion engine uses OpenCV to detect stress levels and motivation from users' facial expressions. This data is sent from the training device to a server and analyzed by an AI model.

[1427] The server scores the performance of the training participants based on the collected response and emotion data. It also generates a ranking based on the scores of multiple training participants and notifies the user. Detailed feedback is provided along with the ranking results. The feedback includes an evaluation of not only response ability but also emotion management.

[1428] What you need to do:

[1429] The user starts training using the training terminal. Based on the security scenarios sent from the server, the user responds in real time. For example, if a ransomware attack scenario occurs, the user stops the suspicious process and runs security software.

[1430] The emotion engine continues to collect user emotion data during training. After training, users can receive feedback from the server to check their performance. Based on this feedback, users can understand how to improve their response skills and emotion management.

[1431] Examples:

[1432] As a concrete example, consider the "phishing email scenario." In this scenario, the server uses an AI model to simulate a phishing email attack. Users use training devices to verify the sender of the email and check the safety of the links. The accuracy and speed of the response are evaluated, and the emotion engine detects stress levels.

[1433] After completing the training, the server provides feedback such as "Response score: 85, Stress level: 0.65," allowing users to understand areas for improvement in their response skills and emotional management.

[1434] Example prompt sentence:

[1435] "Use AI models to generate real-time security incident scenarios and leverage emotion recognition engines to build models that assess users' stress levels and readiness to respond."

[1436] This provides a concrete understanding of how this AI system can make security training more effective.

[1437] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[1438] Step 1:

[1439] The server initializes the generative artificial intelligence model. The input used is a pre-trained model file. Based on this, the server initializes the AI ​​model. The output is the initialized AI model.

[1440] Step 2:

[1441] The server generates random security incident scenarios using the initialized AI model. The inputs are the AI ​​model and a dataset of past security incidents and attacks. The AI ​​model extracts important features and generates random security incident scenarios based on those features. The output is the generated security incident scenario.

[1442] Step 3:

[1443] The server executes attacks against the training terminal based on the generated security incident scenario. The input requires the scenario and information about the training terminal. The server analyzes the scenario and sends commands and triggers to the terminal to execute the virtual attack. The output is the state of the training terminal when the attack is executed.

[1444] Step 4:

[1445] The training terminal collects responses made by users to virtual attacks from the server. The inputs required are attack information from the server and user operation information. The terminal captures user operation logs and reactions in real time. The output is the collected response data.

[1446] Step 5:

[1447] The device collects the user's emotional data in real time. The input requires data from sensor devices such as cameras and microphones. The emotion engine analyzes this data and generates emotional data such as stress level and motivation. The output is the analyzed emotional data.

[1448] Step 6:

[1449] The server receives the reaction data and emotion data collected from the training device. The reaction data and emotion data are required as input. The server analyzes these data with an AI model to evaluate the user's response ability and emotional state. The output is a performance score, which is the analysis result.

[1450] Step 7:

[1451] The server scores users' performance based on the analysis results and generates rankings. The analysis results are required as input. The server calculates the scores and creates rankings based on the scores of multiple users. The output is the scoring and ranking results.

[1452] Step 8:

[1453] The server notifies the user of the scoring and ranking results. The inputs required are the scoring and ranking results. The server generates this information as a feedback report and sends it to the user via the training terminal. The output is the feedback report received by the user.

[1454] Step 9:

[1455] Users review the feedback report to understand areas for improvement in their response skills and emotional management. The input required is the feedback report. Users use the feedback to learn and improve their future responses. The output is the user's improved response skills and emotional management.

[1456] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[1457] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1458] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the robot 414.

[1459] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[1460] FIG. 9 is a diagram illustrating an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and actions arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion includes both affect and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[1461] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[1462] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[1463] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. Emotions can also be created for robots, automobiles, and motorcycles, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on Voice Emotion Recognition and Emotional Brain Physiological Signal Analysis Systems, Tokushima University, Doctoral Dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the "reaction" domain, where sensation is dominant. The right half of the emotion map lists emotions belonging to the "situation" domain, where situational awareness is dominant.

[1464] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[1465] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[1466] The system according to the present disclosure has been described above mainly with respect to the functions of the data processing device 12, but the system according to the present disclosure is not necessarily implemented on a server. The system according to the present disclosure may be implemented as a general information processing system. The present disclosure may be implemented, for example, as a software program running on a personal computer or an application running on a smartphone, etc. The method according to the present disclosure may be provided to users in the form of SaaS (Software as a Service).

[1467] In the above embodiment, an example was given in which the specific processing is performed by one computer 22, but the technology of the present disclosure is not limited to this, and the specific processing may be distributed and performed by a plurality of computers including the computer 22. For example, the data generation model 58 may be provided in an external device of the data processing device 12, and data may be generated in the external device in accordance with input data.

[1468] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[1469] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[1470] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[1471] The hardware resource for executing a specific process can be any of the following processors: An example of a processor is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. Another example of a processor is a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[1472] The hardware resource that executes the specific processing may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific processing may be a single processor.

[1473] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[1474] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[1475] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[1476] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[1477] The following is further disclosed regarding the above embodiment.

[1478] (Claim 1)

[1479] means for initializing the generative artificial intelligence model;

[1480] means for generating random security incident scenarios using the generative artificial intelligence model;

[1481] means for executing an attack on a training terminal based on the security incident scenario;

[1482] means for collecting and analyzing responses and responses from said training terminals;

[1483] a means for scoring and ranking the performance of training participants based on the analysis results;

[1484] means for notifying training participants of said scoring and ranking;

[1485] …

[1486] A system including:

[1487] (Claim 2)

[1488] 10. The system of claim 1, further comprising means for increasing training participant engagement by introducing game elements into the training environment.

[1489] (Claim 3)

[1490] 10. The system of claim 1, further comprising means for analyzing the collected data and generating and providing a feedback report to the training participants.

[1491] "Example 1"

[1492] (Claim 1)

[1493] means for initializing the artificial intelligence model to be generated;

[1494] means for generating random security incident scenarios using the generated artificial intelligence model;

[1495] means for executing an attack on the training information processing device based on the security incident scenario;

[1496] means for collecting and analyzing responses and reactions from said training information processing device;

[1497] A means for scoring and ranking the work performance of the training participants based on the analysis results;

[1498] means for informing training participants of said scoring and ranking;

[1499] means for storing the reaction data of the training participants in a database;

[1500] a means for evaluating the speed and accuracy of responses of training participants, the means having a data analysis tool for analysis using the data;

[1501] means for using the model to score the performance of said training participants;

[1502] means for displaying the feedback content on a display device of the training information processing device;

[1503] means for notifying the user of the feedback content by email;

[1504] A system including:

[1505] (Claim 2)

[1506] 10. The system of claim 1, further comprising means for increasing training participant engagement by introducing game elements into the training environment.

[1507] (Claim 3)

[1508] 10. The system of claim 1, further comprising means for analyzing the collected data and generating and providing a feedback report to the training participants.

[1509] "Application Example 1"

[1510] (Claim 1)

[1511] means for initializing the generative artificial intelligence model;

[1512] means for generating random security incident scenarios using the generative artificial intelligence model;

[1513] means for executing an attack on a training terminal based on the security incident scenario;

[1514] means for collecting and analyzing responses and responses from said training terminals;

[1515] a means for scoring and ranking the performance of training participants based on the analysis results;

[1516] means for notifying training participants of said scoring and ranking;

[1517] a means for providing the security incident scenario in real time using a smartphone and collecting responses from users;

[1518] a means for analyzing the response on a cloud server and generating feedback;

[1519] A system including:

[1520] (Claim 2)

[1521] 10. The system of claim 1, further comprising means for increasing training participant engagement by introducing game elements into the training environment.

[1522] (Claim 3)

[1523] 10. The system of claim 1, further comprising means for analyzing the collected data and generating and providing a feedback report to the training participants.

[1524] "Example 2: Combining Emotion Engines"

[1525] (Claim 1)

[1526] means for initializing the generative artificial intelligence model;

[1527] means for generating random security incident scenarios using the generative artificial intelligence model;

[1528] means for executing an attack on an information processing device based on the security incident scenario;

[1529] means for collecting and analyzing reactions and responses from the information processing device and emotion data obtained from the emotion recognition device;

[1530] a means for scoring and ranking the performance of training participants based on the analysis results;

[1531] means for notifying training participants of said scoring and ranking;

[1532] A system including:

[1533] (Claim 2)

[1534] 10. The system of claim 1, further comprising means for increasing training participant engagement by introducing game elements into the training environment.

[1535] (Claim 3)

[1536] 10. The system of claim 1, further comprising means for analyzing the collected data and generating and providing a feedback report to the training participants.

[1537] "Application example 2 when combining emotion engines"

[1538] (Claim 1)

[1539] means for initializing the generative artificial intelligence model;

[1540] means for generating random security incident scenarios using the generative artificial intelligence model;

[1541] means for executing an attack on a training terminal based on the security incident scenario;

[1542] means for collecting and analyzing responses and responses from said training terminals;

[1543] a means for scoring and ranking the performance of training participants based on the analysis results;

[1544] means for collecting and analyzing user emotion data from the training terminal;

[1545] means for informing training participants of said scoring and analysis;

[1546] The system includes a means for providing feedback and adjusting training content based on the user's emotional data.

[1547] (Claim 2)

[1548] 10. The system of claim 1, further comprising means for increasing training participant engagement by introducing game elements into the training environment.

[1549] (Claim 3)

[1550] 10. The system of claim 1, further comprising means for analyzing the collected data and generating and providing a feedback report to the training participants. [Explanation of symbols]

[1551] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot< / url:> < / url:> < / url:> < / url:>

Claims

1. means for initializing the generative artificial intelligence model; means for generating random security incident scenarios using the generative artificial intelligence model; means for executing an attack on a training terminal based on the security incident scenario; means for collecting and analyzing responses and responses from said training terminals; a means for scoring and ranking the performance of training participants based on the analysis results; means for notifying training participants of said scoring and ranking; A system including:

2. 10. The system of claim 1, further comprising means for increasing training participant engagement by introducing game elements into the training environment.

3. 10. The system of claim 1, further comprising means for analyzing the collected data and generating and providing a feedback report to the training participants.

Images